A noticeable shift is underway: businesses are increasingly facing legal challenges over how their websites track users. While this article is not intended to provide any form of legal advice, (our suggestion to anyone dealing with a lawsuit around data usage, is to seek legal advice in their relevant jurisdiction) we can at least explore the fundamentals of what exactly is happening.
From the United States to Europe and other area’s following suit, regulators and courts are paying closer and closer attention to how user data is collected, shared, and processed particularly when it involves third-party tracking technologies such as analytics tools, marketing scripts, and session replay tools. In some cases, this is a very productive development for the protection of user data; nevertheless, it also presents an opportunity for opportunistic litigation driven more by financial incentives than by genuine substantive concerns around data protection.
Law firms are actively pursuing claims on behalf of users, arguing that certain tracking practices may amount to unlawful data collection or even interception of communications. This trend is on the rise, and fast.
This article explores what’s driving this trend, what it means for businesses, and how organisations can respond.
🚨 Disclaimer: We Are Not Lawyers
This article is for informational purposes only and does not constitute legal advice. While we consider ourselves experts in the implementation of tracking technologies and can support businesses rectify incorrect implementations. We cannot advice on legal claims.
If your organisation has received a legal letter or is concerned about compliance, you should seek advice from a qualified legal professional within the jurisdiction of your business.
Why Is There a Rise in Legal Cases Around Website Tracking?
At the core of most of these legal cases is the issue of websites collecting and sharing user data in ways that users may not fully understand or have consented to.
Many modern websites heavily rely on analytics platforms; advertising pixels; performance and behavioural tracking tools, and they change quickly.
These usually capture:
- Clicks
- Page views
- Form Inputs
- Browsing behaviour
In many cases this data is in real time shared with third parties, and this is at the root of these legal cases.
The Consent Problem
Privacy laws are continuously developing across the globe, however the majority of laws (e.g., GDPR, ePrivacy directive) require that:
- Users are clearly informed about tracking
- Consent is obtained BEFORE non-essential tracking systems become operational
- Consent is specific and granular (e.g., separating analytical tracking and marketing tracking)
However, often in practice:
- Consent banners are unclear of misleading
- Tracking scripts load before consent is given
- Users are not always aware of the extent of data sharing
- Website systems haven’t been updated in many years
This gap between legal expectation and technical reality is driving litigation, making it crucial you audit your consent mechanisms to avoid legal turmoil.
What Role Do Third-Party Scripts Play?
Third party scripts are absolutely critical to identifying consent issues. As sometimes businesses setup these systems many years ago, or are otherwise unaware that third party tracking pixels sit on their site.
Some third party scripts are:
- marketing pixels (e.g. ad platforms like Meta)
- analytics tools
- session replay software
- embedded third-party services
What is actually happening that is unlawful when it comes to third party tracking scripts?
In many tracking implementations scripts can activate (or ‘fire’) before the user has explicitly given consent. If you are recording user data, without the user consenting to this, it may be unlawful.
This can result in:
- User interaction data being sent externally to 3rd parties
- Third parties receiving data, they should not have access to yet (as users haven’t given consent)
- Potential violations of privacy laws or, in some jurisdictions, wiretapping-style legislation
Recently legal arguments have focused on the idea that transmitting user interactions to third parties without consent may constitute an ‘interception’ of communications, Even where that theory is being contested, courts are increasingly favouring these proceedings.
Why Is There Increasing Legal Pressure?
There are several key factors that contribute to the increased legal pressure, these are regular momentum, technological complexity, litigation opportunities, and increased user awareness.
Regular Momentum
Authorities are tightening enforcement around:
- cookie consent
- transparency
- data sharing practices
At the same time, in the United States, courts are beginning to engage with similar issues through litigation. For example, in Pemberton v. Restaurant Brands International (2025) and Wiley v. Universal Music Group (2025) claims were allowed to proceed where plaintiffs alleged that website tracking tools shared user interaction data with third parties without proper consent. This reflects a broader global trend: whether through regulators or courts, scrutiny of tracking practices is increasing. When we start to see historical cases such as these resolved, it sets the tone for how future cases may be handled.
Technological Complexity
Modern websites use dozens of scripts, often:
- implemented via tag managers
- deployed by various marketing teams, agencies, previous team members
- not fully audited for compliance, or misunderstood on what to check
In cases such as Smith v. Rack Room Shoes (2025), courts have examined how these technologies operate in practice particularly whether third-party tools are receiving user data in a way that users would not reasonably expect. This demonstrates that even complex tracking issues will be looked at by the courts.
