North Carolina Electronic Surveillance Act: One-Party Consent, Privacy Lawsuits and Business Risk

North Carolina is a one-party consent state. For a business reviewing call recording or website tracking, that can be an important legal distinction. It is also easy to turn that distinction into a much broader conclusion than the law supports.

A company may have a defense to an interception claim and still face allegations that it mishandled confidential information, breached a privacy promise or failed to exercise reasonable care. North Carolina’s hospital pixel litigation makes that point concrete. WakeMed and Duke Health reached approved settlements after negligence and contract claims survived earlier proceedings. The settlements did not establish violations of North Carolina’s Electronic Surveillance Act.

This installment in Captain Compliance’s privacy lawsuit series examines the Act’s scope, the cases interpreting it and the relationship between interception law and the broader website privacy problem. It also explains why consent software, scanning and deployment evidence remain useful in a one-party consent jurisdiction. Those controls need to reflect the actual legal obligations and data flows, rather than copy a configuration designed for another state.

Statutory and case materials reviewed October 12, 2026. Settlement agreements, approval orders and judicial rulings are identified separately.

What North Carolina’s Electronic Surveillance Act prohibits

The relevant law is Article 16 of Chapter 15A of the North Carolina General Statutes. Section 15A-287(a) prohibits specified willful interception or attempted interception of wire, oral or electronic communications without at least one party’s consent. It also addresses willful disclosure of contents known, or reasonably known, to have been obtained unlawfully. Violations of subsection (a) are Class H felonies.

The one-party rule is a real difference from the all-party frameworks discussed in the New Hampshire and Pennsylvania articles. For the North Carolina provision, the analysis asks whether an actual participant consented. Permission from someone who owns a device, pays for a platform or wants the resulting data does not by itself establish that person’s participation in the communication.

The statute contains exceptions for specified publicly accessible communications, qualifying provider activities and interception otherwise permitted under federal wiretap law. Each requires analysis of its conditions. The provider exception concerns activities necessary to providing the service or protecting the provider’s rights or property; it is not a blanket exemption for anything a vendor describes as analytics.

A business should identify the communication before deciding who can consent to its acquisition. A customer’s conversation with an agent, a message sent to a company and a separate interaction inside a third-party service may involve different participants. “We own the website” does not resolve every communication passing through it.

The definitions make the data and architecture important

Section 15A-286 defines electronic communications broadly to include transfers of writing, images, sounds and data through specified systems affecting interstate or foreign commerce, subject to exclusions. Interception means acquisition of communications contents through a qualifying device. Contents concern the communication’s substance, purport or meaning. Oral communications require an exhibited expectation against interception that the circumstances justify.

The statute also defines electronic storage and excludes certain equipment from its device definition when used in the prescribed ordinary course. Those provisions help explain why accessing a stored message and acquiring a message during transmission can raise different legal questions.

For website review, separate the technical observations. An IP address, a page path, an entered search and a chat message are not necessarily equivalent under an interception analysis. A page address containing a specific appointment request may carry more communicative meaning than a generic home-page address. Counsel needs the actual values and circumstances, rather than a report that merely lists a pixel.

The exclusion for communications from a tracking device is also a defined statutory concept, with a reference to federal law. It should not be assumed to cover every product marketed as a “tracking tool.” Product terminology and statutory terminology can describe different things.

The civil remedy requires more than an installed tool

Section 15A-296 authorizes a civil action for communications intercepted, disclosed or used in violation of the Article. Recoverable relief includes actual damages with a liquidated minimum of $100 for each day of violation or $1,000, whichever is higher, punitive damages and reasonable attorney fees and litigation costs.

The provision includes a complete defense for good-faith reliance on a court order or a representation by the Attorney General or a district attorney. It does not make a vendor’s generic compliance assurance the same statutory defense. Nor does the damages formula create an automatic award for each detected cookie or network request.

In Kroh v. Kroh, the Court of Appeals distinguished the civil provision’s requirement of actual interception, disclosure or use from the criminal prohibition on an endeavor to intercept. For a website claim, evidence of capability and evidence of what happened should therefore be kept separate.

That distinction works in both directions. A claimant needs facts supporting the alleged violation. A business needs a reliable account of its deployment to evaluate those facts. Finding a script does not prove actionable interception; failing to document the script’s behavior does not prove that nothing was acquired.

North Carolina cases explain the limits of consent and surveillance claims

The principal state appellate decisions concern family recordings, workplace systems and public employment rather than modern advertising pixels. They are still relevant because they address participant consent, actual acquisition, service-provider activity and the factual showing required to maintain a claim.

