What actually applies: the recording and interception statute
This is the statute that most often reaches a website. Session recording, chat transcripts, form-field capture and analytics that replay a visit have all been argued as interception of a communication.
- Citation
18 Pa.C.S. § 5725- Consent regime
- All-party consent
- Private lawsuits
- Yes. A private party can sue.
- Damages named
- Greater of actual damages, $100 a day, or $1,000, plus punitive damages and fees
- Observed filing volume
- High
Pennsylvania is second only to California in tracking-pixel filings, and its all-party rule is the reason.
Your state is not the only one that applies
Wiretap exposure follows the visitor, not the practice. A Pennsylvania practice whose website is read by someone sitting in an all-party-consent state can be answering to that state's statute, not this one. Twenty states also have a comprehensive consumer privacy law in effect, and those reach your visitors from Pennsylvania wherever your servers are.
Start with California, Colorado, Connecticut, Delaware, Florida, Indiana, or see the full list of jurisdictions.
The federal floor
HIPAA applies to a covered entity in every state. Civil money penalties were last adjusted January 28, 2026; the highest tier reaches $2,190,294 per violation with an annual cap of $2,190,294 for the same requirement.
Neighbouring states
Delaware · Maryland · New Jersey · New York · Ohio · West Virginia
Sources
- Reporters Committee for Freedom of the Press — Reporter's Recording Guide, civil suits: https://www.rcfp.org/reporters-recording-sections/civil-suits/
- DarrowEverett — Tracking Pixel Litigation Expands: A State-by-State Guide to Wiretapping Risk (2026): https://darroweverett.com/pixel-litigation-trends-by-state-compliance-legal-analysis/
- Davis+Gilbert — New State Privacy Laws: Alabama, Louisiana, Oklahoma, and Vermont Join the Party (2026): https://www.dglaw.com/new-state-privacy-laws-alabama-louisiana-oklahoma-and-vermont-join-the-party/
Figures last reviewed July 25, 2026.