Wiretap claims arising from cross-border transfers of website user data

On June 16, 2026, the US District Court for the Northern District of Illinois denied a motion to dismiss a putative class action complaint alleging violations of the federal Wiretap Act, where the plaintiff’s claim was premised on an alleged violation of the US Department of Justice’s (DOJ) Bulk Data Rule (Rule). We have previously written on the proliferation of wiretapping claims and how companies can better defend themselves, but this development is particularly noteworthy.¹

In a first-of-its-kind decision, the court in Baker v. Index Exchange, Inc., Case No. 1:25‑cv‑10517, 2026 WL 1734901 (N.D. Ill. June 16, 2026), accepted the plaintiff’s theory that a violation of the Rule can satisfy the federal Wiretap Act’s crime/tort exception to the one-party consent rule. Accordingly, the defendant’s purported use of tracking software on a website to intercept user data and share it with a foreign advertiser could give rise to a private cause of action and, with it, statutory damages on behalf of a class. This decision is likely to embolden the privacy class action plaintiffs’ bar, which is already active in pursuing state-level claims arising from website data-sharing practices.

Bulk Data Rule

Executive Order 14117 (February 2024), issued under the International Emergency Economic Powers Act, directed the DOJ to issue regulations preventing “countries of concern” from accessing Americans’ sensitive personal data. On April 8, 2025, the DOJ issued the final Bulk Data Rule.² Under the Rule, US persons are prohibited from knowingly engaging in covered data transactions that give “countries of concern”³ or “covered persons” tied to those countries access to bulk US sensitive personal data or US government-related data. Data brokerage transactions with covered persons/countries of concern are flatly prohibited. Vendor, employment, and investment agreements are permitted only if certain cybersecurity and compliance requirements are met. 

Notably, the Rule carries criminal and civil penalties for violations but does not provide for a private cause of action.

Federal Wiretap Act

The federal Wiretap Act makes it unlawful to intentionally intercept “any wire, oral, or electronic communication.”⁴ Importantly, the Wiretap Act contains a one-party consent exemption: An interception is not unlawful if one party consents to the disclosure. This exemption has been an effective defense for websites sharing user data derived from communications between a user and the website itself under the theory that the website provides the one-party consent.

Under the crime/tort exception to this exemption, however, the one-party consent rule does not apply. If a communication is intercepted “for the purpose of committing any criminal or tortious act,” the one-party consent is not a defense. If the crime/tort exception applies, then both parties to the communication must consent to the interception. Some courts have found that the crime/tort exception can apply when an entity allegedly violates the Health Insurance Portability and Accountability Act or commits a common law tort. Other courts have found that the crime/tort exception does not extend to violations of other statutes, such as certain provisions of the Gramm-Leach-Bliley Act, where the alleged violation does not carry criminal penalties and does not have a private right of action. 

The Wiretap Act provides for statutory damages of up to $100 for each day of a violation or $10,000, whichever is greater.⁵ Such statutory damages could quickly multiply and expose companies to liabilities amounting to hundreds of millions of dollars or more in the context of a nationwide class action.

Baker v. Index Exchange, Inc.

In Baker, the plaintiff alleges that a website used the defendant’s tracking software to intercept user data and transmit it to advertising partners, including a US subsidiary of a Chinese e-commerce company. The tracking software allegedly collects information such as users’ IP address, cookie and advertising identifiers, device data, and inferred demographic and behavioral data. The plaintiff, on behalf of a proposed class, alleges that advertisers then use the data through a real-time bidding platform to bid on the right to place ads for the website user. Advertisers also used the data through a process called “cookie syncing,” allowing the advertisers to track users across multiple websites and tailor ads targeting the user. The plaintiff alleges that the tracking software constituted an illegal wiretap in violation of the federal Wiretap Act.

The defendant moved to dismiss, arguing that the website, as a party to the allegedly intercepted communications, consented thereto, so the one-party consent exemption precluded the claim.

In denying the motion to dismiss, the Northern District of Illinois held that the plaintiff plausibly alleged that the crime/tort exception applied. The court reasoned that the alleged transfer to a Chinese company constituted a violation of the Rule, which in turn constitutes a tortious act within the meaning of the exception. 

Takeaway

The Baker decision supports a litigation theory that plaintiffs across the country are likely to replicate. It gives plaintiffs a potentially actionable theory to sue website operators and ad-tech providers for the use of common tracking software where user data is purportedly shared with companies in China or other countries of concern. Without sufficient controls, website operators and ad-tech companies may risk significant exposure under this theory.

In light of this decision, businesses may consider assessing whether their website user data collection procedures are compliant with the Rule. This could include assessing whether direct or indirect recipients of their user data are organized in, or majority-owned by, a country of concern and auditing data brokers and other data vendor relationships to ensure downstream compliance. More broadly, the Rule’s obligations are not limited to ad-tech or wiretap-adjacent conduct; any US company with cross-border data sharing arrangements (e.g., vendor agreements, cloud storage, offshoring, joint ventures) may be subject to the Rule’s prohibitions and restrictions.

Many businesses are finding out the hard way that pixels and other tracking technologies are getting through their consent management platforms, leading to wiretapping claims under similar state-level statutes, such as those in California, Florida, Michigan, and Pennsylvania. Proactive steps to mitigate this risk could include:

• robust consent and disclosure practices, such as a cookie banner that requires consumers to accept or reject cookies before the website initiates tracking software
• disclosures for website features such as search bars or chats powered by third parties 
• website privacy notices containing up-to-date, plain-language descriptions of any tracking methods, including any tracking technology deployed by third parties
• auditing consent management on a technical level to ensure it is functioning as anticipated 

__________

If you have any questions about this Legal Briefing, please feel free to contact any of the attorneys listed or the Eversheds Sutherland attorney with whom you regularly work.

_{1 See, e.g., Wiretapping litigation shows no signs of slowing in California and Florida (Feb. 2, 2026); Eight-figure CIPA settlement underscores importance of telemarketing compliance (June 2, 2025).
2 28 C.F.R. Part 202.
3 As of July 20, 2026, China, Russia, Iran, North Korea, Cuba, and Venezuela have been designated as countries of concern.
4 18 U.S.C. §§ 2510–22.
5 17 U.S.C. § 2520(c)(2).}