Kroh v. Kroh: a nonparticipant cannot simply consent for everyone

In Kroh, 152 N.C. App. 347 (2002), a spouse placed recording devices in the family home. The court rejected the proposition that her own consent necessarily authorized recordings when she was not a participant. It also distinguished silent video of physical activities from recordings of oral communications under the claim before it.

The court adopted a limited vicarious-consent doctrine for a custodial parent acting on a good-faith, objectively reasonable belief that recording was necessary for the child’s best interests. Disputed facts required reversal of summary judgment on the surveillance claim. That family-law doctrine should not be repurposed as general authority for an employer or website operator to consent on a customer’s behalf.

The business implication is to document participant status with the same care as consent. The person authorizing acquisition must be connected to the communication in a legally relevant way. Administrative control over a system and participation in every exchange on that system are different propositions.

Kinesis Advertising v. Hill: stored messages and provider functions mattered

In Kinesis Advertising, Inc. v. Hill, 187 N.C. App. 1 (2007), former employees challenged their employer’s access to voicemail and email accounts after their departure. The Court of Appeals affirmed judgment against the interception counterclaim. It relied on Kinesis’s role as provider of the accounts, its business-related access and protection of its rights and property, and the fact that the messages had already been received and stored.

For technical teams, the distinction suggests a useful inventory question: does the component acquire communications during transmission, or access records already stored? Record the answer for each integration. The decision does not establish that moving data to a backend makes all later processing permissible; another statute, confidentiality obligation or contract may govern that processing.

Wright v. Town of Zebulon: willfulness and expectations were fact-dependent

In Wright v. Town of Zebulon, 202 N.C. App. 540 (2010), the court affirmed summary judgment for defendants over monitoring of an officer’s patrol-car conversations during an integrity investigation. Under the facts presented, it found the required willfulness lacking and no reasonable expectation of privacy in those oral communications.

The investigation’s circumstances mattered. The ruling should not be read as permission for every employer to monitor every private conversation. Businesses considering workplace audio, transcription or monitoring should review the particular purpose, notice, environment and communications, and preserve the basis for the approved approach.

Riddick v. Gates County: a 2026 decision on insufficient surveillance allegations

In Riddick v. Gates County, No. COA25-647, decided March 18, 2026, the Court of Appeals affirmed dismissal of claims arising from a county employment dispute. The plaintiff alleged that officials used security cameras to listen to or record conversations. The court found the pleaded facts insufficient to establish the surveillance claim. Reviewing whether a car was present in a parking lot was not itself acquisition of a communication.

The opinion reinforces the need for particular facts rather than the label “surveillance.” In a website dispute, the equivalent questions concern the communication allegedly acquired, the mechanism, consent and the required state of mind. A broad accusation and a list of installed technologies should be tested against those elements.

The healthcare pixel settlements show a wider privacy exposure

North Carolina also has substantial litigation over hospital websites, patient portals and third-party tracking. The cases below belong in the same operational discussion, but their financial outcomes must not be portrayed as damages awards under the Electronic Surveillance Act. Several claims can arise from the same alleged disclosure, and settlements do not decide the merits of each theory.

Case	Settlement amount	Verified status and limitation
Weddle v. WakeMed Health & Hospitals N.C. Business Court, 22CVS013860-910	$2,450,000 fund.	Approved November 17, 2025. Surviving claims were negligence, implied contract and fiduciary duty; the surveillance count had been abandoned.
Williams v. Duke University Health System M.D.N.C., No. 1:22-cv-00727	$3,743,600 fund.	Approved August 27, 2026. Negligence and contract claims survived earlier dismissal proceedings; this was not a finding of a state surveillance violation.
In re Novant Health, Inc. M.D.N.C., No. 1:22-cv-00697	$6,660,000 fund.	Approved June 17, 2024. A privacy settlement, not a judicial damages finding under North Carolina’s Act.
Singh v. The Moses H. Cone Memorial Hospital Operating Corp., et al. M.D.N.C., No. 1:24-cv-00558	$1,765,000 proposed fund.	Final approval hearing scheduled November 5, 2026. Cone Health denies wrongdoing.

WakeMed: the surveillance claim was abandoned, but the case continued

The December 4, 2023 WakeMed opinion expressly states that plaintiffs abandoned the Electronic Surveillance Act claim in their opposition brief. The court dismissed it without further discussion. That disposition was not a developed merits ruling establishing that the alleged tracking complied with the Act.

The court allowed common-law negligence, breach of implied contract and breach of fiduciary duty to proceed. Its later November 17, 2025 approval opinion, 2025 NCBC 71, describes the $2.45 million non-reversionary settlement fund. Fees and administration reduce the amount available for class payments, and the order does not constitute an admission by the parties.

