Ad Tech Compliance
Tracking pixel lawsuits: how the party exception works under the Wiretap Act and state law
Published · Last updated
Tracking pixel lawsuits against healthcare sites can turn on the party exception in wiretap law. The federal provision covers parties and prior consent, with a limit for criminal or tortious purposes. State statutes word the rules differently. The result can depend on the forum, the recipient’s role and what the evidence shows.
Contents
Key facts
- The federal exception covers a party or prior consent of one party, subject to a criminal or tortious purpose limit. 18 U.S.C. § 2511(2)(d).
- The federal rule addresses intentional interception and procuring another person to intercept. 18 U.S.C. § 2511(1)(a).
- Separate provisions address knowing disclosure and use of contents obtained through an interception that violates the subsection. 18 U.S.C. § 2511(1)(c)–(d).
- California’s confidential communications provision concerns intentional eavesdropping or recording without all parties’ consent. Cal. Penal Code § 632, as quoted in Frasco, ECF 776, pp. 8–9.
Definition
Party exception refers here to the federal interception provision for a party to the communication or a person with prior consent from one party, subject to its stated purpose limit.
What the rule text says
4 of 4 rows
18 U.S.C. § 2511(2)(d) | The federal exception covers a party or prior consent of one party, subject to a criminal or tortious purpose limit. | |
18 U.S.C. § 2511(1)(a) | The federal rule addresses intentional interception and procuring another person to intercept. | |
18 U.S.C. § 2511(1)(c)–(d) | Separate provisions address knowing disclosure and use of contents obtained through an interception that violates the subsection. | |
Cal. Penal Code § 632, as quoted in Frasco, ECF 776, pp. 8–9 | California’s confidential communications provision concerns intentional eavesdropping or recording without all parties’ consent. |
18 U.S.C. § 2511(2)(d)
- What it says
The federal exception covers a party or prior consent of one party, subject to a criminal or tortious purpose limit.
- Source
18 U.S.C. § 2511(1)(a)
- What it says
The federal rule addresses intentional interception and procuring another person to intercept.
- Source
18 U.S.C. § 2511(1)(c)–(d)
- What it says
Separate provisions address knowing disclosure and use of contents obtained through an interception that violates the subsection.
- Source
Cal. Penal Code § 632, as quoted in Frasco, ECF 776, pp. 8–9
- What it says
California’s confidential communications provision concerns intentional eavesdropping or recording without all parties’ consent.
- Source
Table by this library, CC BY 4.0.
A web tag may send a separate request to a vendor when a visitor opens a page or submits a form. The site and vendor may each argue that it was a party to the communication. The statute first asks about the interception and who took part, then addresses consent and the purpose limit. 18 U.S.C. § 2511(1), (2)(d).
California provisions address different acts. The October class certification order addresses the scope of a claim under section 631. The Frasco court discusses section 632 and separately describes the medical information claim. The texts and case records supply different facts for each claim. In re Meta Pixel Healthcare Litigation, ECF 1425, pp. 22–24, 37; Frasco v. Flo Health, N.D. Cal., ECF 776, pp. 1–5 and 8–10.
In Sweat v. Houston Methodist Hospital the Southern District of Texas granted summary judgment on its record. The court considered whether the hospital was a party and whether the purpose of using the pixel was criminal or tortious. It distinguished a claimed commercial aim from evidence of a criminal or tortious act. No. 4:24-cv-00775, 22 September 2025, pp. 7–16.
In In re Facebook Internet Tracking Litigation the Ninth Circuit treated a third party’s receipt of a duplicated communication differently from being a party to the original communication. The Third Circuit in Popa v. Harriet Carter Gifts addressed Pennsylvania’s statute and rejected the district court’s direct-party reasoning on the record before it. The reasoning rests on different statutes. {V04d:No. 17-17486, 9 April 2020, pp. 24–29}; No. 21-2203, amended opinion, pp. 12–19.
The Massachusetts Supreme Judicial Court considered browsing on public hospital sites in Vita v. New England Baptist Hospital. It found the statute ambiguous on those facts, applied the rule of lenity and reversed the denial of the motions to dismiss. Massachusetts SJC, SJC-13542, 24 October 2024, pp. 4–6, 41–47.
In Frasco v. Flo Health a jury returned a liability verdict against Meta for the California subclass under section 632 on 1 August 2025. The district court rejected the later motions covered by its amended order. The order discusses the evidence of the app’s operation and the subclass. N.D. Cal., No. 3:21-cv-00757-JD, ECF 776, pp. 1–5, 43–44; Meta Form 10-Q, Legal Proceedings, company statement.
