Stored Communications Act Privacy Lawsuits: What Businesses Need to Know About Stored Messages and Data Disclosures

A Google privacy case over the disclosure of search queries ended in a $23 million settlement approved in 2023. A separate Facebook tracking case reached a $90 million settlement after the plaintiffs’ Stored Communications Act claim had already been dismissed. Both belong in a discussion of privacy litigation, but they tell different stories about the law.

The Stored Communications Act, commonly called the SCA, addresses specified access to stored communications and disclosures by covered service providers. It is part of the federal Electronic Communications Privacy Act of 1986. It does not treat every cookie, database entry or customer record as a protected stored communication, and it does not apply the same analysis as a live-interception claim.

That distinction connects this installment to Captain Compliance’s privacy lawsuit series. The state wiretap articles examined communications acquired through recording and tracking technologies. The SCA adds questions about the service holding a communication, its storage and the authority for accessing or releasing it. A business can have a defensible answer under one statute and a difficult problem under another.

For companies reviewing support chat, cloud email, customer portals and software integrations, the practical task is to reconstruct the actual flow. What did the person communicate? Where was it held? Who accessed it, and who received a copy? Those facts are more useful than a vendor’s description of its product as analytics, storage or customer engagement.

Statutory and case materials reviewed October 12, 2026. Settlement figures are gross funds, not findings of liability or amounts paid entirely to individual claimants.

Access and disclosure are different SCA claims

The Act’s commercial privacy disputes commonly involve two provisions. Section 2701 concerns intentional access without authorization, or access exceeding authorization, to a facility through which an electronic communication service is provided. The access must result in obtaining, altering or preventing authorized access to a communication in electronic storage.

Its exceptions include conduct authorized by the service provider, and user authorization concerning a communication of or intended for that user. These are specific statutory exceptions. A working password does not establish authorization by itself, while an authorized access does not necessarily resolve the legality of a later disclosure.

Section 2702 restricts knowing disclosure of covered communications contents by electronic communication services provided to the public. Its remote-computing branch covers specified customer communications maintained solely for storage or processing, where the provider is not authorized to access their contents for other services. A generic cloud-provider label does not establish those requirements.

The provision has exceptions, including disclosures to intended recipients, lawful consent from specified persons and disclosures necessarily incident to service delivery or protection of the provider’s rights or property. Provider authorization under § 2701 should not be treated as blanket permission under § 2702.

Non-content records have different rules. Section 2702 distinguishes their disclosure to government entities from disclosure to private parties. Its customer-record exception permits disclosure to a person other than a governmental entity. That does not displace other privacy obligations, but it means a private-party SCA contents claim cannot rely only on the fact that personal information changed hands.

Start a review by identifying the alleged act and provision. An outsider downloading someone’s mailbox presents an access question. A covered platform releasing stored message contents to an advertising company presents a disclosure question. A complaint may allege both, but each needs its own factual and statutory support.

“Stored” has a statutory meaning

Under § 2510(17), electronic storage includes temporary, intermediate storage incidental to transmission and storage by an electronic communication service for backup protection. An electronic communication service gives users the ability to send or receive wire or electronic communications. Contents concern a communication’s substance, purport or meaning.

A remote computing service provides computer storage or processing services to the public through an electronic communications system. These definitions require more than identifying a server. Examine what the system does for the user and the function of the particular copy at issue.

The everyday distinction between data “in transit” and “at rest” is a useful starting point, but it is not a complete legal test. Temporary storage can occur during transmission, and a retained record may fall outside the SCA’s electronic-storage definition. Delaying a transfer or routing it through a server does not settle the question.

Consider an illustrative support conversation. The customer sends a message, the chat provider queues it, the agent reads it, and the platform retains a history. The merchant then exports a transcript to another system. These steps involve different copies, actors and purposes. Record them separately before deciding whether a particular access or disclosure falls within the Act.

The service’s role can also vary by operation. A business may receive communications as an intended recipient while using a separate provider to deliver and retain them. Calling both companies “processors” in a contract does not answer every SCA question. Likewise, a business that merely maintains internal records should not be assumed to provide a communications service to the public.

