Chatbots and Website Tracking Technologies: Considerations Under Florida’s Security of Communications Act
March 31, 2026
The lawsuit against Orlando Health, commonly referred to as W.W. v. Orlando Health, alleged that the hospital system’s website technologies, including chatbots and tracking tools, captured and shared patient communications with third parties without proper consent. The claims were brought under the Florida Security of Communications Act (FSCA), which requires all parties to consent to the interception of communications. Plaintiffs argued that these tools effectively “recorded” sensitive interactions, potentially violating Florida’s strict two-party consent requirement.
In March 2025, a federal court allowed most of the claims to move forward, rejecting Orlando Health’s motion to dismiss. The court found that the alleged data collection could qualify as intercepting the “contents” of communications rather than merely metadata. This marked an important development in how traditional wiretap laws might apply to modern digital tools like chatbots and tracking pixels. However, on February 13, 2026, the parties jointly agreed to dismiss the case, and the court formally closed it the same day. The case ended without a final ruling on whether Orlando Health violated the law.
Under Florida Statutes § 934.03, Florida is a "two-party" (or "all-party") consent state for recording conversations.
- Consent Is Required: All parties to a conversation must consent before it can be legally recorded.
- Applies to: Oral, wire, and electronic communications where there is a reasonable expectation of privacy.
- Civil Liability: Victims may sue for damages.
Recording someone without their consent in Florida can result in both criminal prosecution and civil lawsuits.
The penalties for civil violations of the statute can include the following:
- Civil Damages: Victims may recover actual damages, or statutory damages of $100 per day for each day of violation (or $1,000, whichever is greater).
- Punitive Damages: Courts may award punitive damages in civil actions for willful violations.
- Attorney's Fees: The prevailing party in a civil suit may recover reasonable attorney's fees and litigation costs.
The Federal Trade Commission also regulates certain uses of AI data, including collection processes and practices. While the FTC does not have a multi-party consent regulation, it can take action if a company makes false claims about its recording practices in connection with conduct that is otherwise deceptive or misleading.
Although the W.W. v. Orlando Health lawsuit is no longer active, the rulings on the defendant’s Motion to Dismiss remain influential and have been cited in more recent Florida court decisions focused on interception of electronic communications. Courts have shown increasing openness to applying wiretap statutes like the FSCA to website technologies, and similar lawsuits continue to be filed, particularly in states with strict consent laws like Florida. While this specific case did not produce a definitive legal precedent, it reflects a broader and ongoing trend of litigation targeting chatbots, session replay tools, and tracking pixels in healthcare and other industries.
Businesses can take several steps to mitigate the risk of lawsuits alleging violations of the FSCA.
- Robust, recently updated Terms of Use, Privacy Policy, and Acceptable Use Policy documents are essential for any business that interacts with the public, whether via chatbots, submission forms, polls, reviews, or user-generated content. In these policies, a company can inform customers and site users about data collection and usage, and seek to limit court actions and class action suits. Some states currently allow browser-wrap agreements, while others require click-wrap agreements, making the latter preferable. However, given a recent Supreme Court ruling [link to the last post], a browser-wrap agreement may suffice. These policies should be visible and accessible on websites (including mobile versions) and apps.
- A visible and audible notification (for users who rely on screen readers) should appear on all chatbots, regardless of whether the user has used the chatbot before. This notification should state that the contents of the chat will be recorded and used to provide responses, services, information, and content, as well as for archival, training, and data processing purposes.
- Internal best practices that employees and contractors, including website developers and social media managers, can follow to avoid violating the Florida Security of Communications Act. Courts may choose to interpret this statute strictly, so clear internal guidelines can help prevent inadvertent violations.
Berger Singerman lawyers are available to discuss how to update internal and external policies and processes. We can also review your business’ agreements with third parties, including contractors, to help mitigate risks related to this issue.
