A Florida wiretapping lawsuit can now start with two questions about shipping. That is roughly what happened to Boarderie, a Riviera Beach company that ships charcuterie boards. Someone used the AI chat widget on its website, asked about shipping, and the company later found itself named in a lawsuit. The owner told a West Palm Beach news station he was stunned.
He is not alone, and the pattern is not random. Since July 2025, attorneys for a single Broward County plaintiff have filed more than 160 of these suits against Florida businesses, sometimes ten in a day, using largely the same complaint language each time. If your website has a chat widget, this is worth understanding before a letter arrives.
What a Florida Wiretapping Lawsuit Actually Claims
The statute is the Florida Security of Communications Act, Fla. Stat. 934.03, and it is not new. It was written to stop covert surveillance: hidden recorders, tapped phone lines. Florida is an all-party consent state, which means every participant in a communication has to consent before it can lawfully be intercepted. Most Floridians know this as the reason customer service calls announce that they may be recorded.
The argument being made now is that your website works the same way. When a visitor types into a chat widget, they are communicating with your business. If a third party vendor is also receiving that text, the theory goes, a party outside the conversation has intercepted a communication, and nobody asked the visitor first.
The same reasoning gets applied to session replay tools that record keystrokes and mouse movement, and to advertising pixels that report what a visitor did on your site. Chat is simply the easiest version to plead, because the interception is text a human actually typed.
One Plaintiff, More Than 160 Lawsuits
The volume matters more than any single case. Court records reviewed by reporters show one plaintiff’s attorneys filing at a pace that only works if the complaints are near-identical, which they are.
This is a business model, not an accident, and understanding it tells you how to think about the risk. These filings are not built to win at trial. They are built to cost more to fight than to settle. Many land in small claims court, where hiring a lawyer to mount a real defense exceeds the amount in dispute before you have filed a single motion.
Some complaints seek at least $2,500 in statutory damages for each alleged interception, plus fees and costs. Multiply that by a class, or simply by the number of letters a firm can send in a month, and the economics explain themselves.
The Size Threshold Trap
Here is the part that catches small and mid-sized organizations, and it is the reason “we are too small for this” is the wrong instinct.
Florida does have a comprehensive consumer privacy law. The Florida Digital Bill of Rights carries a revenue threshold in the neighborhood of a billion dollars, so it reaches almost no small or mid-sized business. If you looked at Florida privacy law once, concluded you were far below the threshold, and stopped reading, that conclusion was correct as far as it went.
The wiretap statute is a different law with no size threshold at all. It does not care about your revenue, your headcount, or whether you are a business or a nonprofit. A two person shop and a hospital system are equally capable of being named. The law that exempts you and the law generating the lawsuits are not the same law.
The Damages Math
FSCA provides liquidated damages of $1,000 per violation or $100 per day of violation, whichever is greater, plus actual damages, attorney’s fees, and potentially punitive damages.
Two things about that formula are worth sitting with. The daily accrual means a site left uncorrected keeps adding to its own exposure while everyone decides what to do. And the fee shifting is what makes small claims filings rational for a plaintiff’s firm, because the statutory floor plus fees can exceed what the case costs them to bring.
You may see higher per visitor figures quoted in headlines. Treat those as an aggregation of multiple alleged violations rather than the statutory number, and ask your counsel what actually applies to your situation.
Courts Are Split, and That Is Exactly Why Filings Continue
It would be easier to write this post if the law were settled. It is not.
Florida courts previously rejected FSCA claims built on website analytics. Then in March 2025, a federal judge in the Middle District of Florida allowed a claim to survive a motion to dismiss in W.W. v. Orlando Health, finding the plaintiff had adequately alleged interception of content through third party pixels. The parties dismissed that case themselves in February 2026, so no court ever ruled on whether Orlando Health actually violated the statute. The signal was enough regardless.
