The federal inquiry
18 U.S.C. §2511 addresses intentional interception of communications, subject to exceptions. For a website investigation, identify actual contents, contemporaneous acquisition, the recipient, technical mechanism and each party's role. Session-replay or pixel code alone does not prove interception of a person's protected communication. Read §2511.
Contents and collection
Preserve the payload, request initiator and timeline. Distinguish substantive searches or form contents from ordinary routing data. Inspect masking and whether content actually left the browser. A vendor's advertised capability is not evidence that a particular deployment exercised that capability.
One-party consent and the crime-tort exception
A party's prior consent can be a defense even when a third party receives the communication. The website operator's consent therefore matters. Counsel must evaluate who was a party and the scope of consent.
The crime-tort exception requires interception for an independent criminal or tortious purpose. Planned Parenthood v. Newman (9th Cir. 2022) requires a purpose separate from the recording itself. The same alleged CIPA interception cannot simply bootstrap a federal claim.
Semien v. PubMatic (N.D. Cal. Jan. 27, 2026) allowed specified sensitive cross-site profiling and interception claims to proceed at the pleading stage. It is not a finding that routine advertising or every RTB request satisfies the exception.
Standing is a separate inquiry
Popa v. Microsoft (9th Cir. 2025) rejected automatic federal standing from ordinary session-replay shopping data. Fons v. Grocery Outlet (N.D. Cal. Sept. 24, 2026) found an allegedly ignored Reject All choice insufficient on the ordinary-data facts there. Neither a tracker signature nor a broken banner establishes a person's concrete injury. Sensitive data and cross-site profiling require factual proof; a business category is not proof of sensitive disclosure.
Remedies are not automatic
For the ordinary §2520(c)(2) category, the court may assess the greater of actual damages plus violator profits or statutory damages of the greater of $100 per day or $10,000. This is not a guaranteed award per request, tracker or person. Fees and punitive relief have separate requirements. Read §2520.
State laws need separate review
A list of all-party-consent states does not establish website-tracking liability in each state. Coverage, territorial application, remedies and appellate decisions differ. Neither a federal label nor a scanner location establishes nationwide class certification or personal jurisdiction.
Using Discover
Discover supplies technical observations and research questions for attorney review. Historical catalogue entries are not automatically available for purchase. The reviewed-package pilot requires a defined scan, checked artifacts and human review; availability and delivery dates are confirmed individually. View the synthetic sample or discuss a pilot investigation.
Deliberize LLC is a technology company, not a law firm. These materials are not legal advice and do not establish a violation, admissibility, standing, class certification or recovery. Legal reference date: October 5, 2026.