Laws covered
State codes for services likely used by children: high-privacy defaults, no dark patterns. California's is enjoined; Vermont's starts 2027.
Illinois biometric law. Written notice and release before collecting face, voice or fingerprint data; $1,000 to $5,000 per violation, private suits.
California's wiretap law, the top source of privacy class actions. $5,000 per violation; SB 690 ends pen-register suits, wiretap claims continue.
California's medical privacy law, broader than HIPAA. Private right of action, $1,000 per violation without proof of harm; pixel suits pair it with CIPA.
Federal children's privacy law for under-13s. Parental consent before collecting identifiers; amended rule in full effect since April 2026.
The FTC's authority over unfair or deceptive practices. Tracking cases turn on the gap between what the privacy policy says and what pixels do.
Federal financial privacy law. Notice and opt-out before sharing customer data with nonaffiliated third parties; FTC, CFPB and bank regulators enforce.
Federal health privacy rules. Tracking pixels on patient portals and authenticated pages can transmit PHI; OCR enforces, settlements exceed $100M.
Washington's consumer health data law. Consent to collect and share, authorization to sell, geofencing ban, private right of action. In force 2024.
Federal law on disclosing video viewing history. $2,500 per person; revived against sites and apps where pixels send video titles plus IDs.
Federal ECPA claims against interception of communications. Wiretap Act damages of $10,000; the crime-tort exception drives pixel litigation.
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.