Tracking Lawsuits Hit 2,163 in One Year — Is Your WooCommerce Store Next?
Quick Answer: Tracking-related privacy lawsuits surged from 228 in 2021 to 2,163 in 2025 (IAPP, 2025). 59% target businesses with under $100 million in annual revenue, and 20.2% of SMBs have tracking pixels deployed with zero privacy mitigation. The legal theory driving most cases treats third-party pixels — Meta Pixel, TikTok Pixel, Google Ads remarketing tags — as illegal wiretaps under state laws like California’s CIPA. Server-side tracking reduces exposure by processing visitor data on a first-party server before forwarding consented events, removing the direct browser-to-third-party transfer that plaintiffs characterise as wiretapping.
In this article
- How many tracking-related lawsuits were filed in 2025?
- What size businesses are being targeted by tracking lawsuits?
- What tracking practices create the most legal exposure?
- What percentage of small businesses have no privacy protections on their tracking?
- Do most tracking lawsuits go to trial?
- How many US states have privacy laws that affect tracking?
- Which WooCommerce tracking pixels carry the highest lawsuit risk?
- Can a consent banner protect you from tracking lawsuits?
- What is the Camplisson v. Adidas ruling and why does it matter?
- How does server-side tracking reduce legal exposure?
How many tracking-related lawsuits were filed in 2025?
Tracking-related privacy lawsuits reached 2,163 in 2025, up from just 228 in 2021 — a nearly tenfold increase (IAPP, 2025) driven by state wiretapping laws being applied to website tracking pixels that send visitor data to third-party servers without explicit consent. That’s not a gradual trend. It’s an inflection point where plaintiff attorneys discovered that every Meta Pixel, every TikTok tag, and every Google remarketing snippet on a store owner’s site is a potential cause of action.
The acceleration happened because courts began accepting the argument that a tracking pixel sending visitor data from a browser to Facebook’s servers constitutes a “wiretap” under statutes like California’s Invasion of Privacy Act (CIPA). These laws were written for phone tapping. They’re now being applied to JavaScript. And the legal theory is winning — not occasionally, but consistently enough to fuel a tenfold increase in filings in four years.
Tracking-related privacy lawsuits surged from 228 in 2021 to 2,163 in 2025 — a nearly tenfold increase (IAPP, 2025).
What size businesses are being targeted by tracking lawsuits?
59% of tracking lawsuits target businesses with under $100 million in annual revenue (IAPP, 2025) — these aren’t enterprise GDPR fines making headlines. They’re lawsuits hitting the kind of business that runs a WooCommerce store, manages its own ad spend, and installed a Meta Pixel because a Facebook tutorial said to. The majority of defendants aren’t Fortune 500 companies with dedicated privacy counsel. They’re growing retailers and SMBs who assumed compliance was something bigger companies worried about.
The question isn’t X. The question is Y — it isn’t whether large companies face tracking lawsuits. It’s whether your WooCommerce store, running the same pixels as every other store, is distinguishable from the 59% already being targeted. If you installed a Meta Pixel through a WooCommerce plugin, added a TikTok tag from a YouTube tutorial, or turned on Google remarketing without reviewing what data leaves the browser, you’re running the same configuration that’s generating settlements in the tens to hundreds of thousands of dollars.
What tracking practices create the most legal exposure?
Third-party pixels that send visitor data to external servers without explicit consent create the highest legal risk — plaintiffs argue these constitute illegal wiretapping under state laws like California’s CIPA and Florida’s Security of Communications Act. The mechanism is straightforward: a visitor loads your product page, your Meta Pixel fires, and that visitor’s browsing data — page URL, product viewed, device fingerprint — is transmitted to Meta’s servers before the visitor has any meaningful opportunity to object.
The liability extends beyond advertising pixels. Session replay tools, analytics platforms, and any JavaScript that captures visitor behaviour and transmits it to a third-party server fall under the same legal theory. If the data leaves the visitor’s browser and reaches a server you don’t control without consent, it’s potentially a wiretap — regardless of whether the tool’s purpose is advertising, analytics, or “customer experience.”
Related: Your Facebook Pixel Could Be an Illegal Wiretap: What CIPA Litigation Means for WooCommerce
| Tracking tool | Data sent to third party | Legal risk level |
|---|---|---|
| Meta Pixel | Page URLs, product views, purchase data, device info | High — most litigated pixel in CIPA cases |
| TikTok Pixel | Page URLs, event data, device fingerprint | High — same browser-to-third-party transfer pattern |
| Google Ads remarketing | Browsing behaviour, audience signals | High — sends data to Google servers directly |
| Session replay (Hotjar, FullStory) | Mouse movements, clicks, scroll, form inputs | High — Camplisson v. Adidas expanded wiretap theory |
| GA4 (browser-side) | Page views, events, user properties | Moderate — first-party cookie but data leaves browser |
What percentage of small businesses have no privacy protections on their tracking?
