Illinois Eavesdropping Act: How Website Tracking Lawsuits Compare With CIPA, WESCA, Florida and Ohio Law

A patient types a message into a healthcare website. A marketing script sends information about that interaction to an advertising company. The website receives analytics in return. Whether those events support a privacy lawsuit depends on more than the presence of a pixel: it depends on the communication, the recipient, the timing, the visitor’s expectations and the particular statute invoked.

The Illinois Eavesdropping Act belongs in the same conversation as the California Invasion of Privacy Act, Pennsylvania’s Wiretapping and Electronic Surveillance Control Act, Florida’s Security of Communications Act and Ohio’s wiretap law. But Illinois has a feature that deserves closer attention. A website’s status as a participant in an electronic communication can defeat one theory of liability while leaving another available: the allegation that the website acted as a principal benefiting from a third party’s unlawful eavesdropping.

This article continues Captain Compliance’s privacy lawsuit series, including our coverage of CIPA website litigation, federal ECPA tracking claims and WESCA and session-replay litigation. The common operational problem is the transmission of visitor communications to outside companies. The legal routes differ considerably.

What the Illinois Eavesdropping Act actually prohibits

The Act appears in Article 14 of the Illinois Criminal Code, 720 ILCS 5/14-2, with civil remedies in Section 14-6. For website cases, Section 14-2(a)(3) is especially relevant: it addresses knowing and intentional interception, recording or transcription of a private electronic communication, in a surreptitious manner, by someone who is not a party, without all parties’ consent. Those conditions are distinct elements, rather than interchangeable descriptions of unwelcome tracking.

The definitions in Section 14-1 make the privacy inquiry explicit. A private electronic communication can include writing, images, sounds and data transmitted through a computer or other listed system, but the sender or recipient must intend privacy under circumstances reasonably justifying that expectation. Surreptitious acquisition involves stealth, deception, secrecy or concealment. Invisible code therefore raises an issue for investigation; invisibility alone does not establish every element of a claim.

Illinois also treats oral conversations and electronic communications differently. The private-conversation provisions reach certain surreptitious recordings by participants themselves. The electronic-communication provision expressly concerns acquisition by a nonparty. Applying the oral rule to a written website interaction can produce the wrong answer before the technical analysis even begins.

A patient’s confidential message, an ordinary product-page visit and a request sent directly to an analytics endpoint should therefore be analyzed separately. The inquiry must identify the relevant communication and explain why the alleged interceptor was outside it. Describing every browser event as a private conversation skips the statutory distinctions that can determine the outcome.

Why older Illinois recording cases need historical context

Two important Illinois Supreme Court decisions explain why the current statute cannot be understood through older summaries alone. In People v. Melongo, 2014 IL 114852, decided March 20, 2014, the court invalidated the former recording provision on First Amendment grounds. It also found the challenged publishing provision overbroad. The opinion relied on the companion decision, People v. Clark, 2014 IL 115776, in explaining that the former statute criminalized recordings of conversations even when participants had no reasonable expectation of privacy.

Those decisions concerned the earlier statutory language. They do not establish that Illinois currently permits unrestricted secret recording. The present text expressly addresses private communications and surreptitious conduct. For a modern website assessment, the useful questions are consequently whether the communication was private, whether acquisition was concealed and which provision reaches the defendant’s role.

The principal theory: receiving the communication is not the end of the analysis

Illinois defines a principal to include someone who knowingly benefits or receives information from another’s illegal use of an eavesdropping device. Other branches address knowing employment and direction of unlawful device use. The civil-remedy provision permits recovery against an eavesdropper, its principal or both in the circumstances specified by the Act.

The practical issue is the relationship between the website and the vendor. A website may argue that the visitor communicated with it directly. A plaintiff may respond that a separate company secretly acquired the communication and that the website knowingly benefited from that acquisition. The latter theory still requires underlying unlawful eavesdropping; receiving useful analytics does not independently establish a violation.

This is why a tracking inventory should record more than vendor names. Counsel needs to understand what the vendor receives, whether it acts solely for the website, whether it uses information independently and what benefits the website obtains. Those facts can support competing accounts of who participated in the communication and who benefited from another entity’s conduct.

