Know what is on your site before a plaintiff’s firm does.Free website scanScan Your Site
Log in Sign up Book a demo
Solutions / ECPA · United States
ECPA · FEDERAL WIRETAP AND TRACKING LITIGATION

Your website can transmit a visitor’s communications before anyone notices. Our software protects you against ECPA litigation claims.

The Electronic Communications Privacy Act is increasingly appearing in lawsuits involving pixels, session replay, chat tools, advertising technology, and other code that transmits website activity to third parties. Captain Compliance identifies what is loading, controls when it can transmit, records visitor choices, and preserves the evidence needed to respond.

Book an ECPA tracking-risk review Explore Cookie Scanner
Federal private litigationReal-time tracker detectionConsent and blocking evidence
ECPA at a glance

An older federal statute meeting modern website technology.

Congress enacted ECPA in 1986 to extend communications protections to emerging electronic technologies. Plaintiffs now invoke portions of the statute in disputes over real-time website data collection and third-party tracking.

Section 2520 allows a court to assess statutory damages based on the greater of $100 per day of violation or $10,000, but availability and calculation depend on the claim, the facts, the jurisdiction, and judicial discretion. No tracker automatically produces a $10,000 award.

The shape of the risk

The allegation begins with what the browser transmitted in real time.

ECPA website claims are highly technical. The result can turn on what was transmitted, when it was acquired, which entity received it, whether the information constituted communication contents, and whether prior consent or another statutory exception applies.

Duplicate
Real-time duplication

Pixels, session-replay tools, chat services, and embedded scripts can direct a visitor’s browser to send a duplicate or parallel communication to a third party as the visitor interacts with a website.

Contents
Contents versus routing data

Page URLs, searches, form entries, chat messages, selections, and other transmitted information may be alleged to reveal the contents of a communication. Device, routing, and signaling information can require a different analysis.

Timing
Consent timing

The federal Wiretap Act includes a one-party prior-consent exception, subject to an important crime-or-tort limitation. Litigation frequently focuses on who consented, what they consented to, and whether consent existed before the alleged interception.

Federal
Nationwide litigation exposure

ECPA is federal, contains civil remedies, and is frequently pleaded alongside CIPA, state wiretap laws, consumer-protection statutes, invasion-of-privacy claims, and other causes of action.

ECPA does not require every website to use opt-in consent. Prior user consent can materially strengthen the factual record, but the statute contains several elements and exceptions, and courts do not apply them uniformly.

The statute in three parts

ECPA is an umbrella for three different statutory frameworks.

Wiretap
Federal Wiretap Act

Addresses the interception, use, and disclosure of wire, oral, and electronic communications. This is the component most commonly invoked in real-time website tracking litigation.

SCA
Stored Communications Act

Addresses unauthorized access to and disclosure of certain communications held in electronic storage. It is different from intercepting a communication contemporaneously with transmission.

Pen/Trap
Pen register and trap and trace

Primarily regulates the installation and use of devices that capture dialing, routing, addressing, or signaling information. These federal provisions should not be presented as a general civil cause of action against ordinary website analytics.

Important distinction: ECPA’s federal pen-register provisions are not the same as California lawsuits brought under CIPA’s separate trap-and-trace provision, California Penal Code §638.51.

What you get

Control the technology and preserve the factual record.

A privacy policy cannot stop a pixel from transmitting. Captain Compliance connects public-facing consent with the code, vendors, records, and technical evidence behind it.

D

Continuous tracker discovery

Scan for pixels, cookies, scripts, session-replay software, chat tools, analytics, advertising tags, and other technologies that can transmit visitor activity to outside parties.

Explore Cookie Scanner
B

Consent-based blocking

Prevent configured non-essential technologies from loading until the appropriate visitor choice has been received. Apply regional rules and counsel-approved consent models from one deployment. Blocking is a risk-control and evidence mechanism, not a complete legal defense.

Explore Consent Management
P

Real-time pixel enforcement

Detect when a tracker fires despite the intended consent state. Identify newly added or altered technologies before an unnoticed deployment becomes a recurring litigation allegation. Patrol runs live scans so drift surfaces quickly.

Explore Patrol
S

Session replay and chat controls

Identify tools capable of collecting clicks, keystrokes, form interactions, chat messages, page activity, or session recordings. Apply blocking and activation rules based on sensitivity and approved use.

H

Sensitive-page protection

Apply stricter controls to health, financial, authentication, checkout, account, support, and other pages where URLs or interactions may reveal particularly sensitive information.

N

Clear notices and preferences

Explain relevant purposes, categories, technologies, and third-party recipients in understandable language. Give visitors access to persistent preference controls and withdrawal mechanisms.

Explore Privacy Notices
R

Consent receipts and audit evidence

Preserve the banner version, disclosures presented, visitor action, consent state, timestamp, region, and relevant technology configuration. Use the record to investigate allegations and support counsel’s response.

L

Vendor and litigation documentation

Maintain scanner results, vendor inventories, configuration records, consent logs, notices, remediation history, and change evidence in a form legal and privacy teams can evaluate quickly.

How it fits

The banner, browser, tag manager, and evidence must tell the same story.

Website privacy litigation often exposes a gap between the policy a company intended to implement and the code that actually executed. Captain Compliance connects visitor choices to tag behavior and continuously checks whether the deployed website remains aligned.

The legal analysis still depends on the transmitted information, technical architecture, parties, jurisdiction, purpose, and applicable exceptions. Captain Compliance provides controls and evidence; it does not guarantee a particular litigation outcome.

