Florida Federal Court Permits Another Digital Wiretapping Claim to Proceed: What Every Business With a Website Needs to Know

Florida Federal Court Permits Another Digital Wiretapping Claim to Proceed: What Every Business With a Website Needs to Know

A Florida federal court just gave the green light to a proposed class action accusing a business of illegally intercepting communications simply by using common website tracking tools, delivering yet another blow to any Florida business with a website. The August 11 decision in Crespi v. BayCare Health System from the U.S. District Court for the Middle District of Florida is the latest chapter in the fast-growing category of privacy litigation. It confirms Florida’s status as the second-hottest venue in the nation for this particularly challenging kind of claim. Here’s what happened, what the court decided, and what it means for you.

What Happened?

Three people sued BayCare Health System, a nonprofit healthcare network in Central Florida, over its use of two common analytics tracking tools on its website.

• The plaintiffs claim that they used BayCare’s website over periods ranging from three to more than 10 years to search for physicians, request appointments, and research medical conditions such as arthritis.
• They claimed that while they were logged into their personal browsers, the tracking tools captured their searches, clicks, and other website activity and sent that information to the search engine without their consent.
• Because the plaintiffs were logged in, they argued the data was personally identifiable and tied directly to their browser profiles.
• They alleged this amounted to an interception of their private medical communications with BayCare, exposing details like which doctors they were researching and what conditions they were dealing with.
• They filed a class action lawsuit alleging violations of the Florida Security of Communications Act and the federal Wiretap Act, along with a breach of confidence claim.

Court Deals Blow to Businesses

BayCare moved to dismiss the case, arguing the plaintiffs lacked standing to sue and had not adequately pleaded any of their claims. The court sided with the plaintiffs on nearly every issue that mattered.

• Standing. The court found that the alleged disclosure of sensitive medical searches and communications, without consent, was enough on its own to establish a concrete injury sufficient for the case to proceed in federal court.  
• Florida Security of Communications Act. The court rejected BayCare’s argument that plaintiffs needed to have shown a subjective expectation of privacy to proceed, holding that such a requirement applies only to oral communications, not electronic ones like website activity. The court also found it plausible that the tracking tools “intercepted” the plaintiffs’ communications and that information like physician searches and medical condition inquiries qualified as protected “contents” under the statute.
• Federal Wiretap Act. BayCare argued it could not be liable because it was a party to the communications at issue, which is normally a defense to a wiretapping claim. The court found that the plaintiffs plausibly invoked an exception to that defense by alleging BayCare intercepted the communications for the purpose of violating HIPAA and its common-law duties of confidentiality, which was enough to let the claim move forward.
• Breach of confidence. The court found that the plaintiffs’ repeated, years-long use of the website to research physicians and conditions was enough to plausibly allege a confidential relationship with BayCare, even though two of the named plaintiffs were not BayCare patients.

Florida is the New Hotbed

We asked in January whether Florida is the new hotbed for digital wiretapping lawsuits. This latest court decision confirms the answer is yes. After all, it is not an isolated ruling. It follows the same pattern we also flagged earlier this year when the same district court issued a similar ruling.

Moreover, Florida is not slowing down in its pursuit to catch California as the epicenter of digital wiretapping litigation. Our firm’s Digital Wiretapping Litigation Map shows the current state-by-state breakdown of these lawsuits and reveals Florida to be the only state within reach of California. Decisions like this one will only accelerate that trend.

The reason? Florida courts are increasingly willing to let digital wiretapping claims clear the motion to dismiss stage on nearly identical theories. They usually conclude that standard analytics and advertising tools amount to unlawful interception when they capture identifiable, sensitive information about what a website visitor searched for or disclosed.

All Florida Businesses Should Take Note

Any healthcare business that operates a patient portal, health-related content, or a site touching similarly sensitive subject matter should pay attention to this latest decision. But the reasoning in this case is not limited to healthcare. The same tracking technologies power e-commerce sites, customer service platforms, marketing pages, and career sites across every industry. The court’s logic on this case will most likely extend well beyond hospitals and health systems.

What Should Florida Businesses Do Now?

In order not to get caught up in this wave of litigation, every Florida business with a website should consider the following:

1. Audit your tracking technologies. Catalog every pixel, analytics tool, session replay tool, and marketing script on your website. If you are a healthcare business, also look at any patient, customer, or applicant portal. Have your outside counsel lead this review to preserve attorney-client privilege.

2. Fix your consent flow. A privacy policy buried in a footer link is not enough. Consent needs to be clear, conspicuous, and obtained before tracking begins, not after.

3. Flag sensitive content areas. Pages touching health information, financial data, or similarly sensitive topics deserve extra scrutiny. Work with your counsel to determine whether tracking should be turned off entirely.

4. Revisit vendor contracts. Make sure agreements with analytics and advertising vendors clearly assign responsibility for compliance and include indemnification where possible.

5. Get involved in efforts to amend Florida’s law. Several states, including Tennessee and New Hampshire, have amended their state wiretapping laws to clarify that it is not a violation of the law for a business to deploy third-party cookies and pixels on its website. California is considering a bill to tighten the law as well (and one of our attorneys recently testified in aid of that ongoing legislative effort). Florida is primed for a similar clarification of its law, and FP attorneys are involved in legislative efforts that will take shape by early 2027. Contact your Florida business industry association to voice your concerns regarding this troubling litigation trend. And contact your Fisher Phillips attorney or our FP Gov group to inquire about ways you can support ongoing legislative efforts.

Conclusion

Fisher Phillips will continue to track how Florida courts handle digital wiretapping claims and what it means for businesses. Make sure you are subscribed to Fisher Phillips’ Insight System to get the most up-to-date information. If you have questions, contact your Fisher Phillips attorney, the authors of this Insight, any attorney in our Florida offices, or any member of our Digital Wiretapping Litigation Team.