The cases: substantial settlements alongside important claim limits

Case	Issue	Outcome and qualification
In re Google Referrer Header Privacy Litigation	Alleged disclosure of search-query information.	$23 million settlement approved October 16, 2023, without an admission of liability.
In re Facebook Internet Tracking Litigation	Tracking users after logout.	SCA dismissal affirmed in 2020; broader $90 million settlement approval affirmed in 2024.
In re Google Cookie Placement Consumer Privacy Litigation	Cookies allegedly bypassing browser restrictions.	Third Circuit affirmed SCA dismissal in 2015 because the alleged browser access implicated no protected facility.
In re Zynga Privacy Litigation	Disclosures through referrer headers.	Ninth Circuit affirmed dismissal in 2014 because the information alleged was not communications contents.
Pietrylo v. Hillstone Restaurant Group	Management access to a private employee discussion group.	2009 post-trial ruling upheld the jury’s federal and state stored-communications verdict.
Hately v. Watts	Previously opened webmail.	Fourth Circuit reversed the electronic-storage ruling in 2019 and remanded.

Google’s search-query case: a $23 million settlement after a Supreme Court remand

In Frank v. Gaos, the Supreme Court described allegations that Google transmitted search terms to third-party website servers when users clicked search results. The plaintiffs alleged that disclosure through referrer headers violated the SCA and state law.

The litigation initially produced an $8.5 million settlement that provided no payment to absent class members and directed most funds to nonprofit recipients. On March 20, 2019, the Supreme Court vacated the appellate judgment and remanded for consideration of standing. It did not decide whether Google violated the Act or resolve the settlement’s merits.

After further proceedings, Judge Edward J. Davila approved a replacement $23 million settlement on October 16, 2023. The fund included fees, costs and administration, with remaining class funds distributed pro rata to participating claimants. Google did not admit liability. The settlement class concerned searches followed by a result click between October 25, 2006 and September 30, 2013.

The operational lesson is to inspect information carried by a URL or outbound header. A search query can communicate what a person wants to know, and its disclosure deserves review even when the transfer contains no full message transcript. Engineers should examine values and context rather than assume that anything in a header is merely technical metadata.

Facebook’s $90 million tracking settlement followed dismissal of the SCA claim

The April 9, 2020 opinion in In re Facebook Internet Tracking Litigation addressed allegations that Facebook tracked users on other websites after logout. The Ninth Circuit revived several claims but affirmed dismissal of the SCA claim. The alleged storage in a URL toolbar and browser history did not satisfy the required electronic-storage analysis.

The broader case later settled for $90 million, along with an agreement addressing collected cookie data. On February 21, 2024, the Ninth Circuit affirmed settlement approval. This was a resolution of the remaining privacy dispute, not an SCA damages judgment.

For a business receiving a tracking demand, this sequence is useful. A weakness in one legal theory does not dispose of every claim arising from the same conduct. Counsel needs a provision-by-provision analysis, while the technical team needs a reliable description of the transmissions and the company’s representations about them.

The Google cookie-placement case rejected the browser-as-facility theory

In In re Google Inc. Cookie Placement Consumer Privacy Litigation, users alleged that advertising companies placed tracking cookies despite browser restrictions. On November 10, 2015, the Third Circuit affirmed dismissal of the SCA claim. The alleged access to personal browsers did not implicate a qualifying facility under the Act.

The court nevertheless revived certain California privacy claims against Google. The decision therefore should not be described as general approval of bypassing privacy controls. It identified a limit on the particular federal theory while leaving other questions for further proceedings.

A cookie is browser storage in a technical sense, but that does not make it electronic storage under the SCA. A review should distinguish the visitor’s device from a communications provider’s systems. Where code accesses a remote account as well as local browser information, document those operations separately.

Zynga shows why the actual contents matter

In In re Zynga Privacy Litigation, decided May 8, 2014, the Ninth Circuit considered allegations against Facebook and Zynga concerning referrer-header disclosures. It held that the basic identification and address information alleged was not communications contents and affirmed dismissal.

The court distinguished those fields from a URL carrying a user’s search terms, which could disclose the contents of a communication in appropriate circumstances. The decision does not establish that every URL, identifier or header has the same legal character.

For testing, retain representative field values with appropriate safeguards. A destination hostname alone may show that a vendor received a request, but not what the request conveyed. Review the query string, event body and relevant headers. Where an identifier links a disclosed message to a person, explain that relationship rather than treating the identifier and message as unrelated fields.

Pietrylo: an employer could not rely on possession of an employee’s password

Pietrylo v. Hillstone Restaurant Group concerned management access to an invitation-only MySpace discussion group. In a September 25, 2009 post-trial opinion, Judge Faith S. Hochberg upheld a verdict on federal and New Jersey stored-communications claims.

An employee had supplied login information, but testified that she felt pressure because the request came from management. The court found sufficient evidence for the jury to conclude that access was unauthorized and intentional. The compensatory awards were $2,500 and $903, with punitive damages stipulated at four times those awards. The plaintiffs’ live-wiretap claims had been voluntarily dismissed after discovery showed no interception.

