Not every privacy claim starts with a demand letter. In Florida, many start with a summons. The example below is a complaint filed in Broward County court in July 2026 against a Minnesota company that sells online. There was no letter first. The first thing the business received was a notice to appear at a pretrial conference.
We've redacted the parties, the website, and the plaintiff's lawyers. What's left shows how little a plaintiff needs to file one of these cases, and how little the business would have needed to prevent it.
What the complaint looks like
Page one of the complaint: a Florida resident sues a Minnesota corporation under the Florida Security of Communications Act.
The filing is a 20-page template with three counts:
- Unauthorized use of a pen register or trap and trace device, under Fla. Stat. § 934.31↗, which says no person may install or use one without a court order.
- Unauthorized interception of electronic communications, under § 934.03, which requires the prior consent of all parties.
- Invasion of privacy, a common law tort.
The complaint pleads damages between $500 and $2,500, which puts it in county court. That number is deliberate. It's small enough that hiring defense counsel costs more than settling, and the case can be copied across hundreds of defendants.
The theory: your marketing tags are surveillance devices
Most of the complaint explains why ordinary website scripts count as "pen registers" or "trap and trace devices." The argument runs like this. Florida adopted the federal Patriot Act's definitions in 2002, those definitions cover any "device or process" that captures routing, addressing, or signaling information, and an IP address is routing information. So a third-party script that captures a visitor's IP address and passes it to an ad platform is a trap and trace process. The complaint calls them "spyware."
The complaint expressly says it is not about session replay. It's about the ordinary third-party scripts nearly every ecommerce site runs.
The tags it names
The pre-suit analysis (screenshot redacted) and the start of the tag list.
According to the complaint, a pre-suit expert analysis found these scripts running on the site with no consent request:
- Facebook Connect and Facebook Custom Audience
- Google Analytics 4, Google Global Site Tag, and Google Global Site Destination Tag
- Klaviyo
- Shopify Analytics
- Stamped
That's a standard Shopify marketing stack: email, reviews, analytics, and two ad platforms. Nothing exotic. If your store runs these apps, your site would show the same list.
The allegation that matters most
The complaint makes a point that is unusually blunt for a legal filing. It says the defendant "failed and refused to deploy even a free consent banner," and that to comply with Florida law, all the defendant had to do was place a consent banner on the site and obtain consent before installing the scripts.
That's the plaintiff's framing, and Florida courts are still working out how the FSCA applies to websites. But it shows where these cases aim. The complaint doesn't argue about whether a banner was good enough. It points out that there wasn't one.
What the plaintiff asks for
The prayer for relief.
The relief tracks the FSCA's civil remedy in Fla. Stat. § 934.10↗: the greater of $100 a day for each day of violation or $1,000, plus punitive damages and attorney's fees and costs. The complaint counts the days from when the scripts were first installed through final judgment, and reserves the right to add claims if discovery turns up more violations.
The notice attached to the complaint is just as important as the complaint. It orders the defendant to appear at a pretrial conference, in person or through an attorney, "to avoid a default judgment." A business that sets the envelope aside can lose by not showing up.
What the business was missing
A consent banner. The defendant had no consent mechanism at all, according to the complaint. Under § 934.03's prior-consent language, there was nothing to point to.
Script control. Even with a banner, the scripts in the list would need to wait for consent before loading. Shopify apps and theme snippets often load on every page by default.
Awareness that Florida law applies. The defendant is a Minnesota corporation. The complaint establishes jurisdiction by pointing to sales and shipments into Florida. If you sell to Florida customers, Florida's wiretap statute reaches your site.
See what your site fires for a Florida visitor
The free FSCA scan records every tracker that loads on your site before consent, the same list a pre-suit analysis would produce.
Scan my site for FSCA exposure →How PieEye closes the gap
A banner that asks first. PieEye's consent management puts a consent request in front of every visitor and records the answer, which is the step this complaint says was missing.
Scripts that wait. PieEye's Trap and Trace Shield holds third-party scripts, including pixels and app tags like the ones listed above, until the visitor consents.
Your exposure in a minute. The free FSCA scan shows which trackers fire before consent so you can see your site the way a plaintiff's analyst does.
If one of these lands on your desk
Calendar the pretrial conference date before anything else. Then read our FSCA demand letter guide, check what your site actually fires, fix it so exposure stops growing, and bring both to Florida defense counsel. For background on how these cases spread, see Florida's FSCA website tracking lawsuits.
This post is for general information and is not legal advice. Talk to Florida counsel about any complaint you receive.