What actually applies: the recording and interception statute
This is the statute that most often reaches a website. Session recording, chat transcripts, form-field capture and analytics that replay a visit have all been argued as interception of a communication.
- Citation
D.C. Code § 23-554- Consent regime
- One-party consent
- Private lawsuits
- Yes. A private party can sue.
- Damages named
- Greater of actual damages, $100 per day of violation, or $1,000, plus punitive damages and fees
- Observed filing volume
- Low
Your state is not the only one that applies
Wiretap exposure follows the visitor, not the practice. A District of Columbia practice whose website is read by someone sitting in an all-party-consent state can be answering to that state's statute, not this one. Twenty states also have a comprehensive consumer privacy law in effect, and those reach your visitors from District of Columbia wherever your servers are.
Start with California, Colorado, Connecticut, Delaware, Florida, Indiana, or see the full list of jurisdictions.
The federal floor
HIPAA applies to a covered entity in every state. Civil money penalties were last adjusted January 28, 2026; the highest tier reaches $2,190,294 per violation with an annual cap of $2,190,294 for the same requirement.
Sources
- Reporters Committee for Freedom of the Press — Reporter's Recording Guide, civil suits: https://www.rcfp.org/reporters-recording-sections/civil-suits/
- DarrowEverett — Tracking Pixel Litigation Expands: A State-by-State Guide to Wiretapping Risk (2026): https://darroweverett.com/pixel-litigation-trends-by-state-compliance-legal-analysis/
- Davis+Gilbert — New State Privacy Laws: Alabama, Louisiana, Oklahoma, and Vermont Join the Party (2026): https://www.dglaw.com/new-state-privacy-laws-alabama-louisiana-oklahoma-and-vermont-join-the-party/
Figures last reviewed July 25, 2026.