Florida Security of Communications Act: all-party consent, pixels, chat and session replay

Fla. Stat. §934.03(1)(a) makes it unlawful for any person who "Intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept any wire, oral, or electronic communication". It also covers disclosure and use of contents a person knows were intercepted (§934.03(1)(c)–(d)).

Consent. "It is lawful … for a person to intercept a wire, oral, or electronic communication when all of the parties to the communication have given prior consent to such interception" (§934.03(2)(d)).

Definitions in §934.02:

• Intercept: "the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device".
• Contents: "any information concerning the substance, purport, or meaning of that communication".
• Electronic communication excludes "Any communication from an electronic or mechanical device which permits the tracking of the movement of a person or an object" (§934.02(12)(c)).

Pen registers. Section 934.31(1) provides that "no person may install or use a pen register or a trap and trace device without first obtaining a court order", with an exception for providers where "the consent of the user of the service has been obtained".

For an interception claim the elements are:

• an intentional interception or procurement;
• of the contents of an electronic communication;
• by a device;
• without the prior consent of all parties.

Section 934.10(1) gives "Any person whose wire, oral, or electronic communication is intercepted, disclosed, or used in violation of ss. 934.03-934.09" a civil action. The person may recover:

• equitable relief;
• "Actual damages, but not less than liquidated damages computed at the rate of $100 a day for each day of violation or $1,000, whichever is higher";
• punitive damages;
• attorney’s fees.

The civil remedy is limited to ss. 934.03–934.09. We have not confirmed a private damages remedy for the §934.31 pen register prohibition.

• Limitations period: "not … later than 2 years after the date upon which the claimant first has a reasonable opportunity to discover the violation" (§934.10(3)).
• Standing: federal plaintiffs also need a concrete injury; see standing.

Fisher Phillips describes four waves (Fisher Phillips, 6 January 2026):

• Session replay, from 2021, which mostly failed.
• Pixels on patient portals, then on consumer sites. The firm describes a December 2025 class action against Nike alleging tracking with no consent banner and Global Privacy Control ignored.
• Website chat recordings, filed by repeat "tester" plaintiffs in small claims court with a jurisdictional limit under USD 8,000.
• Email tracking pixels, in demand letters that call open-and-click trackers trap and trace devices.

These are allegations reported by a defence firm. The complaints themselves were not reviewed for this page.

What the rulings turn on. Goldstein treated page views as addressing information. It followed In re Zynga and distinguished In re Nickelodeon's point that some URLs "may convey substantive information". So a pixel that sends a search term, a form field or a URL describing a health condition is the stronger Florida claim; clicks and scrolls are the weaker one. All-party consent means the site’s own consent does not answer the claim. The visitor’s prior consent does.

We did not find a Florida appellate decision on website pixels or chat under the FSCA.

Status, 17 October 2026: in force. We found no enacted amendment addressing website tracking. Commentators name Florida as a destination for claims displaced by SB 690 (Jeffer Mangels, 25 September 2026). Fisher Phillips also urged businesses to support efforts to amend the statute. Whether email trap and trace theories carry a private remedy is untested in the decisions we reviewed.

Florida’s all-party rule means the visitor’s prior consent is the defence that matters:

• Hold pixels, chat recording and session replay until the visitor agrees, under an opt-in policy for Florida if your legal team chooses one.
• Keep search terms, form values and condition-revealing URLs out of third-party payloads; contents is where Florida claims succeed or fail.
• Show recording notice in the chat widget before the first message.
• Inventory open and click tracking in marketing email, and know which vendor receives it.

How Inth catches this

• Code audit: flags a pull request that adds a pixel, session replay script or chat vendor outside the consent check, and traces form fields and search terms to the vendor.
• Website audit: records vendor requests before a choice, with the page, time, visitor region and consent state.
• Consent banner: Florida is not in the default opt-in regions. Teams can create a Florida policy so that tags wait for the visitor’s choice.
• Evidence: consent records with the choice, country and policy that applied.

Inth’s Website audit observes web pages, not marketing email. Email open and click tracking needs a separate review of your email platform.

• European Wax Center (proposed settlement capped at USD 5 million, final approval not confirmed; FSCA, ECPA, CIPA §631 and privacy claims pleaded)
• Formula One (Florida court, VPPA)
• Related law pages: Standing, Federal Wiretap Act

• Florida Statutes (2025) §934.02, §934.03, §934.10, §934.31
• Goldstein v. Costco, S.D. Fla. No. 21-cv-80601-RAR, ECF 53; Jones v. Bloomingdales.com, 8th Cir. No. 23-3304
• European Wax Center settlement website (claims description)
• Secondary: Fisher Phillips, 6 January 2026; Jeffer Mangels, 25 September 2026

Source review: 17 October 2026. This page summarises the statute and the cited decisions at their procedural stage. It is not legal advice. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.