Since then the results have been genuinely mixed. Some courts have dismissed claims where the site’s disclosures were deemed sufficient. Others have let cases proceed past the pleading stage. That inconsistency is not a temporary phase on the way to clarity. It is the fuel. When outcomes are unpredictable, settlement looks rational to defendants, and filing looks rational to plaintiffs.
The case worth watching is a pixel suit against Nike in the Southern District of Florida, set for trial November 2, 2026. It would be the first major FSCA pixel case to reach a jury, and the verdict will tell us more about 2027 than anything filed so far.
What Has Actually Worked
The defenses that have succeeded are less exotic than you would expect, and they share a theme: the visitor knew before the interaction, and you can prove it.
Disclosure that appears before the conversation starts, rather than buried in a privacy policy nobody opened, has been enough for some courts to dismiss. For a chat widget specifically, that means the notice needs to be visible at the point the visitor engages, not linked from the footer.
Consent records with timestamps have defeated demand letters outright. If you can show what a specific visitor was shown and when they agreed, the claim gets much harder to plead. Most consent platforms can log this. Most installations never turn it on.
And underneath both, the trackers have to actually be blocked until consent happens. A banner that displays a notice while the chat widget and the pixels fire anyway produces a written record that you knew about the issue and did not stop it. We wrote about that gap in our post on CIPA lawsuits, since California’s version of this fight is further along and the mechanics are identical.
What To Do About It
If you have received a demand letter or a complaint, call your attorney before you touch the website. Changing things after a claim arrives is a legal decision about sequencing and preservation, and what you write down while investigating can become discoverable. This is the one situation where doing something helpful can make your position worse.
If you have not received anything, the useful first step costs nothing: find out what your site loads before a visitor consents to anything. Open it in a private window with the network tab recording, and watch what fires before you click a thing. Most organizations have never looked, and the answer tends to be more than anyone expected.
E11 is not a law firm and cannot tell you whether this statute reaches you. What we can do is the build: audit what is running, configure the consent platform to genuinely block third party scripts before consent, get the disclosure in front of the chat widget rather than behind it, turn on consent logging, and document the result so your counsel has something concrete to review. That is our privacy and consent compliance service, scoped and priced per site.
Where This Leaves You
Florida has become the second front in a fight that started in California, and it arrived faster than most businesses noticed. The statute is decades old, the theory is new, the courts disagree with each other, and a single plaintiff can generate 160 filings while that gets sorted out.
None of which means you should panic or buy something today. It means the question “what does our website do before someone says yes” has moved from a technical curiosity to something a business owner should be able to answer. If you cannot answer it, that is the place to start, and it is an afternoon of work rather than a project.
Common Questions About Florida Wiretapping Lawsuits
Does this only affect Florida businesses?
No. Liability follows the location of the person whose communication was intercepted, not where your business is headquartered. A company that has never operated in Florida can be named because Florida residents visit its website. Geofencing does not reliably solve this either, since a VPN makes someone appear to be elsewhere and a Florida resident traveling is still a Florida resident.
Do I have to remove my chat widget?
No, and that is usually the wrong fix. The claim is about interception without consent, not about chat existing. Disclosure before the conversation begins, real consent, and a record of both address the theory without removing a tool that converts.
What if we are a nonprofit?
The wiretap statute does not carve out nonprofits. Nonprofit sites run the same chat widgets, analytics, and donation page pixels that generate these claims, usually with a smaller legal budget behind them.
Is this the same as the California CIPA lawsuits?
Different statute, same underlying theory. California’s is further along and currently the subject of reform legislation that could narrow part of it, though that bill has to pass before the legislature adjourns on August 31, 2026. Florida’s is expanding. A business with visitors from both states is exposed under both, and the technical remediation is the same work either way.
Does a cookie banner protect me?
Only if it actually blocks the trackers and logs the consent. A banner that displays a notice while everything fires underneath it is documentation of the problem, not a defense.
