Florida's Security of Communications Act and Session Replay: How the 2021 Suits Ended on the Meaning of Contents

Chapter 934 as an All-Party Consent Statute

Florida's wiretap law is chapter 934 of the Florida Statutes, the Security of Communications Act, enacted by chapter 69-17. Its legislative findings in section 934.01 are about wire and oral communications and organized crime. The finding in subsection (4) states that, to safeguard the privacy of innocent persons, "the interception of wire or oral communications when none of the parties to the communication has consented to the interception should be allowed only when authorized by a court." Electronic communications came in later through the definitions.

Section 934.03(1) makes it a crime to intentionally intercept, endeavor to intercept, or procure another person to intercept any wire, oral or electronic communication, and to intentionally disclose or use the contents of a communication knowing or having reason to know they came from an unlawful interception. Under subsection (4)(a), a violation is a felony of the third degree, with lesser grades for certain first offenses involving unscrambled radio transmissions.

The exceptions in subsection (2) determine who may record. Paragraph (c) allows a law enforcement officer, or a person acting at an officer's direction, to intercept a communication to which that person is a party or where one party has consented, but only where "the purpose of such interception is to obtain evidence of a criminal act." For everyone else, paragraph (d) supplies the rule: interception is lawful "when all of the parties to the communication have given prior consent to such interception." A website operator or analytics vendor has no one-party consent exception to rely on.

Three definitions in section 934.02 do most of the work in website cases. To intercept is "the aural or other acquisition of the contents of any wire, electronic, or oral communication through the use of any electronic, mechanical, or other device." Contents "includes any information concerning the substance, purport, or meaning of that communication." An electronic communication is any transfer of "signs, signals, writing, images, sounds, data, or intelligence of any nature" by wire, radio or similar system, but it excludes four things, among them "[a]ny communication from an electronic or mechanical device which permits the tracking of the movement of a person or an object."

The Civil Remedy in § 934.10

Section 934.10(1) gives "[a]ny person whose wire, oral, or electronic communication is intercepted, disclosed, or used in violation of ss. 934.03-934.09" a civil cause of action against "any person or entity who intercepts, discloses, or uses, or procures any other person or entity to intercept, disclose, or use, such communications." The procurement language is how a retailer that installs a vendor's script and the vendor that receives the data can both be named. The available relief is:

• Preliminary, equitable or declaratory relief
• Actual damages, "but not less than liquidated damages computed at the rate of $100 a day for each day of violation or $1,000, whichever is higher"
• Punitive damages
• A reasonable attorney's fee and other litigation costs reasonably incurred

Subsection (2) makes good-faith reliance a complete defense to any civil, criminal or administrative action, in three forms: reliance on a court order, subpoena or legislative authorization; on a request of a law enforcement officer under section 934.09(7); or on "[a] good faith determination that Florida or federal law, other than 18 U.S.C. s. 2511(2)(d), permitted the conduct complained of." The carve-out names the provision of the federal Wiretap Act that allows a party to a communication, or a person with one party's consent, to intercept it. A belief that the federal one-party rule permitted the conduct is therefore excluded from the good-faith defense. Subsection (3) requires a civil action to be commenced no later than two years after "the date upon which the claimant first has a reasonable opportunity to discover the violation."

Contents of a Communication

The most complete Florida federal analysis of session replay under the Act is Goldstein v. Costco Wholesale Corp., No. 21-cv-80601 (S.D. Fla. Sept. 9, 2021), by Judge Rodolfo A. Ruiz II. The complaint alleged that session replay software on Costco's website captured "mouse movements and clicks, keystrokes, search terms, information inputted into the website, and pages and content viewed." The court described the case as one of "a flurry of virtually identical cases" brought under the Act.

The order started from the definition of contents. In a footnote it observed that the Act was modeled on the federal Electronic Communications Privacy Act and that Florida courts follow federal decisions on analogous provisions, citing Minotty v. Baudo (Fla. 4th DCA 2010). Federal courts distinguish "record information" about a communication from its substance, purport or meaning. Measured against that line, the court held that tracking a user's movements on a website was "the cyber analog to record information Defendant could have obtained through a security camera at a brick-and-mortar store." It treated the statutory exclusion for tracking devices as reinforcing the point, finding that "the plain language of the statute exempts the sort of tracking that triggered this action" even though the tracking was virtual.

Two further allegations failed the same test. Pages and content viewed were compared to addresses rather than contents, relying on the Ninth Circuit's decision in In re Zynga Privacy Litigation. The plaintiff's framing of clicks as "commands" sent to Costco's servers was treated as the equivalent of "dialing, routing, addressing, or signaling information." The court also rejected the argument that what was intercepted could not be evaluated on a motion to dismiss, stating that content "must be plausibly alleged." Its conclusion was compressed into one sentence: "No substance means no contents, no contents means no interception, and no interception means no FSCA violation." Because the failure to plead contents made amendment futile, the dismissal was with prejudice. The order noted that Costco's motion also raised consent and pleading grounds and declined to reach them.