This is a useful distinction for a privacy program. Winning, narrowing or removing one statutory count does not answer whether a business exercised reasonable care with information entrusted to it. Review should cover the confidentiality promise and intended use of the data alongside the interception analysis.

Duke Health: an approved settlement followed surviving negligence and contract claims

The Duke Health final approval order records the earlier dismissal of the federal Electronic Communications Privacy Act claim and several other theories, while negligence and breach of contract proceeded. On August 27, 2026, the court approved the $3,743,600 settlement fund.

The administrator’s FAQ explains that the settlement class concerns identified users of Duke’s MyChart portal or MyDuke Health mobile app during the specified period. Duke denies wrongdoing. Eligible timely claims share the net fund after approved deductions; the gross fund should not be described as money distributed entirely to patients.

For health systems, the connection between website and app use matters operationally. Review the tracking configuration for each surface and the integrations carrying events between them. A control verified on a public website is not evidence that the same rule governs an authenticated portal or mobile app.

Novant Health: configuration was part of the provider’s own account

In an August 12, 2022 notice, Novant said a pixel associated with a campaign promoting MyChart access had been configured incorrectly and might have transmitted information to Meta. Its account described potential exposure of identifiers and appointment-related details, depending on user activity. Novant said it removed the pixel and investigated; it also said it was unaware of improper use of patient information.

Novant later announced a $6.66 million proposed settlement. The June 17, 2024 approval order approved the class settlement and entered final judgment. That agreement resolved the privacy litigation without a merits finding that Novant violated North Carolina’s surveillance statute.

The reported configuration issue is a reason to test payloads, not just approve vendors. A tool deployed for a reasonable campaign can still operate on a page containing information that should not enter that campaign’s measurement system. Governance needs to follow the deployed event and its fields.

Cone Health: a proposed settlement remains subject to approval

The official Cone Health settlement site describes allegations of improper tracking on the website, including MyChart. Its FAQ identifies a $1,765,000 proposed fund and a class covering qualifying portal access or submission-form use from September 1, 2016 through November 3, 2022. Approved costs would be deducted before valid claims share the net fund.

The final approval hearing is scheduled for November 5, 2026, after this article’s review date. Cone denies wrongdoing. The agreement should therefore be discussed as proposed, with no assumption that payments have already occurred or that a court has established liability.

How North Carolina relates to the other laws in the series

The comparison begins with consent but cannot end there. Each law defines protected communications and prohibited conduct differently. Those differences affect how a business should assess the same recording or tracking function.

Jurisdiction or law	Relevant distinction from North Carolina	Practical consequence
New Hampshire RSA 570-A	All-party consent framework. Its contents definition expressly includes information about identity and the communication’s existence.	North Carolina’s one-party analysis and contents definition should not be substituted for New Hampshire’s.
Pennsylvania WESCA	The relevant consent exception requires all parties’ prior consent.	A configuration relying on the operator’s consent alone needs separate Pennsylvania review.
California CIPA § 631	Separate prohibitions concern wiretapping, learning communications in transit without consent and assistance with prohibited conduct.	Identify the precise provision and recipient’s role; North Carolina consent does not answer California liability.
Ohio § 2933.52	Generally permits participant or one-party-authorized interception, with prohibited-purpose limitations.	The similarity is useful, but Ohio’s text and exceptions still need independent application.
Florida § 934.03	All parties’ prior consent is an express exception, alongside other specified exceptions.	Review interstate calls and digital communications before relying on a North Carolina recording rule.
Illinois 720 ILCS 5/14-2	Private communications, surreptitious conduct and participant status matter under its provisions.	Assess those elements rather than treating it as an interchangeable consent statute.
Washington RCW 9.73.030	Protects private communications and conversations, with all-participant consent and specific announcement rules.	Privacy and notice mechanics require their own Washington analysis.

The Pennsylvania Uniform Firearms Act and California Song-Beverly articles address restrictions tied to particular information or transactions. Those are different questions from interception. A permitted recording can still involve information subject to an independent confidentiality, collection or disclosure restriction.

For a North Carolina business serving customers nationally, its headquarters location is only one fact. Where participants are located, where relevant conduct occurred and the applicable choice-of-law rules may affect the dispute. Regional consent settings should follow a reviewed legal approach rather than the assumption that one local rule governs every visitor.

Which businesses should review their exposure?

Healthcare providers have the clearest local examples. Review patient portals, appointment workflows, medical search functions and support communications. Determine which information the customer entrusted to the provider, what the provider promised and which recipients actually received it. A general analytics choice is not automatically a legally sufficient authorization for health-information disclosure.