20.2% of SMBs have tracking pixels deployed with zero privacy mitigation — no consent banner, no privacy policy reference to tracking, and no opt-out mechanism (IAPP, 2025). These stores installed a pixel, confirmed conversions were showing up in their ad dashboard, and moved on. There’s no consent management platform. There’s no cookie notice. The pixel fires on every page load for every visitor, and the store owner may not even know what data is being collected, let alone where it’s being sent.
Here’s the thing — these aren’t edge cases or outliers. One in five small businesses has tracking running with no privacy infrastructure at all. They’re the lowest-hanging fruit for plaintiff attorneys: no banner means no consent defence, no privacy policy reference means no disclosure defence, and no opt-out mechanism means every single visitor is a potential plaintiff. The math is simple — a store doing 10,000 monthly visitors with zero privacy mitigation has created 10,000 potential plaintiffs per month, every month the pixel has been active.
Do most tracking lawsuits go to trial?
Over 90% of tracking privacy cases settle before trial, typically costing SMBs between $50,000 and $500,000 depending on the scope of the violation and the number of affected users (IAPP, 2025). The economics are simple: defending a wiretapping lawsuit through trial costs more than settling, and the legal theory is untested enough that no store owner wants to be the one who sets precedent. So the cases settle. Quietly. And the plaintiff attorneys move to the next store running the same pixel configuration.
The settlement range depends on three factors: how many visitors were tracked without consent, how long the tracking was active, and how much data was transmitted. A WooCommerce store doing 10,000 monthly visitors with a Meta Pixel installed for two years has a materially different exposure than a store doing 500 visitors per month. But the legal costs of responding to the complaint — even before settlement negotiations begin — typically run $15,000 to $30,000 in attorney fees alone. For a small store owner, that’s the marketing budget for a quarter.
Related: 19 US States Now Have Privacy Laws That Affect Your WordPress Tracking
How many US states have privacy laws that affect tracking?
19 US states now have comprehensive privacy laws that regulate how websites collect and share visitor data through tracking pixels (IAPP, 2025) — and more are pending. Each law has its own definitions, consent requirements, and enforcement mechanisms. California’s CCPA/CPRA, Virginia’s VCDPA, Colorado’s CPA, Connecticut’s CTDPA, and 15 others each create a slightly different set of rules for what data you can collect, when you need consent, and what happens if you get it wrong.
For a WooCommerce store shipping nationwide, that’s 19 separate compliance surfaces. A visitor from Texas has different rights than a visitor from California, and both have different rights than a visitor from a state without a comprehensive privacy law. But the tracking pixel doesn’t distinguish — it fires the same way for every visitor, sends the same data to the same third-party server, regardless of where the visitor is located. The gap between how tracking actually works and what the law requires is where lawsuits live.
Which WooCommerce tracking pixels carry the highest lawsuit risk?
Meta Pixel, TikTok Pixel, and Google Ads remarketing tags carry the highest risk because they send visitor browsing data — including page URLs and product views — directly to third-party servers without processing on your own infrastructure first. The browser-to-third-party transfer is the legal trigger. When a visitor loads your WooCommerce product page and your Meta Pixel sends that page URL, the product they viewed, and their device fingerprint to Meta’s servers, plaintiff attorneys characterise that as an unauthorised interception of communications.
The risk is amplified by how WooCommerce plugins install these pixels. Most WooCommerce Meta Pixel plugins add the base pixel code to every page, enable automatic event tracking (PageView, ViewContent, AddToCart, Purchase), and start transmitting data immediately — often before any consent mechanism fires. The plugin does what it’s designed to do: track everything, send it all, and let the ad platform optimise. The problem is that “track everything, send it all” is exactly the behaviour that wiretapping statutes prohibit when done without consent.
Can a consent banner protect you from tracking lawsuits?
A consent banner reduces risk but doesn’t eliminate it — courts have found that some implementations fail to block data collection before consent is given, and “dark pattern” banners that make opting out difficult have themselves become targets of litigation. The banner is the minimum, not the solution. If your consent management platform loads after your Meta Pixel, the pixel fires before the visitor has a chance to decline — and that initial firing is enough for a wiretapping claim.
The technical requirement is that no third-party tracking script loads until the visitor affirmatively consents. That means the consent banner must block scripts at the network level, not just display a notice. Many popular WordPress consent plugins default to “informational” mode — they show a cookie notice but don’t actually block anything. Store owners see the banner and assume they’re compliant. Plaintiff attorneys see the network traffic and know they’re not.
What is the Camplisson v. Adidas ruling and why does it matter?
