{"id":2368,"date":"2025-08-26T12:54:26","date_gmt":"2025-08-26T16:54:26","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=2368"},"modified":"2025-08-26T13:36:35","modified_gmt":"2025-08-26T17:36:35","slug":"illinois-federal-courts-allow-adtech-and-edtech-ecpa-claims-to-proceed-furthering-split-of-authority","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2025\/08\/26\/illinois-federal-courts-allow-adtech-and-edtech-ecpa-claims-to-proceed-furthering-split-of-authority\/","title":{"rendered":"Illinois Federal Courts Allow Adtech And Edtech ECPA Claims To Proceed, Furthering Split Of Authority"},"content":{"rendered":"
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Tyler Zmick<\/strong><\/p>\n\n\n\n

Duane Morris Takeaways:<\/strong>\u00a0 On August 20, 2025, in Hannant v. Sarah D. Culbertson Memorial Hospital, 2025 WL 2413894 (C.D. Ill. Aug. 20, 2025), Judge Sara Darrow of the U.S. District Court for the Central District of Illinois granted <\/a>a motion to dismiss while allowing a website user to re-plead her claim that the hospital\u2019s use of website advertising technology (\u201cadtech\u201d) violated the Electronic Communications Privacy Act (\u201cECPA\u201d).\u00a0 The same day, in Q.J. v. Powerschool Holdings, LLC, 2025 WL 2410472 (N.D. Ill. Aug. 20, 2025), Judge Jorge Alonso of the U.S. District Court for the Northern District of Illinois denied <\/a>the Chicago school board and its educational technology (\u201cedtech\u201d) provider\u2019s motion to dismiss a claim that their use of a third-party data analytics tool violated the ECPA.\u00a0 These rulings are significant in that they show that in the hundreds of adtech, edtech, and other internet-based technology class actions across the nation seeking millions (or billions) in dollars in statutory damages under the ECPA, Illinois Federal courts have distinguished themselves from other courts in other jurisdictions that have refused to interpret the ECPA in such a plaintiff-friendly manner as have the Illinois Federal courts.\u00a0 <\/em><\/p>\n\n\n\n

Background<\/strong><\/p>\n\n\n\n

These cases are two of a legion of class actions that plaintiffs have filed nationwide alleging that Meta Pixel, Google Analytics, and other similar software embedded in defendants\u2019 websites secretly captured plaintiffs\u2019 web-browsing data and sent it to Meta, Google, and other online advertising agencies and\/or data analytics companies.  In these adtech, edtech, and similar class actions, the key issue is often a claim brought under the ECPA on the theory that hundreds of thousands of website visitors times $10,000 per claimant in statutory damages equals a huge amount of damages.  Plaintiffs have filed the bulk of these types of lawsuits to date against healthcare providers, but they have filed suits against companies that span nearly every industry including education, retailers, and consumer products.  Several of these cases have resulted in multimillion-dollar settlements, several have been dismissed, and the vast majority remain undecided.<\/p>\n\n\n\n

In Hannant<\/em>, the plaintiff brought suit against a hospital.  According to the plaintiff, the hospital installed the Meta Pixel on its website, thereby transmitting to Meta, allegedly without the plaintiff\u2019s consent, data about her visit to the hospital\u2019s website. <\/p>\n\n\n\n

In Q.J.<\/em>, the plaintiff brought suit against the Chicago school board and its edtech provider.  According to the plaintiff, the school board and edtech provider installed a third-party data analytics tools called Heap Autocapture on the edtech provider\u2019s online platform, thereby transmitting to Heap, allegedly without consent, information about the students\u2019 visits to the online platform.<\/p>\n\n\n\n

In both lawsuits, the plaintiffs claimed that these alleged events amounted to an \u201cinterception\u201d by the defendant that violated the ECPA.  Neither defendant contested whether the plaintiff had plausibly alleged an \u201cinterception,\u201d even though the events were more like the catching and forwarding of a different ball, not an interception: (1) as alleged in Hannant<\/em>, see <\/em>No. 24-CV-4164, ECF No. 14 \u00b6\u00b6 49, 363 (alleging that the communication Meta received was not the same transmission but a \u201cduplicate[]\u201d that was \u201cforward[ed]\u201d); and (2) despite the wholly conclusory allegations of a purported \u201cinterception\u201d in Q.J.<\/em>  However, both defendants moved to dismiss the claim under the ECPA on the grounds that, to the extent there was any interception, no liability exists under the ECPA pursuant to its exception where the party does not act \u201cfor the purpose of committing any criminal or tortious act.\u201d 18 U.S.C. 2511(2)(d).<\/p>\n\n\n\n

