Editorial organization reviewed September 28, 2026. Source dates are shown with the records.

Evidence and sources

Review the records and perspectives behind the debate. Each item identifies who produced it, what it establishes and where its limits matter.

Court records and legal materials

Court decision

A court restricted one plaintiff’s filings

In Shah v. Crain Communications, a July 20, 2026 order declared Vivek Shah a vexatious litigant and imposed prefiling review on new CIPA or related digital-privacy cases he files in the Central District of California. The public docket records the order.

Shah appealed. The appellate docket records a September 16 denial of his request to pause the order. That procedural ruling does not decide the appeal’s merits.

Source: public docket entries. The order concerns one litigant’s filings in one federal district; the appeal remained pending on the September 16 appellate docket.

Court decision · U.S. District Court, Southern District of California · 2026-03-12

Jones v. Skullcandy

S.D. California · 3:25-cv-01759, Document 13 · Motion to dismiss

In a March 12, 2026 order, the Southern District of California denied a motion to dismiss claims concerning a retail website. The pleaded facts included Google Analytics alongside Meta Pixel, Meta CAPI, DoubleClick, identifiers, purchases and advertising uses.

No. 3:25-cv-01759, Document 13.

A motion-to-dismiss ruling tests pleaded claims; it is not a finding of liability.

Court decision · California Court of Appeal · 2026-07-24

Doe v. Adventist

California Court of Appeal · B344951 · Class-certification appeal

The California Court of Appeal reversed denial of certification for the health-risk-assessment subclass and the surviving patient-portal claims, and remanded. It affirmed denial for the portal subclass’s CMIA claims.

No. B344951. Filed July 24, 2026; certified for publication August 24, 2026.

Class certification concerns whether claims may proceed together, not whether the defendant is liable.

Court decision · U.S. District Court, Northern District of California · 2023-08-30

Swarts v. Home Depot

N.D. California · 4:23-cv-00995-JST, Document 31 · Motion to dismiss

Reviewed 2026-09-28

The court dismissed the pleaded CIPA and federal Wiretap Act claims with leave to amend, and the unfair-competition claim without leave to amend.

This is a pleading-stage order, not a categorical ruling that website chat is lawful. It does not establish the case’s ultimate outcome.

Read the source

Court filing

Oracle’s settlement terms

The Oracle settlement includes nonmonetary commitments about data collection and review practices in §3.5. Oracle denied wrongdoing.

The agreement includes monetary relief and commitments about data practices.

A settlement is not a finding of wrongdoing or evidence that it caused a national filing trend.

Statute · California Legislature; Federal Trade Commission

Privacy and consumer-protection obligations

Reviewed 2026-09-28

California’s consumer privacy law supplements existing privacy laws; compliance is not automatically a defense to a CIPA claim. The Federal Trade Commission (FTC) addresses unfair or deceptive practices under its authority.

These routes have their own coverage and remedies; they are not interchangeable with the claims HAIL would remove.

Data and methodology

Research dataset

Filing patterns by law firm

Rank firms by distinct tracked court dockets. Explore filing-year and CIPA filters, firm websites, annual counts and the case records behind each total.

The ranking is limited to this dataset’s coverage. Name variants and duplicate dockets are reconciled using a published method.

Filing patterns by law firm

A high filing count alone does not establish misconduct.

Research dataset · Fisher Phillips

Explore the litigation tracker

Fisher Phillips tracks digital wiretapping litigation across the United States, with filters for court and industry.

Explore the cases and organizations documented in the research database. Coverage and counting methods are explained alongside the records.

Reported business experiences

Owner account · CapRadio · 2026-06-18

Folsom Lake Heating & Air

CapRadio reported a website-related CIPA suit involving Tami Goldsmith and her husband’s HVAC business. Its account names a booking service referenced in the suit and attributes a settlement account to Goldsmith.

CapRadio owner interview · June 18, 2026. Settlement amount undisclosed.

Owner account · KERO/23ABC · May 2026

Second Star Technologies

Brandon Phipps told KERO/23ABC that his Bakersfield family business paid more than $20,000 in combined legal fees and settlement costs.

KERO/23ABC owner interview · May 2026. Reported amount combines fees and settlement.

Owner account · Elk Grove Citizen · 2026-06-09; follow-up 2026-09-23

Elk Grove Plumbing

Belinda Gutierrez described an expected $20,000 cost to contest a claim and a proposed $15,000 settlement. These are alternative estimates, not reported payments.

Owner’s estimates · May 2026 interview, published June 9.

September 23 follow-up reports a decision to defend the business.

Legislation and state developments

Developments beyond California

Selected court decisions and privacy-law developments affecting online data use. Reviewed September 27, 2026.

Massachusetts · Court interpretation · October 24, 2024

Hospital website tracking

Massachusetts’ highest court held that the state wiretap statute did not reach the web-browsing interactions at issue in a hospital tracking case. Other privacy-law questions remain separate.

Next review: later decisions or amendments to the state wiretap statute. A court holding has no new statutory effective date.

Massachusetts · Proposed privacy legislation · June 17, 2026

Different House and Senate texts

The House and Senate adopted different data-privacy texts. The official record shows conference committees appointed in June 2026, with no later action displayed. No enacted effective date is established by this record.

Next review: conference agreement, enactment or 2027 reintroduction. This is a related privacy proposal, not a wiretap exemption.

Pennsylvania · Jurisdiction decision · September 5, 2024

FullStory session-replay case

A federal appeals court sent a FullStory session-replay case back for further consideration of jurisdiction. It did not decide whether the tracking violated Pennsylvania law.

Next review: the remand and later precedential decisions. This procedural ruling has no legislative effective date.

Washington · Existing consumer-health-data law

My Health My Data Act

Washington’s My Health My Data Act regulates certain consumer health data outside HIPAA’s protections. Violations can be enforced through the state Consumer Protection Act.

Main compliance dates were March 31, 2024, and June 30, 2024, for defined small businesses. The geofencing provision began July 23, 2023.

Next review: agency guidance, court interpretations or amendments. This health-data law is distinct from SB 690-style relief.

Policy arguments and commentary

Opinion · Rep. Roger Williams · The Hill · 2026-09-25

Stop the wiretap shakedown on Main Street

Rep. Roger Williams · September 25, 2026

Williams describes the costs facing small businesses and argues for federal reform, discussing HAIL alongside California’s narrower response.

Read the opinion column in The Hill

An opinion argument, not an independent finding about every case.

Advocacy statement · Travis Hall · Center for Democracy & Technology · 2026-08-21

Privacy advocacy perspective on SB 690

Reviewed 2026-09-28

CDT opposed the amended California SB 690, arguing that its restrictions on private actions and retroactive effect would weaken enforcement. This statement addresses the California bill, not the federal HAIL Act.

Read the coalition’s rationale and the HAIL Act’s remedy tradeoffs.

Read the source

Commissioned research · Oxford Economics · June 2026

Oxford Economics

Oxford Economics cost model, commissioned by Reform CIPA.

Commissioned by Reform CIPA. Modeled costs depend on the report’s assumptions and are not observed payments by every business.

Advocacy statement · Christopher Ott · Loeb & Loeb · 2026-05-22

Stage-specific defense-cost estimates

A published practitioner guide gives $50,000–$150,000 as a motion-to-dismiss benchmark and $250,000–$400,000 for class-certification briefing.

The author’s estimates describe particular litigation stages, not a typical total for every case or an amount paid by the owners featured here.

Read the source

Technical background

Share a source