Financial services, insurance, legal services and education businesses should apply similar scrutiny to account pages and confidential intake. Their legal obligations differ, but the review question is concrete: does optional technology receive information beyond what is needed for the requested service? Industry association alone does not establish a violation of the surveillance statute.

Ecommerce operators should inspect search, checkout, account and support events. Agencies and software vendors should understand the fields their implementations read and the destinations they enable. A contract describing a supplier as a processor does not by itself establish participant status or permission for every acquisition.

Employers and call centers need a separate recording inventory. Include telephone systems, meeting bots, automated transcription and cameras capable of recording audio. Review the participants, purpose, notice and governing jurisdictions. A website preference center does not automatically operate those systems, and a camera’s ordinary security purpose does not resolve every use of its microphone.

Review the acquisition and the later disclosure separately

Consider an illustrative appointment workflow. A visitor sends a request to a provider. The provider may have a substantial argument that it is a participant in that exchange. An optional integration then reads entered fields and sends them to an advertising service. Counsel should identify whether that operation acquires the original communication, creates another communication or transfers an existing record, and what permissions and duties govern it.

That is more informative than assuming either that every third-party tool is an unlawful eavesdropper or that the website operator’s participation makes every transfer permissible. Trace the acquisition first, then assess subsequent use and disclosure. Privacy promises, confidential relationships and other applicable laws can remain relevant even when an interception theory is weak.

Capture network requests along the actual journey. Inspect page addresses, search values, form fields and identifiers in combination. A hashed identifier may still support matching; the fact that a payload does not display a customer’s name in plain text does not settle whether it connects information to that customer.

Timing should also be recorded. Distinguish capture during the interaction from a later event generated from an existing record. Server-side processing changes where those steps happen, but not the need to explain them. Preserve the sequence and the responsible components so legal review can address the correct conduct.

Why consent management still matters in a one-party state

A business should not describe visitor opt-in as universally required by North Carolina’s Electronic Surveillance Act. The statute’s one-party rule must be acknowledged. Nevertheless, properly designed consent controls can serve applicable obligations in other jurisdictions, enforce commitments the business made and govern optional processing for which the business chooses to seek permission.

The value is in the operation behind the interface. If a business promises that optional tracking waits for acceptance, its implementation should make that promise true. If a sensitive account page should send no advertising event, a broad cookie acceptance should not override that page-specific restriction.

Captain Compliance’s technical guidance on gating nonessential scripts and beacons explains why cookie restrictions alone may leave outbound requests running. Hardcoded scripts and code outside a controlled tag manager need appropriate execution controls. The policy must reach the component that actually sends the data.

Test refusal and selected categories as well as acceptance. Include new visits, account pages and later preference changes. Verify the requests that leave the site, and inspect backend event rules independently. A consent signal communicates a choice; testing establishes how the particular integration responded.

How Captain Compliance supports the review and the evidence

Captain Compliance’s website privacy capabilities include scanning for tracking technologies, configured consent and blocking controls, consent evidence and monitoring for changes. These help a business find optional technology and enforce its approved rules. Scanning alone does not establish every legal element or expose every server-side transfer.

Begin with the workflows that contain the most consequential information. Use scan findings to direct investigation, then combine them with request inspection and backend configuration review. Counsel determines the obligations and permissible uses; the implementation team converts those decisions into rules for each tool and workflow.

Keep the notice version and consent choice with the relevant deployment records. Preserve tag versions, approved purposes and verification results so the business can explain both its policy and its operation. Hosted or updated notices should accurately describe the reviewed practice; changing a policy later does not authorize earlier conduct.

Continued monitoring matters because campaigns, applications and website templates change. A new integration can bypass an established control or inherit access to a page it was never reviewed for. Assign responsibility for investigating changes and retesting affected flows rather than treating the original installation as permanent protection.

Captain Compliance’s Compliance Shield offers a written litigation guarantee for qualifying customers and eligible claims under its terms. Businesses should confirm coverage for the particular North Carolina claim and review deployment requirements, limits and exclusions. The relevant protection is defined by the agreement, not by a broad assumption that every privacy dispute is covered.

If a demand arrives, preserve the demand and relevant evidence with counsel. Document the existing configuration while promptly addressing any continuing problematic transmission. Historical notices and deployment records may be as important as a current scan. A remediation can improve present behavior without establishing what the site did months earlier.

North Carolina’s one-party rule deserves a fair place in that analysis. So does the lesson from the healthcare cases: removing an interception count may leave a substantial dispute over how confidential information was handled. The most useful privacy program can answer both questions with facts.

Book a Captain Compliance demo to review how scanning, configured consent controls and monitoring can support the data flows your business actually uses.