The Illinois cases website operators should know

Kurowski v. Rush System for Health: a principal claim survived

In Kurowski v. Rush System for Health, 683 F. Supp. 3d 836 (N.D. Ill. 2023), patients alleged that tracking technology on Rush’s website and MyChart portal transmitted identifiable health information to Facebook, Google and Bidtellect. On July 24, 2023, Judge Matthew Kennelly allowed the Illinois eavesdropping claim to proceed under the principal theory. Although the allegations did not sufficiently support every branch of that definition, the alleged knowing receipt of a benefit from the third parties’ conduct was sufficient at the pleading stage.

That decision illustrates why participant status does not necessarily resolve a website’s Illinois exposure. It was a ruling about sufficiently pleaded allegations, not a finding that Rush or the vendors had committed unlawful eavesdropping. In a July 18, 2024 decision, the court again declined to dispose of the eavesdropping claim, including the request for punitive damages. The opinions are useful for their legal reasoning; neither should be presented as a trial verdict.

Stein v. Edward-Elmhurst Health: the provisions pleaded mattered

The result differed in Stein v. Edward-Elmhurst Health, No. 23-cv-14515 (N.D. Ill. Feb. 21, 2025). Judge Steven Seeger dismissed the Illinois eavesdropping count while permitting the federal ECPA claim to proceed. The private-conversation theory failed because it concerned oral communications, and the allegations involved electronic interactions. The challenged use-or-disclosure theory also failed because it required information obtained in violation of the Act; the hospital’s participation in the communications defeated the asserted underlying route.

Read alongside Kurowski, Stein shows why the exact liability theory matters. It does not establish blanket immunity for healthcare pixels. Nor does a surviving federal claim establish a surviving Illinois claim. The statutory routes must be pleaded and evaluated separately.

L.C. v. Fertility Centers of Illinois: the principal theory received further support

In L.C. v. Fertility Centers of Illinois, PLLC, No. 25 C 2049 (N.D. Ill. Dec. 8, 2025), Judge Rebecca Pallmeyer denied a motion to dismiss claims arising from alleged website tracking involving Meta and Google. The court rejected the argument that being a party to the website communications necessarily prevented the clinic from being a principal. Alleged benefits included analytics and information supporting the clinic’s commercial activities.

The opinion also explained that Stein had not analyzed the interaction between participant status and principal liability because that argument was not presented there. These decisions therefore should not be flattened into a claim that every Illinois court takes one position on pixels. They identify different pleading routes and unresolved factual questions. None of the cited motion rulings establishes liability merely because an advertising or analytics tool was installed.

Illinois compared with CIPA, WESCA, Florida and Ohio

The remedies above summarize Illinois Section 14-6, California Section 637.2, Pennsylvania Section 5725, Florida Section 934.10 and Ohio Section 2933.65. They are not automatic awards, and the table does not resolve violation counting, standing, class certification or defenses. A projected damages figure is only as sound as its assumptions about those issues.

California: prior consent and the particular CIPA section

CIPA is a collection of provisions. Section 631 includes restrictions on learning communication contents while in transit and on assisting prohibited conduct. It should not be treated as identical to Illinois’s private-electronic-communication provision. In particular, importing Illinois’s express privacy and surreptitiousness definitions into a California claim would obscure the California text.

The clearest consent-timing example is Javier v. Assurance IQ, LLC, No. 21-16351 (9th Cir. May 31, 2022). Javier alleged that ActiveProspect’s TrustedForm recorded his interactions with an insurance-quote website before he accepted its privacy policy. In an unpublished memorandum, the Ninth Circuit rejected retroactive consent as the basis for dismissal and remanded. The court did not decide the defendants’ remaining arguments, including implied consent and ActiveProspect’s third-party status.

The operational lesson is narrower than “every website needs a banner.” If a company relies on visitor consent to authorize capture, the sequence must support that defense. A checkbox at the end of a form does not necessarily authorize recording that already occurred while the visitor entered information.

California also has a separate pen-register and trap-and-trace provision, Section 638.51. That route addresses a different statutory framework from a contents-interception claim. The section prohibits installation or use without a court order, subject to listed service-provider exceptions, including user consent. Whether a particular tracking process fits the relevant definitions still requires analysis. An Illinois contents-related defense cannot simply be copied into a California claim concerning routing or signaling information.

