What actually applies: the recording and interception statute
This is the statute that most often reaches a website. Session recording, chat transcripts, form-field capture and analytics that replay a visit have all been argued as interception of a communication.
- Citation
Mich. Comp. Laws § 750.539h- Consent regime
- One-party consent
- Private lawsuits
- Yes. A private party can sue.
- Damages named
- Injunctive relief, actual and punitive damages
- Observed filing volume
- Moderate
Written as all-party, but Michigan courts have recognized a participant exception since Sullivan v. Gray (1982), reaffirmed federally in 2026 — so it operates as one-party.
Your state is not the only one that applies
Wiretap exposure follows the visitor, not the practice. A Michigan practice whose website is read by someone sitting in an all-party-consent state can be answering to that state's statute, not this one. Twenty states also have a comprehensive consumer privacy law in effect, and those reach your visitors from Michigan wherever your servers are.
Start with California, Colorado, Connecticut, Delaware, Florida, Indiana, or see the full list of jurisdictions.
The federal floor
HIPAA applies to a covered entity in every state. Civil money penalties were last adjusted January 28, 2026; the highest tier reaches $2,190,294 per violation with an annual cap of $2,190,294 for the same requirement.
Sources
- Reporters Committee for Freedom of the Press — Reporter's Recording Guide, civil suits: https://www.rcfp.org/reporters-recording-sections/civil-suits/
- DarrowEverett — Tracking Pixel Litigation Expands: A State-by-State Guide to Wiretapping Risk (2026): https://darroweverett.com/pixel-litigation-trends-by-state-compliance-legal-analysis/
- Davis+Gilbert — New State Privacy Laws: Alabama, Louisiana, Oklahoma, and Vermont Join the Party (2026): https://www.dglaw.com/new-state-privacy-laws-alabama-louisiana-oklahoma-and-vermont-join-the-party/
Figures last reviewed July 25, 2026.