Wisconsin Electronic Surveillance Control Law: Privacy Suits, Tracking Pixels and One-Party Consent

Wisconsin generally permits a participant to record a communication, or another person to intercept it with a participant’s prior consent. That makes its law materially different from the all-party frameworks discussed in the New Hampshire and Pennsylvania articles. It does not make Wisconsin website tracking litigation an easy question.

The participant exception has limits, including interception for the purpose of committing another injurious act. Recent cases have examined those limits in disputes involving financial information, medical websites and dental scheduling software. The outcomes include claims surviving motions to dismiss, a later federal remand after discovery and substantial settlements resolving broader privacy litigation.

For businesses, the useful approach is to identify the communication, the recipient, the acquisition and its purpose before relying on the state’s one-party label. The deployed configuration matters, as do privacy promises and any separate restrictions on confidential information.

This installment continues Captain Compliance’s privacy lawsuit series. Wisconsin connects several of its recurring issues: consent is legally specific, a policy must match actual behavior, and a favorable answer to an interception question does not necessarily authorize every later disclosure.

Case and statutory materials reviewed October 12, 2026. Pleading decisions, jurisdictional rulings and settlement approvals are distinguished throughout.

The Wisconsin rule is one-party consent with a purpose limitation

Wisconsin’s Electronic Surveillance Control Law is principally found in §§ 968.27–968.37. Section 968.31 prohibits specified intentional interception, attempted interception and procurement of interception, and knowing use or disclosure of unlawfully acquired communications. Its private-party exception permits participant interception or interception with one participant’s prior consent, unless the purpose is a criminal, tortious or other injurious act.

That final category deserves attention. It makes Wisconsin’s wording different from the federal participant exception, which refers to criminal or tortious purposes. Whether a particular practice falls within the Wisconsin limitation depends on its facts and purpose, not simply whether the company benefited from it.

For an ordinary business review, identify whose communication the tool acquires and who purportedly authorized that acquisition. Ownership of the website does not establish participation in every exchange that passes through an embedded service. Likewise, a third party’s contractual permission to install code should not be confused with consent from a participant in the relevant communication.

The analysis also needs to distinguish a purpose alleged in a complaint from a purpose established through evidence. A claimant cannot resolve the exception merely by describing a practice as harmful. A defendant cannot resolve it merely by describing the same practice as standard analytics.

Protected communications and contents require a factual analysis

Section 968.27 defines electronic communications broadly to include transfers of data, writing, images and other information through specified systems, subject to exclusions. Interception concerns acquisition of communications contents through a qualifying device. Contents concern the communication’s substance, purport or meaning. Oral communications include a justified expectation against interception.

These concepts matter when reviewing pixels, session replay, chat and embedded forms. A product label does not establish what the component acquires. Inspect whether it receives a generic page event, the content of a search, a form field or a conversation. The complete payload can carry meaning that an isolated field does not.

An identifier associated with an appointment type presents a different factual question from an anonymous count of page loads. A URL parameter can carry the visitor’s request, while another page address may contain little more than a general navigation path. Record the actual values and their context before drawing a legal conclusion.

Wisconsin also defines pen registers in terms of specified impulses and numbers transmitted on a telephone line. That language should not be replaced by a generic idea of “anything that tracks.” A claim involving contents and a claim involving a pen register require separate statutory analysis.

The civil remedy is not a fixed payment for every visit

Section 968.31(2m) provides a civil cause of action for qualifying unlawful interception, disclosure or use. It allows actual damages with a liquidated minimum of $100 for each day of violation or $1,000, whichever is higher, punitive damages and reasonable attorney fees and litigation costs.

This does not create an automatic $5,000 award for each website visit. Businesses should not import CIPA demand-letter calculations into Wisconsin. Qualifying conduct, days of violation, injury and available recovery must be evaluated under the applicable law and procedural requirements.

A civil remedy and federal standing are also different questions. The legislature’s recognition of a claim does not by itself establish that a particular plaintiff has the concrete injury required to litigate it in federal court. The later proceedings in Brahm show why that distinction matters.