Litigation Opportunities
In jurisdictions like the US, laws enable:
- private claims with large cash settlements
- class actions which can be extremely expensive and threatening to businesses
- statutory damages
This creates strong incentives for legal action, and potential areas for exploitation.
User Awareness
Users are becoming more aware that:
- their behaviour is tracked, and how the consent systems work
- their data may be shared across platforms to 3rd parties
- they have rights over that data
From a User’s Perspective: Why This Matters
Although this may mean more audits, and tighter restrictions it’s important to take a step back and consider this from a user’s point of view.
When a user visits a site, they may see this as a private interaction where their actions are only visible to that website. However the case may be that their behaviour may be shared to multiple third parties; their activity may be used for profiling or advertising; they may have little visibility and/or control over this process.
For some users this can raise major concerns around:
- Privacy
- Autonomy
- Trust
Ultimately, if users feel they are not in control of their data, trust in digital experiences break down. This is where increasing legal structure around protecting users rights to their data, is in general a positive development.
The Importance of Proper Consent Mechanisms
This can seem a bit daunting with the continuing changes among data laws coming out, and having to stay up to date with new regulations. However it’s important to start thinking ahead to what a compliant data tracking setup should look like.
A compliant consent setup should:
- Block all non-essential tracking by default
- Clearly distinguish between:
- analytics
- marketing
- functional cookies
- Allow users to:
- accept
- reject
- customise preferences
- edit previous selections
The crucial underlying factor is that consent must actively control whether scripts are allowed to run, not just inform users that they exist.
So What’s the Solution?
While the legal landscape is evolving, there are clear technical steps organisations can take to reduce risk.
These are:
- Implement Robust Consent Management
- Control Script Execution (Not Just Disclosure)
- Move Towards First-Party, Controlled Tracking
- Audit Your Tracking Stack
1. Implement Robust Consent Management
Ensure your consent banner:
- is clear and transparent
- offers genuine choice
- integrates properly with your tracking and analytics systems
2. Control Script Execution (Not Just Disclosure)
A major issue in many setups is that:
Scripts fire regardless of consent status
This needs to be addressed at a technical level, no data should be sent without explicit consent from the user, and this should be laid out in the consent management platform. While in some territories, implied consent can be allowed (to date this is still possible in the United States) the control of the execution of scripts should still be commanded by the input from the consent management system.
3. Move Towards First-Party, Controlled Tracking
One emerging approach is server-side tracking.
Benefits include:
- greater control over what data is sent
- ability to filter or anonymise data
- reduced reliance on uncontrolled third-party scripts
To learn more about personal identifiable information and server-side tracking, what a server-side tracking set-up is, and the importance of first party data in marketing explore our case studies and articles.
4. Audit Your Tracking Stack
When tracking website data, you are responsible for the data collected and shared within your domains, therefore there should be continuous auditing to ensure compliance.
Ask:
- What scripts are running?
- When do they fire?
- What data do they collect?
- Where is that data sent?
Final Thoughts
The rise in website tracking lawsuits is not happening in isolation, it reflects a broader shift towards greater accountability, transparency and user control over data.
The direction website tracking is going is clear – users want to be able to trust business. This means organisations need to: respect users choices, implement proper consent mechanisms, and take control of their tracking infrastructure.
If you would like to have an exploratory call on how to audit your site for compliance, or install a first-party data infrastructure. Just hit the button in the top right of the website which says ‘Book Your Free Audit’.
Yes.
In certain circumstances. Recent legal cases have shown that websites may face claims if tracking tools (such as analytics platforms or marketing pixels) collect or share user data without proper consent. The key issue is not the tool itself, but whether it is implemented in a way that complies with applicable privacy laws and respects user choice.
In many jurisdictions, this can create legal risk. It’s hard to give a definitive answer because it’s based highly on the legal framework in the country you are based. Privacy laws in the UK and EU generally require that non-essential tracking (such as analytics and marketing) is blocked until a user has actively consented to that element of data usage. Currently in the United States, it’s possible to have implied consent until a user declines.
You should review how and when those scripts are executed. This includes ensuring that:
- tracking does not begin before consent is given
- users are clearly informed about what data is collected
- third-party tools are properly configured and controlled
- If you are unsure, it’s advisable to seek legal or technical guidance to ensure your setup aligns with current privacy expectations and regulations.