Pennsylvania: two different Popa cases, plus a 2026 development

In Popa v. Harriet Carter Gifts, Inc. (3d Cir. 2022), the Third Circuit rejected the proposition that NaviStone escaped WESCA liability merely because the browser communicated directly with its servers. It also located the alleged interception at the browser’s routing of communications to NaviStone, rather than simply where NaviStone received them. That reasoning made the visitor’s location relevant even though the receiving infrastructure was elsewhere.

The litigation has since changed. On March 26, 2026, the Third Circuit issued a nonprecedential opinion applying its intervening Cook v. GameStop standing decision. It concluded that Popa lacked a cognizable Article III injury and directed that the removed action return to state court. The court did not resolve the merits of the appeal. A federal standing failure therefore should not be described as a final determination that the tracking complied with WESCA.

Separately, Popa v. Microsoft Corp., No. 24-14 (9th Cir. Aug. 26, 2025), concerned Microsoft Clarity on a different retailer’s website. The Ninth Circuit affirmed dismissal for lack of Article III standing. That case belongs in the discussion of injury from session replay, but it is not the Third Circuit’s Harriet Carter case.

For a business assessing exposure, standing and statutory compliance are separate questions. A plaintiff may fail to establish a sufficiently concrete injury in federal court without obtaining a merits decision. Conversely, allegations concerning confidential health information can present an injury theory materially different from a record of ordinary shopping activity. A dismissal headline does not identify which of those issues the court actually decided.

Florida: retail session replay does not resolve healthcare pixel claims

Florida’s Section 934.03 expressly provides an all-party prior-consent route for interception. Its rules should not be replaced with the federal Wiretap Act’s ordinary one-party-consent formulation.

A useful comparison appears in W.W. v. Orlando Health, Inc., No. 6:24-cv-1068 (M.D. Fla. Mar. 6, 2025). The court distinguished Jacome v. Spirit Airlines, Inc., a 2021 Florida trial-court decision rejecting a commercial session-replay claim. Rather than treating that decision as a universal website exemption, the Orlando Health court examined allegations involving medical conditions, provider searches and communications allegedly disclosed through tracking technology. It permitted the Florida statutory claim to proceed at the pleading stage.

The comparison is useful because it directs attention to the payload. A cursor movement and a transmitted health-related search are not necessarily equivalent communications. The ruling does not make every visit to a healthcare website actionable, and it does not establish that all searches are protected contents. It does show why a defense developed around generic retail browsing needs reconsideration before being applied to a medical interaction.

Ohio: one-party consent, substantial remedies and a relevant software case

Ohio is the clearest departure from the all-party shorthand. Section 2933.52(B)(4) permits a non-law-enforcement person to intercept when that person participates in the communication or has one party’s prior consent. The exception does not apply when interception serves a criminal, tortious or other injurious purpose. A website’s consent may therefore be relevant in circumstances where it would not satisfy Pennsylvania’s all-party rule, but the identity of the consenting party and the interception’s purpose still require examination.

The remedies are substantial. Section 2933.65 compares liquidated damages of $200 per day or $10,000, whichever is greater, with actual damages plus the violator’s profits, and allows the greater amount. It also provides for appropriate equitable relief, punitive damages and reasonable attorneys’ fees and litigation expenses. Ohio’s consent framework is more permissive in this respect than Pennsylvania’s; that does not make an established violation inexpensive.

An instructive digital-communications case is Luis v. Zang, 833 F.3d 619 (6th Cir. 2016). The allegations concerned WebWatcher software secretly installed on a spouse’s computer, with communications allegedly acquired and forwarded to the software company’s servers. The Sixth Circuit reversed dismissal of claims against the company, including Ohio wiretap claims, because the complaint plausibly alleged its active involvement.

Luis was a surveillance-software case, not a ruling that ordinary website analytics violate Ohio law. Its relevance lies in the distinction between selling software and operating a service that itself acquires communications. A vendor’s infrastructure and continuing role can matter, even when someone else installed the code.