This case belongs in an employer’s privacy program even if the company has no website advertising tags. Investigators and managers should use an approved process for employee-account access. Record whose authority supports the access and its scope; avoid treating credentials obtained from a subordinate as conclusive permission.

Hately: reading an email did not necessarily end its protection

In Hately v. Watts, the Fourth Circuit held on March 6, 2019 that previously opened and delivered emails retained in the webmail system at issue qualified as electronic storage for backup protection. It reversed the contrary summary-judgment ruling and remanded.

The decision concerned a particular hosted email arrangement; it did not declare every saved file a protected communication. It does, however, defeat a simple assumption that a message becomes freely accessible once its recipient reads it.

Businesses reviewing access should establish where the message remained and why. A local copy, a retained provider copy and a separate backup can have different roles. Legal review needs that architecture rather than a screenshot showing that the message was marked “read.”

Authorization needs a source and a scope

Permission can become disputed even where a provider voluntarily supplied messages. In Theofel v. Farey-Jones, 359 F.3d 1066 (9th Cir. 2004), the court examined email access obtained through an invalid, overbroad subpoena. It held that consent procured through the relevant known mistake did not establish valid authorization and reversed dismissal of the SCA claim. The amended opinion emphasized conscious procurement through improper means rather than mere negligence.

For business operations, distinguish technical capability from permission. A support account may have access to an entire tenant even though the assigned task concerns one customer. An integration may retrieve old conversations when its approved purpose concerns current tickets. These examples require factual review; neither automatically establishes an SCA violation.

Document the actor granting permission, the account or communications covered, the purpose and any limits. Match permissions to those limits where the system allows it. Review service accounts and integrations as well as human logins, particularly when an agency or vendor retains access after its work ends.

A contractual provision can be relevant without resolving every question. Check the operational behavior against the authority actually granted. Where the business relies on consent for a disclosure, preserve the applicable wording and evidence of the choice. Permission to deliver a message should not be silently expanded into permission for unrelated uses.

Civil damages are not an automatic charge for every page view

Section 2707 permits qualifying civil claims for knowing or intentional violations. Available relief includes equitable or declaratory relief, damages and reasonable attorney fees and litigation costs. The damages provision addresses actual damages and resulting violator profits, with a $1,000 minimum for a person entitled to recover. Punitive damages may be assessed for willful or intentional violations.

The limitation period is two years after the claimant first discovered, or had a reasonable opportunity to discover, the violation. The statutory defenses also have specific requirements. An ordinary vendor assurance should not be assumed equivalent to good-faith reliance on qualifying legal process.

In Van Alstyne v. Electronic Scriptorium, Ltd., 560 F.3d 199 (4th Cir. 2009), the Fourth Circuit required proof of actual damages before recovery of statutory damages. It did not impose the same prerequisite on punitive damages or attorney fees and vacated the awards for further proceedings. A demand’s damages calculation therefore needs review under the relevant precedent, rather than simple multiplication of visits by $1,000.

Federal standing remains a separate requirement. The Supreme Court’s remand in Frank v. Gaos illustrates that a statutory claim and a proposed settlement do not eliminate the need for a concrete injury. Evaluate the evidence of the plaintiff’s own access or disclosure, the asserted injury and the requested remedy.

How the SCA fits with the other laws in this series

Framework	Question to examine	Why the distinction matters
Stored Communications Act	Qualifying stored communications, service roles, access authorization and provider disclosures.	A local cookie or ordinary database record does not establish coverage by itself.
Federal Wiretap Act	Interception and related use or disclosure, with statutory exceptions.	It is another part of ECPA; an ECPA claim is not necessarily an SCA claim.
CIPA § 631	California’s particular interception prohibitions and assistance theories.	The SCA’s facility or storage limits do not automatically resolve California claims.
Pennsylvania WESCA and the state recording laws	The applicable communication, interception and consent rules.	Review the relevant state provision rather than import federal access exceptions.
Wisconsin WESCL	Interception, participant consent and prohibited-purpose limitations.	A Wisconsin participant analysis differs from an SCA access or disclosure analysis.
Minnesota Health Records Act and other confidentiality laws	Release of covered records and applicable permission or exceptions.	Healthcare confidentiality can require a separate review even where an SCA theory fails.

The same separation applies to the earlier Song-Beverly and Pennsylvania firearms-confidentiality articles. Those statutes concern particular transactions or records. The SCA does not supply one universal authorization for every use of information collected through those workflows.

