US
Florida Security of Communications Act (FSCA)
Overview
The Florida Security of Communications Act (FSCA) is Florida's wiretapping and electronic surveillance law. Enacted in 1969 and modeled on the federal Wiretap Act, it prohibits the intentional interception, disclosure, or use of any wire, oral, or electronic communication without the prior consent of all parties. This makes Florida a “two-party consent” or, more accurately, an all-party consent state. Although the FSCA was written in the era of telephone taps and hidden recorders, courts have been asked to apply it to modern website technologies, session replay tools, live chat and chatbots, and third-party tracking pixels that capture what visitors type, click, and share online. Following a 2025 federal court decision allowing pixel-tracking claims to move forward, the FSCA has become one of the most actively litigated wiretapping statutes in the country, exposing website operators to demand letters, individual suits, and class actions.
Regulation Summary
- 1969 – The Florida Security of Communications Act is enacted as Chapter 934, modeled on the federal Wiretap Act of 1968.
- 1988 – The FSCA is amended to extend its protections to electronic communications, following the federal Electronic Communications Privacy Act of 1986.
- June 17, 2021 – In Jacome v. Spirit Airlines, a Florida court rejects an early attempt to apply the FSCA to website session replay technology; similar claims are dismissed in other cases.
- March 6, 2025 – In W.W. v. Orlando Health, a federal court in Florida allows FSCA claims over website tracking pixels to proceed past dismissal, finding the technology may capture the “contents” of visitor communications. The ruling triggers a new wave of website wiretapping lawsuits and pre-suit demand letters across Florida.
- Any business that intercepts, records, or monitors communications involving people in Florida, including companies located outside Florida whose websites are visited by Florida residents.
- Websites and mobile apps using session replay software, live chat, chatbots, analytics tools, or third-party tracking pixels that capture visitor interactions and transmit them to vendors.
- Businesses that record customer phone calls, video calls, or voice interactions with Florida residents, such as call centers and customer support teams.
- Third-party marketing, analytics, and advertising vendors that receive the contents of visitor communications from websites serving Florida users.
- Interceptions made with the prior consent of all parties to the communication are lawful, consent is the core compliance path under the FSCA.
- Communication service providers and their employees acting in the ordinary course of business.
- Interceptions authorized under the Act's judicial-authorization procedures.
- Certain communications, such as those reporting emergencies, are treated differently under the Act.
- A 1988 amendment excludes devices that merely track the movement of a person or object; some courts relied on this and on the lack of substantive “contents” to dismiss early session replay claims.
- Obtain prior consent from all parties before intercepting, recording, or monitoring any wire, oral, or electronic communication involving Florida residents.
- Inventory every technology that captures visitor or customer communications, including call recording, live chat, chatbots, session replay, analytics, and advertising pixels.
- Ensure third-party vendors do not receive the contents of visitor communications, such as form inputs, chat messages, or search queries, before valid consent is obtained.
- Announce call and chat recording at the start of the interaction, before any recording begins.
- Document when and how consent was collected, so it can be demonstrated if a claim is made.
- Present a clear consent mechanism that obtains prior, informed opt-in consent before non-essential tracking technologies, such as session replay, advertising pixels, and analytics that capture communication contents, begin running. Consent gathered after tracking has already started may not defeat a claim.
- Display a notice at the start of live chat and chatbot sessions informing visitors that the conversation may be recorded, monitored, or shared with third parties, and obtain consent before the session proceeds.
- Block non-essential third-party scripts until consent is given, and keep them blocked if the visitor declines or opts out.
- Disclose in the privacy policy which tracking technologies are used, what they capture, and which third parties receive the data. Courts have questioned whether a footer link alone demonstrates consent; a clear, affirmative consent flow is a stronger position.
- Honor opt-out mechanisms and universal signals such as Global Privacy Control where applicable, and avoid transmitting sensitive form inputs or health-related page data to advertising platforms.
- Keep timestamped consent records tied to each visitor interaction as evidence of compliance.
- Court decisions have focused on whether a technology captures the “contents” of a communication, such as messages, form entries, and search terms, rather than mere metadata. The more substantive or sensitive the captured information, the higher the risk.
- Plaintiffs are also invoking the FSCA's pen register and trap-and-trace provision (Section 934.31) against analytics scripts and pixels that capture visitor identifiers, an aggressive theory that remains contested in the courts.
- Pre-suit demand letters, small-claims filings, and federal class actions are all in active use; because liquidated damages apply per violation, exposure can aggregate quickly across thousands of website visitors.
- Review vendor contracts to confirm how tracking providers collect, use, and retain visitor communications captured on your website.
- The right not to have wire, oral, or electronic communications intercepted, disclosed, or used without prior consent of all parties.
- A private right of action.
- The right to seek injunctive relief to stop ongoing unlawful interception.
- Unlawfully intercepted communications are generally inadmissible as evidence in court proceedings.
- Criminal enforcement: Violations are prosecuted by the state; intentional unlawful interception is generally a third-degree felony, punishable by up to 5 years in prison and a $5,000 fine.
- Civil enforcement: Private lawsuits and class actions under Section 934.10, with liquidated damages of $1,000 or $100 per day per violation, whichever is higher, plus punitive damages and attorney fees.
- Litigation trend: Website wiretapping filings under the FSCA have grown sharply since 2025, targeting tracking pixels, session replay, chatbots, and live chat on consumer-facing websites.