Session Replay Decisions in the Florida Federal Courts

Goldstein v. Costco collected the decisions that preceded it. It cited Swiggum v. EAN Services (M.D. Fla. July 16, 2021), Cardoso v. Whirlpool (S.D. Fla. July 6, 2021) and Connor v. Whirlpool (S.D. Fla. July 6, 2021) as adopting a June 17, 2021 order of the Florida Eleventh Judicial Circuit court in Jacome v. Spirit Airlines, which held that "the FSCA does not apply to the plaintiff's claims regarding session replay technology software on a commercial website." The same judge had earlier stayed discovery in Goldstein and, on July 8, 2021, in Leace v. General Motors, describing "a dearth of case law on these novel issues" while noting that nearly identical suits had been dismissed.

A magistrate judge reached the same result by a broader route in Goldstein v. Luxottica of America, No. 21-80546 (S.D. Fla.), a claim over the Ray-Ban website. The report and recommendation, signed August 20, 2021 and entered August 23, recommended dismissal with prejudice on the ground that the information captured was, as a matter of law, not contents, not an electronic communication and not an interception. It summarized the Jacome order as also holding that no device had been pleaded, that the software fell within the tracking exclusion, that no contemporaneous interception was pleaded, that no expectation of privacy was pleaded, and that the plaintiff consented. The report also recorded the one contrary state ruling it had been shown: in Swiggum v. Beall's, a Florida Twelfth Judicial Circuit court denied dismissal in a brief oral ruling that keystrokes, entry of information and mouse movements could be electronic communications. The magistrate judge declined to follow it because it did not analyze the statutory text.

Not every 2021 ruling reached the statute. In Fridman v. 1-800 Contacts, No. 21-cv-21700 (S.D. Fla. Aug. 12, 2021), the plaintiff alleged that Quantum Metric's session replay tool captured keystrokes and clicks as he placed an order for prescription contact lenses. Judge Beth Bloom denied the retailer's motion to compel individual arbitration, finding that the website's hyperlink to its terms was not placed where it would put a reasonably prudent user on notice. The order decided only the arbitration question.

None of the decisions retrieved for this article is from a Florida appellate court or the Eleventh Circuit. The state circuit court orders in Jacome and Swiggum v. Beall's were not retrieved, and are described here only as the federal orders quoted and summarized them.

Where Consent Enters

Consent sits in the Act twice: as the all-party exception in section 934.03(2)(d), and indirectly in the good-faith defense, which excludes reliance on the federal one-party rule. In the 2021 decisions it was argued but rarely decided. Goldstein v. Costco named consent among the grounds it did not reach. The Luxottica report did not reach it either, though its summary of Jacome lists consent among that order's holdings.

Fridman shows a related question arising under another doctrine. Whether a website visitor agreed to terms posted behind a link, which a consent defense may depend on, was decided there under contract formation law, and the court found no notice. That order says nothing about whether a privacy disclosure would amount to prior consent under section 934.03(2)(d).

How Florida Compares With the Pennsylvania Line

Florida's statute and Pennsylvania's Wiretapping and Electronic Surveillance Control Act share their skeleton. Both require all parties' consent for private interceptions, both define contents as information about the "substance, purport, or meaning" of a communication, and both set liquidated damages at $100 a day or $1,000, whichever is higher. In Pennsylvania, the Third Circuit's decision in Popa v. Harriet Carter Gifts (2022) addressed where an interception occurs and rejected a broad direct-party exception, and Cook v. GameStop (3d Cir. 2025) ended a session replay claim for lack of Article III standing. The Florida session replay decisions of 2021 turned on an earlier element: whether anything that counts as contents was acquired at all.

Courts outside Florida have since applied the Act to other kinds of tracking. In Katz-Lacabe v. Oracle America, No. 22-cv-04792 (N.D. Cal. Oct. 3, 2023), a putative FSCA subclass challenged a tracking script used to build consumer profiles. The court noted that the cases Oracle cited on the tracking exclusion "relate primarily to the use of session replay software," held that data entered into forms and referrer URLs can be electronic communications under the Act's broad definition, and allowed the FSCA claim to proceed. By contrast, in A.S. v. SelectQuote Insurance Services, No. 23-cv-02258 (S.D. Cal. Aug. 19, 2024), a court dismissed an FSCA claim over software on a life insurance quote form with leave to amend, finding the interception allegations conclusory and citing the Florida session replay decisions as involving software "similar in kind" to what was alleged.

Read together, the retrieved decisions describe a split by technology rather than by court. Recordings of navigation, clicks and page views were treated in Florida's federal courts as falling outside the statute's definitions, while form entries and URLs collected for profiling were treated in one California court as electronic communications whose contents could be intercepted.

Frequently Asked Questions