Where readings differ
4 of 4 rows
Reading 1, on the site operator | The operator receives its own visitors’ communications as a party. The claimant still needs evidence of a criminal or tortious purpose beyond the act of interception. | The design records who receives the original request and the aim of each tag. | |
Reading 2, on the site operator | The operator’s goal can include disclosure of identifiable health information for a purpose independently alleged to violate another duty. On that reading, the party argument turns on evidence of the disclosure and its purpose. | 18 U.S.C. § 2511(2)(d) and the distinction between interception and intended disclosure | The design identifies each disclosed field and the downstream operation for which it was sent. |
Reading 3, on the vendor | A vendor using copied requests for its own purposes can be a separate recipient rather than a party to the site communication. | {V04d:In re Facebook Internet Tracking Litigation, pp. 24–29} and evidence of duplicated transmission | The design records own-use rights, duplicate requests and downstream destinations. |
Reading 4, on the vendor | A vendor that acts only as the site’s recording tool can argue that its receipt belongs to the site’s side of the exchange. Actual function and the applicable statute matter. | The party language in 18 U.S.C. § 2511(2)(d) and evidence about the site’s control | The design separates storage for the operator from any use for the vendor’s products. |
Reading 1, on the site operator
- What it holds
The operator receives its own visitors’ communications as a party. The claimant still needs evidence of a criminal or tortious purpose beyond the act of interception.
- What it relies on
- What it means for a design
The design records who receives the original request and the aim of each tag.
Reading 2, on the site operator
- What it holds
The operator’s goal can include disclosure of identifiable health information for a purpose independently alleged to violate another duty. On that reading, the party argument turns on evidence of the disclosure and its purpose.
- What it relies on
18 U.S.C. § 2511(2)(d) and the distinction between interception and intended disclosure
- What it means for a design
The design identifies each disclosed field and the downstream operation for which it was sent.
Reading 3, on the vendor
- What it holds
A vendor using copied requests for its own purposes can be a separate recipient rather than a party to the site communication.
- What it relies on
{V04d:In re Facebook Internet Tracking Litigation, pp. 24–29} and evidence of duplicated transmission
- What it means for a design
The design records own-use rights, duplicate requests and downstream destinations.
Reading 4, on the vendor
- What it holds
A vendor that acts only as the site’s recording tool can argue that its receipt belongs to the site’s side of the exchange. Actual function and the applicable statute matter.
- What it relies on
The party language in 18 U.S.C. § 2511(2)(d) and evidence about the site’s control
- What it means for a design
The design separates storage for the operator from any use for the vendor’s products.
Table by this library, CC BY 4.0.
Where the readings collide. The dispute can concern whether disclosure supplies an independent purpose, whether the vendor participated in the original communication and which transmissions required prior consent. The governing statute may define the covered communication or device differently. Evidence about reuse or duplication bears on different arguments for the site and the vendor.
Facts that change the answer
- Which statutes and forums match the site, users and claim?
- Which party is the defendant and what did it do?
- Which pages were public, authenticated or part of a form?
- What does a capture show about the fields and their timing?
- What words were displayed before the first request left?
- What can the vendor do for itself under the terms?
- What dispute terms apply to the people and dates involved?
- When did tags stop and which records were retained?
A single screenshot of a banner cannot show which requests fired earlier. A test trace can pair the rendered wording with a clock, record the script’s first execution and show what changed after a choice. A backend retry or delayed event can have a different time and destination from the first request.
Contract terms can also separate receiving information to provide a service from using it to build a separate product. The actual network trace gives counsel one part of the picture. A service description, access logs and reports help show how the parties used what arrived.
The date range matters when a vendor changed its terms or a website moved from one tag to another. A site may have records of a new design and sparse records of the prior one. A fact sheet can keep dated evidence, later reconstructions and assumptions in distinct fields. One tag can operate on an ordinary article, a search result and an authenticated form. The request on the form may contain extra fields or follow a different path. A route-by-route comparison gives counsel a way to identify which facts in an opinion resemble the design under review.
Requests that go to both the site and a vendor are also worth distinguishing from separate messages a visitor sends directly. An instrumented trace can show the order and destinations of those requests. The statute and case record then inform counsel’s analysis of whether each recipient was a party.
Questions to take to your counsel
- Which statutes and forums are realistic for our sites and users?
- On our evidence, what was the purpose of each tag, and how is that documented?
- Did users consent before the first transmission, and to what words?
- Does any vendor have the right to use the data for its own purposes?
- Do our terms include enforceable arbitration and class-waiver clauses for these claims?
- What must we preserve now, and what may we delete?
- How do insurance and vendor indemnities respond?
Bring the fact sheet from the counsel briefing kit so that counsel answers your flow, not a generic one.
How business strategy and risk appetite enter
The business can compare the information it gets from a tag with the effects of changing where it runs. A program may rely on detailed event reports for spending decisions, while a smaller campaign uses counts. The cost of removing, gating or filtering a tag varies with those dependencies.
It can also cost more to change a signed vendor arrangement than to update a local rule. When counsel examines a setting, the decision record can capture which service and which use the business valued. That helps management separate changes it can make now from changes that need a contract or a new system.
