Where the claims come from
Many privacy suits against businesses apply older statutes to newer technology: state wiretap laws used against session replay and chat tools, video privacy laws used against pixels on websites with video content, and biometric privacy laws, most prominently Illinois's, used against face and fingerprint scanning. Telemarketing and text message rules generate their own litigation. Regulators, including the Federal Trade Commission and state attorneys general, may investigate data practices or the accuracy of privacy promises. The same conduct can lead to individual arbitrations, class actions, and agency inquiries at once. Plaintiffs' firms frequently send similar demands to many businesses at a time, built on scans of public websites.
Defenses that often matter
Consent is central in many cases, so records showing what users saw, what they agreed to, and when are valuable. Standing can be contested in federal court, since plaintiffs must show a concrete injury rather than a bare statutory violation. Arbitration agreements and class waivers may move disputes out of court, though they can also invite mass arbitration filings that carry significant fees. Statutory definitions matter as well, such as whether a vendor counts as a third party, whether data counts as content or biometric information, and whether the business is covered at all. Preserve the website and app code as it existed, vendor contracts, past versions of privacy policies, and consent logs.
Responding before it grows
Early decisions include whether to change the challenged practice, how to communicate with users and regulators, and whether to notify insurers. Changing a practice is generally not treated as an admission of liability, but how the change is made and documented still matters. We review the claim, the technology involved, and the agreements users accepted, then assess where the defenses are strongest and what the exposure could look like across many similar claims. For companies not yet sued, a review of tracking tools and consent flows can reduce risk before demands arrive.
