Run a free scan

Pennsylvania WESCA: all-party consent, interception at the browser, and the standing wall

Pennsylvania’s Wiretapping and Electronic Surveillance Control Act requires every party’s consent and allows USD 1,000 in liquidated damages per plaintiff. In 2022 the Third Circuit held that a marketing vendor’s script intercepted communications at the visitor’s browser, inside Pennsylvania, and that the vendor could not claim to be a party. Session replay suits under WESCA followed, including Cook v. GameStop. Three years later the same court held that a shopper whose browsing was recorded by session replay had suffered no concrete harm. Since then most federal WESCA website claims have stalled on standing.

18 Pa.C.S. §§ 5702, 5703, 5704, 5725 · Source review: 17 October 2026

What the law says

18 Pa.C.S. §5703 makes it a third-degree felony if a person "(1) intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept any wire, electronic or oral communication". It also covers disclosing or using contents a person knows were intercepted.

Definitions in §5702:

  • Intercept: "Aural or other acquisition of the contents of any wire, electronic or oral communication through the use of any electronic, mechanical or other device."
  • Contents: "any information concerning the substance, purport, or meaning of that communication".

Consent (§5704(4)): interception is lawful only "where all parties to the communication have given prior consent to such interception".

The elements are: an intentional interception or procurement; of contents; by a device; and without the prior consent of all parties.

Who can sue and what they can recover

Section 5725(a) gives "Any person whose wire, electronic or oral communication is intercepted, disclosed or used in violation of this chapter" a civil action against anyone who "intercepts, discloses or uses or procures any other person to intercept, disclose or use" it. The person may recover:

  • "Actual damages, but not less than liquidated damages computed at the rate of $100 a day for each day of violation, or $1,000, whichever is higher";
  • punitive damages;
  • "A reasonable attorney’s fee and other litigation costs reasonably incurred".

Good-faith reliance on a court order or the chapter is a defence (§5725(c)).

  • Limitations period (labelled uncertain). Section 5725 states none. We have not confirmed which Pennsylvania limitations period courts apply.
  • Standing. Federal plaintiffs also need a concrete injury, the main barrier since 2025; see standing. Pennsylvania state courts apply their own standing rules.

How it is used against websites and apps

The pleaded theory is that a third-party script loaded on the site intercepts what the visitor does or types and routes it to the vendor’s servers. Plaintiffs plead it against both the vendor and the site, as the party that procured the interception. The technologies named in the Third Circuit cases are:

  • NaviStone’s marketing script, capturing form fields and browsing (Popa v. Harriet Carter);
  • session replay code (Cook v. GameStop);
  • Microsoft Clarity session replay on a Pennsylvania retailer’s site (Popa v. Microsoft).

Hospital pixel claims are also pleaded under WESCA in state court (Mohr v. Penn Medicine).

How courts have ruled

How courts have ruled
CaseCourtDateHolding
[Popa v. Harriet Carter Gifts](https://www2.ca3.uscourts.gov/opinarch/212203p.pdf)3d Cir. (precedential)16 August 2022No "direct-party" exception for the vendor; NaviStone intercepted "at the point where it routed those communications to its own servers. And that was at Popa's browser" (p. 17)
[Cook v. GameStop](/enforcement/cook-v-gamestop)3d Cir. (precedential)7 August 2025No Article III standing for session replay of browsing. Distinguishes cases where a site broke its own promise not to collect; GameStop "made no promise to refrain from collecting information" ([opinion, pp. 15–16](https://www2.ca3.uscourts.gov/opinarch/232574p.pdf))
[Popa v. Microsoft](/enforcement/popa-v-microsoft)9th Cir. (published)26 August 2025WESCA and intrusion claims over Clarity on a pet-supply site dismissed for lack of standing. The court rejected the argument that a statutory privacy right is enough after *TransUnion* ([opinion, pp. 6, 14–15](https://cdn.ca9.uscourts.gov/datastore/opinions/2025/08/26/24-14.pdf))
[In re BPS Direct](/enforcement/in-re-bps-direct)3d Cir. (precedential)11 May 2026In a session replay MDL heard in Pennsylvania (Wiretap Act and state claims), shoppers whose full card numbers were captured have standing; browsers do not ([opinion](https://www2.ca3.uscourts.gov/opinarch/233235p.pdf))

What the rulings turn on.

  • Merits. WESCA is favourable to plaintiffs. All-party consent applies, and Harriet Carter removed both the vendor’s party defence and the argument that interception happened outside Pennsylvania.
  • Standing. Federal courts require more than the statute. Plaintiffs need sensitive content, such as card numbers in BPS Direct, or a broken promise (Cook's carve-out).
  • State court. Article III does not apply there, which is one reason health-system cases such as Penn Medicine were filed in the Court of Common Pleas.

Status and what is changing

Status, 17 October 2026: in force; we found no amendment addressing website tracking. Cook and BPS Direct bind federal courts in the Third Circuit. The Penn Medicine settlement has a final hearing scheduled for 12 November 2026, with total relief capped at USD 9,250,000 including fees and costs (settlement FAQ).

What this means for your implementation

The standing cases make data content decisive. The all-party rule makes the visitor’s prior consent the defence that matters.

  • Mask payment fields, health inputs and free text in session replay at source, and verify that nothing leaves the browser unmasked.
  • Do not load marketing scripts that capture form fields before the visitor chooses.
  • If your banner or policy promises no tracking after "Reject", test that it holds. A broken promise is the standing route Cook left open.

Illustrative pattern, not the defendant’s code. Generic consent check, not a specific c15t API:

// Before: session replay starts on first load and records typed values
LogRocket.init('acme/shop');

// After: start only with analytics consent, and sanitise every input
if (consent.has('analytics')) {
  LogRocket.init('acme/shop', { dom: { inputSanitizer: true } });
}

How Inth catches this

  • Code audit: flags a pull request that adds a session replay or form-capture script, or changes masking settings, and traces which inputs reach the vendor.
  • Website audit: records requests to replay and marketing vendors before a choice and after "Reject", with the page, time, region and consent state.
  • Consent banner: Pennsylvania is not in the default opt-in regions; teams can create a policy for it so that analytics (for example Clarity, Hotjar or LogRocket) waits for the visitor’s choice.
  • Evidence: consent records and runtime observations.

A network capture shows that replay data left the browser. It cannot show whether masked values were reconstructed on the vendor’s side.

Sources and limits

Source review: 17 October 2026. This page summarises the statute and the cited decisions at their procedural stage. It is not legal advice. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.