Book an ECPA tracking-risk review
Discover · Control · Demonstrate
  • Discover — Identify every relevant tracker and the pages on which it operates.
  • Control — Gate technologies according to the selected consent model and page sensitivity.
  • Demonstrate — Preserve consent, configuration, scanning, and remediation evidence for legal review.
A practical ECPA risk review

Find the transmission before a plaintiff’s testing tool finds it for you.

This sequence is a technical review path, not a compliance guarantee. Scope and timing depend on your stack, your vendors, and the decisions your counsel makes along the way.

Review · typical website
  • Day 1 · Scan — Inventory cookies, pixels, scripts, chat services, session replay, form analytics, and server-side or conversion tools.
  • Week 1 · Trace — Determine what each technology receives, when it activates, which pages use it, and whether it can receive URLs, form interactions, identifiers, or other communication content.
  • Week 2 · Control — Implement counsel-approved blocking, consent triggers, tag-manager rules, and additional restrictions on sensitive pages.
  • Week 3 · Disclose — Align the banner, privacy notice, cookie disclosures, preference center, and vendor descriptions with actual website behavior.
  • Week 4 · Document — Preserve consent receipts, scanner reports, tag configurations, vendor assessments, approvals, and remediation evidence.
  • Ongoing · Monitor — Continuously detect new trackers, configuration drift, unauthorized pixel fires, vendor changes, and sensitive-page deployments.
Before and after

From unknown transmissions to defensible website operations.

Before
  • Pixels load immediately on page arrival
  • No complete tracker inventory
  • Session replay appears without legal review
  • Generic banner language
  • Consent stored as a simple yes/no value
  • Sensitive pages use the same tags as marketing pages
  • Tag-manager changes go unnoticed
  • Legal receives an allegation without technical evidence
After
  • Configured technologies wait for the approved consent state
  • Continuously maintained cookie and tracker inventory
  • Session replay detected, assessed, and controlled
  • Purposes and relevant third parties clearly described
  • Versioned consent receipts and configuration evidence
  • Health, financial, account, and form pages receive heightened controls
  • New and altered technologies are detected
  • Counsel receives logs, scans, notices, configurations, and remediation history
Questions teams ask

ECPA and website tracking, answered plainly.

What is the Electronic Communications Privacy Act?+
ECPA is a 1986 federal law that updated communications privacy protections for electronic technologies. It includes amendments commonly called the federal Wiretap Act, the Stored Communications Act, and provisions governing pen registers and trap-and-trace devices.
Can ECPA apply to a commercial website?+
Potentially. Plaintiffs have used the federal Wiretap Act to challenge pixels, plug-ins, session-replay tools, chat technology, and other code alleged to acquire electronic communications while they are being transmitted. Applicability depends on the particular technology, data, parties, timing, intent, consent, and statutory exceptions.
Is every cookie or tracking technology an illegal wiretap?+
No. A claim generally requires more than the presence of a cookie or tracker. Disputes can involve whether there was an interception, whether it occurred contemporaneously with transmission, whether communication contents were acquired, whether the defendant acted intentionally, and whether consent, the party exception, or another defense applies.
What does “interception” mean in website litigation?+
The Wiretap Act defines interception as the acquisition of the contents of a protected communication through an electronic, mechanical, or other device. Courts generally examine whether the alleged acquisition occurred while the communication was in transit rather than only after it was stored.
What information can be considered communication contents?+
Courts distinguish the substance, purport, or meaning of a communication from information used only to route or process it. Plaintiffs may argue that searches, form entries, chat messages, page selections, or sufficiently revealing URLs constitute contents. The result depends on what was transmitted and the governing court’s interpretation.
Does one-party consent defeat an ECPA claim?+
The federal Wiretap Act generally provides an exception when one party to the communication gives prior consent, unless the interception is undertaken for the purpose of committing a criminal or tortious act. Litigation can still concern which entity was a party, whether consent was actually given, its timing and scope, and whether the crime-or-tort limitation applies.
Does ECPA require a cookie banner?+
ECPA does not contain a rule specifically requiring every website to display a cookie banner. A properly configured consent experience can nevertheless provide notice, obtain and document choices, and prevent selected technologies from transmitting before the relevant consent state exists.
What is the difference between ECPA and CIPA?+
ECPA is federal law. CIPA is a separate California statute with different language, causes of action, exceptions, and remedies. A lawsuit may plead both statutes, but satisfying or defeating one claim does not automatically resolve the other.
Are the Stored Communications Act and pen-register provisions the same as the Wiretap Act?+
No. The Wiretap Act principally addresses interception during transmission. The Stored Communications Act addresses certain unauthorized access to or disclosure of communications in electronic storage. The federal pen-register provisions primarily govern devices collecting dialing, routing, addressing, or signaling information and should not be confused with California’s separate trap-and-trace litigation.
What remedies can a private ECPA plaintiff seek?+
Under the Wiretap Act’s civil-remedy provision, a qualifying plaintiff may seek appropriate relief, which can include actual damages and profits or statutory damages calculated under 18 U.S.C. §2520. Punitive damages, equitable relief, reasonable attorneys’ fees, and litigation costs may also be available in appropriate circumstances. These remedies are not automatically awarded merely because a tracker appeared on a website.
Tracking risk is code-level risk

Know what your website transmits before litigation begins.

Scan your website, control pixel activation, document visitor choices, monitor for drift, and give counsel the technical evidence needed to evaluate an ECPA allegation.

Book an ECPA tracking-risk review Explore Cookie Scanner