The Camplisson v. Adidas ruling established that session replay and analytics tools that capture detailed user interactions can constitute illegal wiretapping — broadening liability beyond traditional advertising pixels to any tracking tool that records user behaviour. Before this ruling, wiretapping claims focused on advertising pixels. After it, tools like Hotjar, FullStory, and Microsoft Clarity that record mouse movements, scroll depth, form interactions, and keystrokes are in the same legal category.
This matters for WooCommerce stores because session replay tools are commonly installed alongside ad pixels — they’re marketed as “understanding your customer journey” tools and many store owners install them through a plugin without realising the data is being processed on a third-party server. The Camplisson ruling means your analytics stack, not just your ad stack, is a potential litigation target. Any JavaScript that captures visitor behaviour and transmits it to a server you don’t control is now within the scope of wiretapping claims.
Related: Server-Side Tracking Is Actually More GDPR-Compliant Than Client-Side — Here’s Why
How does server-side tracking reduce legal exposure?
Server-side tracking processes visitor data on a first-party server under your control before forwarding consented events to ad platforms — this removes the direct browser-to-third-party data transfer that plaintiffs characterise as illegal wiretapping. The visitor’s browser communicates with your server. Your server decides what to forward, to whom, and under what consent conditions. There’s no JavaScript sending data to Meta, TikTok, or Google directly from the visitor’s browser.
This matters legally because the wiretapping theory depends on an unauthorised third party intercepting communications. When your own server processes the data first, the “third party” never touches the raw communication. Your server receives a first-party event, checks whether the visitor consented, strips or hashes personal identifiers according to your policy, and then sends a processed, consented event to the ad platform through a server-to-server API. The ad platform gets the conversion data it needs. The visitor’s raw browsing session stays on your infrastructure.
Transmute Engine handles this for WooCommerce by routing events through a managed first-party endpoint — Meta Conversions API, Google Ads API, TikTok Events API, and GA4 Measurement Protocol all receive server-processed events rather than raw browser data, eliminating the browser-to-third-party transfer pattern that generates the majority of tracking lawsuits.
Server-side tracking removes the direct browser-to-third-party data transfer that plaintiffs characterise as illegal wiretapping under state privacy laws.
Key Takeaways
- Tenfold surge in tracking lawsuits: from 228 in 2021 to 2,163 in 2025, with 59% targeting businesses under $100M revenue and 90%+ settling for $50K–$500K.
- Your pixels are the legal trigger: Meta Pixel, TikTok Pixel, and Google remarketing tags send visitor data directly to third-party servers — the exact pattern courts are treating as illegal wiretapping.
- 20.2% of SMBs have zero mitigation: no consent banner, no privacy policy reference, no opt-out — and consent banners alone don’t eliminate risk if they fail to block tracking before consent.
- Server-side tracking removes the exposure: processing data on your own server before forwarding consented events eliminates the browser-to-third-party transfer that drives most lawsuits.
Tracking-related privacy lawsuits reached 2,163 in 2025, up from 228 in 2021 — a nearly tenfold increase driven by state wiretapping laws being applied to website tracking pixels that send visitor data to third-party servers without explicit consent.
59 percent of tracking lawsuits target businesses with under 100 million dollars in annual revenue — these are not enterprise-only problems but direct legal risks to growing WooCommerce stores and SMB retailers running standard ad platform pixels.
Third-party pixels that send visitor data to external servers without explicit consent create the highest legal risk because plaintiffs argue these constitute illegal wiretapping under state laws like California’s CIPA and Florida’s Security of Communications Act.
20.2 percent of SMBs have tracking pixels deployed with zero privacy mitigation — no consent banner, no privacy policy reference to tracking, and no opt-out mechanism for visitors.
Over 90 percent of tracking privacy cases settle before trial, typically costing SMBs between 50,000 and 500,000 dollars depending on the scope of the violation and the number of affected users.
19 US states now have comprehensive privacy laws that regulate how websites collect and share visitor data through tracking pixels, with more states adding legislation each year.
Meta Pixel, TikTok Pixel, and Google Ads remarketing tags carry the highest risk because they send visitor browsing data including page URLs and product views directly to third-party servers without processing on your own infrastructure first.
Server-side tracking processes visitor data on a first-party server under your control before forwarding consented events to ad platforms, removing the direct browser-to-third-party data transfer that plaintiffs characterise as illegal wiretapping.
A consent banner reduces risk but does not eliminate it — courts have found that some implementations fail to block data collection before consent is given, and dark pattern banners that make opting out difficult have themselves become targets of litigation.
The Camplisson v. Adidas ruling established that session replay and analytics tools that capture detailed user interactions can constitute illegal wiretapping, broadening liability beyond traditional advertising pixels to any tracking tool that records user behaviour.