The website cases show both exposure and limits

Case	Relevant issue	Verified outcome
Gassman v. Guardian Credit Union E.D. Wis., No. 25-cv-0176	Financial website tracking and the participant exception.	March 31, 2026 pleading order allowed § 968.31 claim to proceed. Separate pen-register claim dismissed.
Brahm v. Hospital Sisters Health System W.D. Wis., No. 23-cv-444	Patient website information and alleged wrongful advertising disclosures.	Wiretap claim survived in 2024; case remanded May 1, 2026 for lack of federal standing.
Theys v. Dental Intelligence, later Grivetti v. Dental Intelligence N.D. Ill., No. 1:25-cv-02464	Embedded dental scheduling and Wisconsin law.	Wisconsin claim survived March 6, 2026 motion ruling. Later $5.75 million settlement preliminarily approved; final approval remains separate.
In re Advocate Aurora Health Pixel Litigation E.D. Wis., No. 2:22-cv-01253	Related healthcare tracking litigation across websites, app and portal.	$12.225 million settlement approved July 10, 2024. Settlement does not establish a WESCL merits holding.

Guardian Credit Union: participant status did not end the pleading analysis

In Gassman v. Guardian Credit Union, Judge Brett H. Ludwig considered alleged collection and disclosure of customers’ financial website information. Guardian argued that its tools used anonymous data consistently with its privacy policy. The court treated material factual disagreements as premature for resolution on the pleadings.

The March 31, 2026 order allowed the § 968.31 claim to proceed despite conceded participant status, leaving the purpose limitation for a fuller record. It dismissed eight of seventeen counts, including the separate pen-register claim. The decision was not a finding that Guardian unlawfully intercepted information; no later final outcome was verified for this article.

For a financial institution, participant status belongs in the legal review, but so do the transmitted fields and purpose. An account application or product selection can contain information that has no necessary role in advertising measurement. Document what each optional integration receives and why it receives it.

Brahm: a successful pleading was followed by a standing problem

In the June 28, 2024 Brahm order, Judge William M. Conley allowed a Wisconsin wiretap claim involving Hospital Sisters’ alleged patient-data disclosures to proceed. The court found sufficient allegations to examine the participant exception’s limits, including purported disclosures for advertising and marketing, after developing the record. It did not hold that earning revenue automatically defeats participant consent.

The later May 1, 2026 opinion reached a different procedural point. Following discovery, the court found insufficient evidence of a concrete, particularized injury attributable to the defendants’ conduct to establish Article III standing. It remanded the action to Eau Claire County Circuit Court and denied the remaining federal motions as moot.

A remand is not a settlement or a statewide ruling that the technology is lawful. It determines that the federal court cannot continue under those circumstances. No subsequent state-court resolution was verified here.

For businesses, the sequence explains why evidence matters beyond the complaint. Keep observations of actual transmissions separate from possibilities about what a vendor could infer. A reliable technical record helps evaluate both liability allegations and the claimed injury.

Dental Intelligence: an embedded scheduler brought Wisconsin law into an Illinois case

In Theys v. Dental Intelligence, decided March 6, 2026, Judge Lindsay C. Jenkins considered allegations involving LocalMed scheduling software embedded in dental websites. The defendants included clinics with Wisconsin operations. The court allowed the Wisconsin wiretap claim to proceed under the alleged prohibited-purpose limitation. That was a pleading decision, not proof that the alleged disclosures occurred.

The later settlement agreement, under the Grivetti caption, provides a $5.75 million non-reversionary fund resolving the dispute with Dental Intelligence. Its terms refer to a later amended complaint. The September 24, 2026 order granted preliminary approval. The agreement denies wrongdoing and remains subject to final approval; the fund cannot be assigned entirely to the earlier Wisconsin claim.

The operational issue is the embedded service. A patient may interact with what looks like the dental practice’s booking page while a separate software provider handles the form and its integrations. Review the widget’s behavior and recipients, rather than assuming that controlling the clinic’s own tags controls the entire scheduling flow.

Advocate Aurora: a significant related settlement, not a wiretap judgment

In In re Advocate Aurora Health Pixel Litigation, Judge J. P. Stadtmueller approved a $12.225 million settlement on July 10, 2024. The case concerned alleged disclosures through public websites, the LiveWell app and MyChart portal. The approved fund covered class payments and settlement expenses, including fees and administration.

The official settlement materials identify the relevant October 24, 2017 through October 22, 2022 period. The court approved a settlement resolving disputed privacy claims; it did not enter a trial finding that the tracking violated Wisconsin’s surveillance law. The gross fund is not the amount paid entirely to individual patients.