How the same website interaction can produce different claims

Consider a hypothetical appointment form that loads an advertising script immediately. The visitor selects a treatment, types a message and submits the form. During that process, a request to an outside endpoint includes a page address, an identifier and information describing the interaction. This example assumes a transmission that must be verified; it does not describe every pixel’s default behavior.

For Illinois, the analysis would ask whether the transmitted material formed a private electronic communication, whether a nonparty acquired it surreptitiously and whether the website knowingly benefited from unlawful acquisition. For Pennsylvania, the inquiry would include prior consent and the point of acquisition. In California, counsel would identify the specific CIPA provision and distinguish a contents theory from any pen-register theory. Florida would require examination of the communication’s contents and applicable exceptions. Ohio would add the participant or one-party-consent defense and its purpose limitations.

The technical evidence can be shared across those analyses, but the legal conclusions cannot. A network request establishes that a browser sent particular data to an endpoint. It does not, by itself, establish secrecy, reasonable expectations, unlawful purpose or who counts as a statutory party. A demand letter should connect those legal propositions to the captured interaction rather than treating a vendor’s name as proof of liability.

The same caution applies when ECPA, VPPA or BIPA counts accompany a tracking claim. Each statute has its own trigger. Calling a recording a “voiceprint,” for example, does not establish biometric processing, and the presence of a video player does not by itself establish a VPPA violation. The Illinois Eavesdropping Act concerns communications privacy; it should not be conflated with Illinois’s separate biometric statute.

What a defensible website review should preserve

Start with the pages where users communicate information that warrants closer review: patient portals, appointment scheduling, legal intake, financial applications and support chats. Inventory scripts, embedded frames, tag-manager rules and server-side forwarding. Record which component receives which fields and whether the vendor processes them solely for the service or also for independent purposes. Marketing’s description of a tool as “measurement” does not answer those questions.

Then capture the network behavior before any choice, after rejection, after acceptance and after withdrawal. Include direct navigation to sensitive pages and movement between pages without a full reload. Preserve the actual requests where appropriate, the consent-state sequence and the configuration version. A consent log can establish a recorded choice; it needs execution evidence alongside it to show what that choice controlled.

Inspect form behavior before submission. Some tools can observe field changes or page updates while the visitor is typing. Validate masking where collection occurs, rather than assuming a hidden playback field means the underlying value never left the browser. Check page addresses, query strings, titles and event names too: those fields can expose context even when a text box is excluded.

Where consent is the chosen legal route, gate the relevant capture and transmission before it begins. Explain the collection purpose and recipients clearly enough for the choice being requested. An “Accept cookies” label may be an incomplete description of session recording, chat capture or advertising reuse. A reject button also needs a matching technical result. Removing browser storage while permitting the same transmission does not establish that collection stopped.

Use data minimization even after a visitor accepts. Excluding advertising tools from sensitive workflows can be a better design decision than trying to authorize every field they might observe. Consent to ordinary measurement should not silently expand to confidential free-text messages. Server-side forwarding requires its own inventory: changing the transmission route does not settle the recipient, purpose or applicable-law questions.

If a claim arrives, preserve the relevant historical deployment before changing it. Keep tag-manager versions, code changes, vendor settings, notices and consent records within an appropriate preservation process. Reproduce the alleged interaction where feasible and identify the exact statutory route. A present-day scan can support remediation, but it cannot reconstruct a historical session without reliable evidence of the earlier configuration.

Where Captain Compliance fits

Captain Compliance’s consent management and scanning tools address the operational side of this problem: identifying deployed technologies, controlling activation and documenting visitor choices. A maintained tracking inventory and notices that match the deployment give counsel a better factual basis than a static policy written before the current tags were installed.

The product workflow must still be tested against the website’s actual behavior. Scanning establishes observations within its scope; a consent platform enforces configured controls. Neither determines whether a court will find a private communication, an unlawful interception or principal liability. Sensitive pages, vendor changes and server-side flows need deliberate review.

For organizations exposed to privacy demands, the useful record is specific: which technology ran, what it received, when it received it, what the visitor had been told and which choice governed execution. That record supports both remediation and a reasoned response to allegations under Illinois law or another statute. Book a demo to review how Captain Compliance can help build and maintain those controls.