October 13, 2026
By: David Allen
Your website’s cookies may be creating more than a better browsing experience—they may be creating litigation exposure for you. Businesses are receiving demand letters and lawsuits from plaintiffs, including serial litigants, alleging that their websites collect and transmit visitors’ information without first obtaining consent. In Florida, these claims are based on the Florida Security of Communications Act (FSCA), a wiretapping law enacted in 1969, decades before modern websites existed. Cases in other states are based on similar state laws in those states.
What Are Cookies?
Cookies are small files stored on a visitor’s device that supports website functionality, remembers preferences, measures traffic, and facilitates advertising. Related technologies, such as tracking pixels and session replay tools, can collect information about pages visited, searches performed, and other website interactions. Businesses frequently use these tools through website providers, advertising platforms, and analytics services without fully understanding what information is collected or where it goes.
Why Routine Website Practices Can Lead to Claims
Plaintiffs allege that certain tracking technologies unlawfully intercept electronic communications when they capture and transmit visitors’ information to third parties without prior consent. A central issue is timing: some websites begin collecting and sharing information immediately upon a visitor’s arrival, before the visitor has an opportunity to review disclosures or make a consent choice.
The absence of a cookie banner does not, by itself, establish an FSCA violation, and not every cookie presents the same legal concerns. Whether a particular practice violates the law depends on the technology used, the information collected, and the circumstances. Businesses can face substantial defense costs and settlement pressure over website features they consider ordinary marketing or operational tools.
A Banner Alone May Not Address the Risk
An effective approach requires more than adding a generic “we use cookies” notice. A banner may offer little protection if tracking technologies activate before consent is obtained or continue operating after a visitor declines. Similarly, a privacy policy that does not accurately describe the website’s data practices may leave important gaps in liability protection.
Businesses should assess what cookies and tracking tools their websites use, what information those tools collect, which third parties receive such information, and when collection and transmission begin. That assessment should be used to craft the website’s privacy and cookie policies and the selection and configuration of appropriate consent mechanisms. Where consent is required, the website’s technical controls should prevent the relevant tracking from beginning before affirmative consent is obtained and should honor visitors’ choices.
Now Is the Time to Assess Your Website Before Receiving a Claim
If your website uses cookies, analytics, advertising pixels, or other tracking technologies (which almost all websites do), then you may have compliance gaps that warrant attention—even if a third-party provider built or manages your site. GrayRobinson attorneys can assist in assessing your website’s practices and applicable legal requirements, preparing or updating the necessary website policies, and coordinating appropriate consent mechanisms with your website provider. A proactive review now can help identify exposure and reduce the risk of a demand letter or lawsuit later.
If your business has already received a demand letter or been sued over website cookies or tracking technologies, contact legal counsel promptly to assess and address the claims. Our attorneys can evaluate the allegations, assess available defenses, and represent your business in responding to the claim while helping address the underlying website practices to avoid future claims.
Questions?
Contact GrayRobinson Senior Associate David Allen or a member of the firm’s Data Privacy and Security Practice.