This case belongs in a Wisconsin privacy review because it shows the exposure surrounding patient-facing technology across several surfaces. It should not be combined with the other agreements into a headline implying that Wisconsin courts awarded all of those amounts under § 968.31.

Desnick explains why an unfavorable result is not automatically an injurious purpose

Desnick v. American Broadcasting Companies, 44 F.3d 1345 (7th Cir. 1995), remains a useful earlier decision. People posing as patients recorded their own interactions at eye clinics as part of a television investigation. The Seventh Circuit rejected the wiretap theories, distinguishing the purpose of investigating conduct from an allegation that the eventual broadcast might be tortious.

The court also addressed Wisconsin’s additional injurious-act language. Exposing misconduct was not the prohibited injury the court understood that provision to address. The decision did not give journalists general immunity from other legal duties; it examined the particular claims and conduct.

Applied cautiously to modern privacy review, the point is that interception purpose must be established rather than inferred solely from an unwelcome consequence. A plaintiff’s claim of injury and a defendant’s purpose are related but distinct. A business should document the intended processing and verify that its integrations operate within that purpose.

Audio recording remains part of the business inventory

Wisconsin disputes are not confined to pixels. The 2024 Green Bay City Hall recording decision addressed claims involving audio devices associated with hallway security cameras. The court dismissed the State Senate for lack of standing while addressing claims by individual plaintiffs separately. It does not establish that every conversation in a public building lacks privacy protection.

For employers and premises operators, cameras capable of recording audio should be reviewed as such. A legitimate need for video security does not answer whether a microphone should record a nearby conversation. Call-center recording, conferencing bots and automated transcription likewise need participant and purpose review.

Identify when capture begins, who takes part and what notice or consent is used. An unrecorded alternative may be appropriate for some workflows. A website preference center does not automatically control a telephone platform or a meeting assistant.

How Wisconsin relates to CIPA, WESCA and the other laws in this series

The comparison should preserve the legal distinctions rather than flatten every law into a cookie-consent requirement. A common technical inventory can support several analyses, but the rule applied to that inventory may differ.

Law or framework	Relevant distinction	Operational implication
Wisconsin WESCL	Participant or one-party consent exception with prohibited-purpose limits.	Review actual participants, acquisition and purpose together.
Pennsylvania WESCA and New Hampshire RSA 570-A	Relevant all-party consent frameworks, with their own definitions and exceptions.	Wisconsin participant consent should not be assumed sufficient for those jurisdictions.
California CIPA § 631	Distinct interception prohibitions and assistance theories; separate provisions concern other tracking conduct.	Identify the asserted provision and recipient role before importing an argument from Wisconsin.
North Carolina’s Electronic Surveillance Act and Ohio § 2933.52	One-party or participant consent concepts, with different statutory wording and exceptions.	Similarity does not make the Wisconsin purpose analysis interchangeable with either state’s law.
Minnesota Health Records Act and Wisconsin patient-record confidentiality law	Restrictions on covered record disclosures, separate from interception.	A permitted acquisition does not necessarily authorize onward release of patient information.

Washington’s RCW 9.73, Florida’s recording provisions and Illinois’s eavesdropping law also require their own review. For an interstate call or website interaction, headquarters location alone does not decide the governing law. Counsel should evaluate the participants, locations, conduct and applicable choice-of-law rules.

For healthcare organizations, § 146.82 generally preserves patient-record confidentiality and permits releases to designated persons or through informed consent, with specified exceptions. That is a separate basis for assessing a disclosure. A general cookie choice should not automatically be treated as authorization for a release governed by healthcare law.

Which businesses face the clearest review priorities?

Financial institutions should inspect applications, account-registration flows and authenticated services. The Guardian case concerns allegations in that setting. Determine whether optional analytics receives selections, identifiers or other information that customers submitted for financial services rather than advertising.

Hospitals, medical practices and dental groups should review portals and scheduling alongside public websites. Clinical and appointment information can travel through vendor integrations the marketing team does not directly administer. A provider should be able to explain each recipient and its role in the patient workflow.

Software providers, agencies and businesses offering embedded tools should examine their own acquisition and onward transmissions. The Dental Intelligence litigation shows why a service provider and its customer websites can appear in the same dispute. Contractual responsibility should be supported by a clear account of which party controls each integration.