For a multi-state business, build one accurate technical record and apply the relevant laws to it. A message can be captured during a live interaction, stored by a provider and released later. The legal significance of each step may differ, as may the available defenses and remedies.

Which businesses should prioritize an SCA review?

Providers of messaging, hosted email, private communities and communications storage should examine their role directly. Public-service status and the function of retained copies can matter to disclosure claims. Document access to communications and any onward release rather than focusing exclusively on privacy-policy language.

Employers and businesses investigating staff conduct should review account-access procedures. The Pietrylo verdict arose from workplace decisions, not an advertising campaign. Personal accounts accessed on company equipment need to be distinguished from communications held in an employer-administered service.

Healthcare, financial services and insurance businesses should examine portals and support conversations because these workflows can contain sensitive communications. Industry alone does not establish SCA coverage. Identify the provider, intended recipient and stored copy, then assess sector-specific confidentiality obligations separately.

Ecommerce merchants and professional services firms should include hosted chat and customer-service integrations in their inventory. An ordinary support tool can retain conversations and enable exports across several vendors. Agencies and software suppliers should clarify which party controls those exports and which party approves new integrations.

AI features deserve the same examination. As an illustrative example, a provider might retain a conversation for customer support and later send its transcript to a separate model service. Determine whether that transfer is authorized and permitted, including whether an SCA disclosure provision applies. “Used for AI” is not an exemption, and the absence of an SCA violation does not settle contractual or other privacy restrictions.

Controls should follow the communication beyond the browser

Map the storage and access path for each important communication. Identify the hosting provider, the business recipient, administrative users and integrations. Include queued messages, retained histories and recoverable copies where relevant. Record retention purposes instead of assuming that all copies perform the same function.

Inspect onward disclosures separately. A browser capture may reveal an advertising event but miss a nightly transcript export. Review backend jobs, webhooks and API permissions with the teams responsible for them. Confirm which fields actually leave the system and whether the recipient uses them only for the approved service.

Restrict access according to the task. Use individual accounts where practical, review broad administrative permissions and revoke obsolete integrations. Preserve access logs sufficient to identify who retrieved which material and when. Avoid storing unnecessary message contents in general-purpose debugging logs merely to make an investigation easier.

Test consent and configuration together where permission is required or deliberately sought. A banner choice may control a browser tag while leaving a backend transfer unchanged. A support notice may explain retention but omit a separate recipient. Determine the authority for each operation and verify the system honors the approved limits.

Give legal requests a separate workflow. Section 2703 addresses government access through specified legal process. A document titled “subpoena” should be reviewed for its legal basis, scope and relationship to the applicable disclosure rules before production. Preserve material when required without assuming preservation itself authorizes release.

Historical evidence is essential when a demand arrives. Keep relevant notices, permission records, integration changes and access history. The present configuration may differ from the disputed period. Counsel should direct preservation and the assessment of claimed damages while the operational team addresses any continuing unauthorized activity.

Where Captain Compliance’s software helps

Captain Compliance’s website scanning and consent capabilities can identify observable tracking technologies, support configured blocking and preserve implementation evidence. They help investigate transmissions at the website layer. A scan does not establish every SCA element or reveal every access to a hosted mailbox and backend archive.

The SCA makes data mapping particularly useful. Captain Compliance’s mapping software connects systems, processing activities, vendors, purposes and responsible owners. Applied to a support workflow, those records can identify where conversations live and which integrations require closer review. Accurate mapping still depends on validated information from the people who operate the systems.

Privacy assessments provide a way to document a proposed integration, request evidence, assign mitigation and route the decision for approval. A new transcript-analysis feature should have a reviewable account of the information received and the permitted uses before deployment. Record unresolved questions rather than convert a vendor’s assurance into an approved fact.

Consent evidence and versioned notices support that record where they apply. They are most useful when connected to the relevant purpose and deployed configuration. A logged choice alone does not prove that every recipient honored it or that the person making it could authorize every communication involved.

For qualifying customers, Captain Compliance’s documented Compliance Shield program offers a written litigation guarantee for eligible website privacy claims under its terms. Confirm whether a particular SCA allegation qualifies. ECPA terminology should not be treated as automatic coverage for every mailbox-access, employment or stored-message dispute.

The practical value is a better-controlled operation and a clearer record for legal review. A company should be able to explain how a message moved from the customer to its service providers, why it was retained and what authority supported any later access or release. Captain Compliance helps organize that work and enforce configured website choices, while account permissions and backend access controls remain part of the wider implementation.

Book a Captain Compliance demo to review website technologies, map communications workflows and identify the consent, vendor and assessment controls your business needs.