4 of 4 rows
Remove third-party tags from health journeys | Changes the recipient list and the fields leaving sensitive pages. | Prior events and backend exports remain separate facts. | Delivery can change quickly; historical copies take separate work. |
Gate tags behind a recorded choice | Ties launch timing to a known interface and event. | Consent scope, language and first transmission need evidence. | Gating logic can change without removing old records. |
Filter events on a controlled server | Gives one point to inspect or limit outbound payloads. | Each remaining disclosure and retry still matters. | Filters can change, while previously sent fields cannot be recalled by that change. |
Restrict vendor own use by contract | Documents the function and limits described by the parties. | Technical behavior and the governing statute still matter. | Reversal may require amendments and vendor closeout. |
Remove third-party tags from health journeys
- What it gives the business
Changes the recipient list and the fields leaving sensitive pages.
- What stays open
Prior events and backend exports remain separate facts.
- How hard it is to reverse
Delivery can change quickly; historical copies take separate work.
Gate tags behind a recorded choice
- What it gives the business
Ties launch timing to a known interface and event.
- What stays open
Consent scope, language and first transmission need evidence.
- How hard it is to reverse
Gating logic can change without removing old records.
Filter events on a controlled server
- What it gives the business
Gives one point to inspect or limit outbound payloads.
- What stays open
Each remaining disclosure and retry still matters.
- How hard it is to reverse
Filters can change, while previously sent fields cannot be recalled by that change.
Restrict vendor own use by contract
- What it gives the business
Documents the function and limits described by the parties.
- What stays open
Technical behavior and the governing statute still matter.
- How hard it is to reverse
Reversal may require amendments and vendor closeout.
Table by this library, CC BY 4.0.
Which option fits is a business decision taken with counsel. It depends on how much the program is worth to you, how much uncertainty you accept and who signs for it.
Status and recent developments
The Northern District of Texas entered its tracking guidance order on 20 June 2024. The order concerns a specified combination of an internet protocol address and a visit to an unauthenticated public webpage. American Hospital Association v. Becerra, No. 4:23-cv-1110-P, pp. 31–32, checked 10 November 2026.
In In re Meta Pixel Healthcare Litigation the 21 January 2026 scheduling order set a June hearing. On 30 October 2026 the court granted class certification subject to limits concerning the section 631 and computer access claims, and called for a revised definition and a notice plan. ECF 1274, p. 3; N.D. Cal., No. 3:22-cv-03580-WHO, ECF 1425, p. 37, checked 10 November 2026.
Meta’s Form 10-Q for the quarter ended 30 September 2026 reported the Frasco liability verdict and that damages had not been determined. That statement describes the company’s reporting period. Form 10-Q, Legal Proceedings, company statement, checked 10 November 2026.
Related references
FAQ
Are tracking pixels wiretapping?
What is the party exception?
Did AHA v. Becerra end pixel lawsuits?
Does a consent banner defeat a wiretap claim?
How this works on owned infrastructure
A team that controls its event collector can preserve a redacted capture, policy version and clock for a test request. It can compare what arrived at the collector with what went to the site’s vendor. Separate logs can show when a delayed event or retry left the system.
AdSovereign can run on infrastructure the team controls. The architecture explains deployment boundaries that can be compared with the tag and server paths. A controlled collector changes the evidence about who received data and when. Counsel still examines the governing statute, consent, intent and what each party did with the communication.
Sources
- 18 U.S.C. § 2511(2)(d). Checked 10 November 2026.
- 18 U.S.C. § 2511(1)(a). Checked 10 November 2026.
- 18 U.S.C. § 2511(1)(c)–(d). Checked 10 November 2026.
- Cal. Penal Code § 632, as quoted in Frasco, ECF 776, pp. 8–9. Checked 10 November 2026.
- Massachusetts Supreme Judicial Court, Vita v. New England Baptist Hospital, SJC-13542, pp. 4–6, 41–47. Checked 10 November 2026.
- S.D. Tex., Sweat v. Houston Methodist Hospital, 4:24-cv-00775, pp. 7–16. Checked 10 November 2026.
- N.D. Tex., American Hospital Association v. Becerra, pp. 31–32. Checked 10 November 2026.
- Ninth Circuit, In re Facebook Internet Tracking Litigation, pp. 24–29. Checked 10 November 2026.
- Third Circuit, Popa v. Harriet Carter Gifts, amended opinion, pp. 12–19. Checked 10 November 2026.
- N.D. Cal., Frasco v. Flo Health, ECF 776, pp. 1–5, 43–44. Checked 10 November 2026.
More sources (2)
- N.D. Cal., In re Meta Pixel Healthcare Litigation, ECF 1425, conclusion and class instructions. Checked 10 November 2026.
- Meta Form 10-Q, quarter ended 30 September 2026, Legal Proceedings (company statement). Checked 10 November 2026.
Changelog
- 10 November 2026: Published.