Ecommerce operators, insurance businesses, professional services and employers should review sensitive forms and communications as a practical priority. Their legal obligations differ, and inclusion in this list does not establish a violation. The question is whether the deployed technology acquires or sends information beyond the service the person requested and the authority the business has.

Technical evidence should answer what, when and to whom

Begin with a workflow map. Identify the component receiving the customer’s communication, any tool observing it and the destinations of resulting requests. An embedded scheduler, chat service and advertising tag can each operate independently. A scan finding one of them should lead to investigation rather than end it.

In an illustrative application flow, the company receives the information needed to open an account. Another component sends an event with selected products and a matching identifier. A third sends the full page address. Review whether those operations acquire communications contents, who participates and what purpose each operation serves.

Inspect requests across the relevant journey. Capture timestamps and values in event bodies, parameters and other transmitted fields. The absence of a cookie does not establish the absence of a request. Hashing an identifier does not necessarily remove its matching function, and masking one replay tool does not control another script’s access.

The pen-register dismissal in Gassman also illustrates why a technical report should use precise descriptions. Identify whether the tool captures contents, routing information or some other event. Do not relabel every observation as a pen register or trap-and-trace device because that terminology appeared in another state’s demand letter.

Backend transfers need separate review. A conversion API, customer-list export or service integration may send data after the browser interaction. That can raise a different acquisition or disclosure question from an in-page script. Moving the event to a server changes the architecture and evidence, not every applicable privacy obligation.

Preserve historical configurations. A current scan cannot establish what happened on an earlier visit, and a present privacy policy cannot establish what a visitor saw then. Keep relevant notice versions, tag changes, vendor settings and verification results so the business can reconstruct the disputed period.

Where Captain Compliance’s controls help

Captain Compliance’s documented website privacy capabilities include scanning for tracking technologies, configured consent and blocking controls, consent evidence and continued monitoring. These support discovery and enforcement of approved rules. They do not automatically determine participant status, prohibited purpose or the legal significance of every payload.

In Wisconsin, visitor opt-in should not be described as universally required by the surveillance law. A properly designed consent system can nevertheless enforce obligations in other jurisdictions, implement the business’s own commitments and govern optional processing for which permission is required or deliberately sought.

The implementation has to control the actual transmission path. Captain Compliance’s guidance on gating nonessential scripts and beacons explains why cookie restrictions alone may not stop outbound requests. Hardcoded code and scripts outside a controlled tag manager need appropriate execution controls.

Build the rules around the workflow. A general product page may permit an optional event while a patient portal or financial application should suppress the same event or remove sensitive fields. Acceptance of analytics should not override a separate rule prohibiting a confidential payload.

Test fresh visits, refusal, selected categories, acceptance and later changes. Verify network behavior rather than the banner’s appearance, and inspect embedded and backend services independently. Consent evidence becomes more useful when the business can connect it to the deployed version and the controls that honored the choice.

Monitoring addresses the next campaign or software update. Assign an owner to review newly observed technologies and changes on sensitive pages. A consent implementation that worked at launch may not govern an integration added months later.

Captain Compliance’s Compliance Shield provides a written litigation guarantee for qualifying customers and eligible claims under its terms. Confirm whether a particular Wisconsin claim qualifies, along with deployment requirements, limits and exclusions. The guarantee should not be assumed to cover every surveillance, banking or medical-confidentiality dispute.

A useful response depends on the record, not the one-party label alone

If a demand arrives, preserve it and the relevant technical evidence with counsel. Document the current configuration while promptly addressing any continuing problematic transmission. Avoid unnecessary copies of sensitive customer information during that review.

The Wisconsin cases support a balanced assessment. Some claims survive because participant status leaves disputed purpose questions. Others fail because the statute does not cover the asserted device or the evidence does not establish federal standing. A settlement resolves a dispute without necessarily deciding either issue.

A business needs facts sufficient to evaluate those distinctions: the communication, its acquisition, the purpose, the consent and subsequent use. Captain Compliance’s scanning, configured controls and monitoring help make approved privacy decisions operational and preserve a more usable record of implementation.

Book a Captain Compliance demo to discuss the technologies operating on your website and the controls needed for your customer workflows.