The Courts\u2019 Decisions<\/strong><\/p>\n\n\n\n

In Hannant<\/em>, the Court dismissed the ECPA claim without prejudice, and granted the plaintiff leave to re-plead in a fashion that may allow such an amended complaint to withstand the ECPA claim.  Specifically, the Court found that an amendment might plausibly allege a criminal or tortious purpose by adding sufficient detail about the plaintiff\u2019s website interactions to show that there had been a violation of the Health Insurance Portability and Accountability Act (\u201cHIPAA\u201d), which provides for criminal and civil penalties against a person \u201cwho knowingly … discloses individually identifiable health information [(\u2018IIHI\u2019)] to another person.\u201d  2025 WL 2413894,<\/em>at *3 (quoting 42 U.S.C. \u00a7 1320d-6).  As the Court explained, under adtech class-action precedent in the U.S. District Court for the Northern District of Illinois, adding additional detail regarding alleged transmission of IIHI could be enough to allege a criminal or tortious purpose.  Id. <\/em>at *3-5.<\/p>\n\n\n\n

In Q.C.<\/em>, the Court denied the school board and edtech provider\u2019s motion to dismiss, citing the same plaintiff-friendly precedent in the Northern District of Illinois cited by the opinion in Hannant<\/em>, and explaining that while the allegedly disclosed data in this educational context did not violate the HIPAA, the plaintiff had plausibly alleged that the transmissions at issue violated the Illinois School Student Records Act (\u201cISSRA\u201d), 105 ILCS 10\/6, and Family Educational Rights and Privacy Act (\u201cFERPA\u201d), 20 U.S.C. \u00a7 1232g.  2025 WL 2410472, at *6.<\/p>\n\n\n\n

Implications For Companies<\/strong><\/p>\n\n\n\n

In Illinois Federal courts, pixels and cookies are no longer just marketing and educational tools \u2013 they are legal risk vectors.  By contrast, other U.S. District Courts ruling on Rule 12(b)(6) motions have found no plausibly alleged interception when an internet-based communication is forwarded as opposed to being intercepted mid-flight, and no plausibly alleged criminal or tortious purpose because the purpose was not to violate any statute but rather to engage in advertising or data analytics.  (See, e.g., <\/em>our prior blog entry discussing one of these several cases, here<\/a>.)Website owners facing lawsuits in Illinois District Courts would do well to press such arguments finding success in other jurisdictions in order to preserve them for appeal in the Seventh Circuit, which has yet to rule on these issues.  In addition, other defenses remain, including demonstrating that plaintiffs cannot meet their burden of proof to show any actual disclosure where transmissions of information entered on the website to adtech vendors and data analytics providers such as Meta or Google are encrypted, ephemeral, anonymized, aggregated, and otherwise unviewable and irretrievable by any human and hence not any actual disclosure to a third party.<\/p>\n\n\n\n

Corporate counsel seeking to deter ECPA litigation should keep in mind the following best practices (discussed in more detail in our prior blog post, here<\/a>): (1) add or update arbitration clauses to deter class actions and mitigate the risks of mass arbitration; (2) update website terms of use, data privacy policies, and vendor agreements; and (3) audit and adjust uses of website advertising technologies.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Justin Donoho, Hayley Ryan, and Tyler Zmick Duane Morris Takeaways:\u00a0 On August 20, 2025, in Hannant v. Sarah D. Culbertson Memorial Hospital, 2025 WL 2413894 (C.D. Ill. Aug. 20, 2025), Judge Sara Darrow of the U.S. District Court for the Central District of Illinois granted a motion to dismiss while … <\/p>\n

Continue reading “Illinois Federal Courts Allow Adtech And Edtech ECPA Claims To Proceed, Furthering Split Of Authority”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[7,122,12,145],"class_list":["post-2368","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":122,"user_id":686,"is_guest":0,"slug":"jrdonoho","display_name":"Justin Donoho","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/02\/donohojustin-1-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":12,"user_id":578,"is_guest":0,"slug":"tzzmick","display_name":"Tyler Z. Zmick","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/zmicktyler-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":145,"user_id":740,"is_guest":0,"slug":"hhryan","display_name":"Hayley Ryan","avatar_url":{"url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/09\/ryanhayley.jpg","url2x":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/09\/ryanhayley.jpg"},"0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2368","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=2368"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2368\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=2368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=2368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=2368"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=2368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}