US
Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA)
Overview
The Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA) is Pennsylvania's wiretapping law. Enacted in 1978, it prohibits the intentional interception, disclosure, or use of any wire, electronic, or oral communication without the prior consent of all parties, making Pennsylvania an all-party consent state. In 2022, the Third Circuit Court of Appeals held in Popa v. Harriet Carter Gifts that the law can apply to website tracking: a third-party marketing vendor that receives a visitor's website interactions may be “intercepting” them, there is no general exception for direct parties to the communication, and the interception is deemed to occur at the visitor's browser in Pennsylvania. The decision opened the door to a flood of class actions over session replay software, chat tools, and tracking pixels, making this law one of the most consequential wiretapping laws for website operators today.
Regulation Summary
- October 4, 1978 – Law is enacted, modeled on the federal Wiretap Act.
- 1988 – The Act is amended to extend its protections to electronic communications.
- 2012 – An amendment narrows the “direct recipient” exception so that it applies only to law enforcement officers in specific circumstances, a change that later proves decisive for website claims.
- August 16, 2022 – In Popa v. Harriet Carter Gifts, the Third Circuit holds that WESCA has no general direct-party exception and that interception of website communications occurs at the visitor's browser; the ruling is reaffirmed on rehearing later that year and triggers a wave of website wiretapping class actions in Pennsylvania.
- Any business that intercepts, records, or monitors communications involving people in Pennsylvania, including out-of-state companies whose websites are visited by Pennsylvania residents, because interception is deemed to occur at the visitor's browser.
- Websites and mobile apps using session replay software, live chat, chatbots, analytics tools, or advertising pixels that transmit visitor interactions to third parties.
- Businesses that record customer phone calls or voice interactions with Pennsylvania residents.
- Third-party marketing, analytics, and advertising vendors that receive the contents of visitor communications, after Popa, vendors cannot rely on being a “direct party” to the communication.
- Interceptions made with the prior consent of all parties are lawful. Courts have indicated that consent may be implied where disclosures adequately alert a reasonable person, but an inconspicuous privacy policy link alone may not be enough.
- Since the 2012 amendment, the direct-recipient exception is limited to law enforcement officers acting with proper approval; ordinary businesses and their vendors cannot invoke it.
- Communication service providers acting in the ordinary course of business.
- The Act contains additional narrow exceptions, such as certain emergency and authorized investigative activities.
- Obtain prior consent from all parties before intercepting, recording, or monitoring any wire, electronic, or oral communication involving Pennsylvania residents.
- Inventory all technologies that capture or transmit visitor and customer communications, including call recording, live chat, chatbots, session replay, analytics, and advertising pixels.
- Do not assume that being a party to the conversation protects you or your vendors: after Popa, there is no general direct-party exception under WESCA.
- Announce call and chat recording at the start of the interaction, before any recording begins.
- Maintain records demonstrating when and how each visitor's consent was obtained.
- Obtain prior, affirmative consent before session replay, tracking pixels, or other technologies that capture visitor communications begin running for Pennsylvania visitors.
- Disclose clearly and conspicuously that visitor interactions are recorded and shared with named categories of third parties. Popa left open whether a privacy policy can create implied consent, but courts expect disclosures that would actually alert a reasonable person, not a buried footer link.
- Show a recording notice at the start of live chat and chatbot sessions and obtain consent before the conversation proceeds.
- Block non-essential third-party scripts until consent is given, and keep them blocked for visitors who decline.
- Prefer click-through (clickwrap) consent over browsewrap for tracking disclosures, and keep timestamped consent records tied to each visitor.
- Consider limiting the data captured by session replay tools, masking form fields, or restricting such tools for Pennsylvania visitors where consent cannot be established.
- Jurisdiction follows the visitor: because interception occurs where the browser is located, companies with no physical presence in Pennsylvania can still be sued there over their website's tracking.
- Litigation risk turns on whether a tool acquires the “contents” of communications, whether the software qualifies as a “device,” and whether valid consent existed, document your position on each.
- Review contracts with analytics and marketing vendors to confirm what visitor data they receive, and ensure their scripts are subject to your consent controls.
- Pennsylvania has no comprehensive consumer privacy law, which makes WESCA, with its private right of action and liquidated damages, the primary vehicle for online privacy claims in the state.
- The right not to have wire, electronic, or oral communications intercepted, disclosed, or used without the consent of all parties.
- A private right of action under Section 5725.
- Unlawfully intercepted communications are generally inadmissible as evidence.
- Criminal enforcement: Unlawful interception is a felony of the third degree in Pennsylvania, punishable by up to 7 years in prison and a fine of up to $15,000.
- Civil enforcement: Private lawsuits and class actions with liquidated damages of $100 per day or $1,000 per violation, whichever is higher, plus punitive damages and attorney fees.
- Litigation trend: Since the 2022 Popa decision, dozens of class actions have been filed in Pennsylvania courts over session replay, chat features, and tracking pixels, and courts have repeatedly allowed such claims past early dismissal.