US Privacy Law Guidance

Privacy laws that generate website litigation

VPPA, CIPA, HIPAA, CCPA, BIPA, and Washington My Health My Data are the statutes most frequently cited in demand letters and class actions against website operators. Each one is triggered by specific technologies on your site. Understand what creates exposure and what to do if a claim arrives.

Federal and state statutes
Demand letter guidance
Technical evidence support

Covered Statutes

Laws by jurisdiction

Each page explains what the law covers, which website technologies trigger exposure, and what to do if a demand letter or enforcement inquiry arrives.

Federal (US)
VPPA

Video Privacy Protection Act

Federal law that prohibits disclosing a consumer's video viewing history without consent. Now widely used in litigation against news, media, and healthcare sites that embed video players alongside ad pixels.

HIPAA

HIPAA and Website Tracking Technologies

OCR guidance confirms that ad pixels and analytics tools on HIPAA-covered entity websites can constitute impermissible disclosures of ePHI, even on public-facing pages.

California
CIPA

California Invasion of Privacy Act

California wiretap law frequently cited in class actions against companies using session replay, chat widgets, and form-capture tools. Section 631 prohibits intercepting communications without consent. Statutory damages are $5,000 per violation.

CCPA/CPRA

California Consumer Privacy Act / California Privacy Rights Act

California's comprehensive consumer privacy law gives residents opt-out rights over the sale and sharing of their personal information. The CPRA created the California Privacy Protection Agency to enforce the law alongside the Attorney General.

Illinois
BIPA

Illinois Biometric Information Privacy Act

Illinois biometric privacy law with a private right of action and statutory damages of $1,000-$5,000 per violation. Active litigation targets facial recognition, device fingerprinting, and behavioral biometrics.

Washington State
MHMDA

Washington My Health My Data Act

Washington's health data privacy law with a private right of action. Broader than HIPAA, it covers any entity that handles consumer health data, including websites using advertising pixels on health-related content.

Defense Counsel Network

Received a demand letter? We work with law firms that handle these cases every day.

Lokker works alongside defense counsel on privacy litigation involving website tracking technologies. If you have received a demand letter related to VPPA, CIPA, HIPAA, or another privacy statute, contact us. We will make the right introduction to attorneys who specialize in exactly this kind of case and provide the technical documentation your defense team needs.

Contact Lokker