Cookie and Tracking Litigation Emerges as a Major Cyber Loss Driver for SMBs

Privacy class actions tied to routine website tracking have surged nearly tenfold since 2022, with small and midsize businesses bearing a disproportionate share of exposure, according to KYND.
By: | April 3, 2026
website tracking

Website-tracking and digital wiretapping cases in the U.S. have grown from 228 in the 2022-2023 period to more than 2,163 in the most recent year, according to a report from cyber risk analytics firm KYND.

The litigation is no longer concentrated on large technology firms. Coalition’s 2025 State of Web Privacy Report found that 59% of all web privacy claims were filed against companies with annual revenue of less than $100 million, indicating the exposure has shifted squarely into the SMB segment, KYND said.

KYND analyzed nearly 10,000 North American organizations and found that 17.7% exhibited zero-consent tracking on their websites — meaning tracking technologies were present without any observable privacy mitigation. Among SMBs with less than $1 billion in revenue, that figure rose to 20.2%. The most exposed sectors were Administrative and Support Services at 31.5%, Educational Services at 31.4%, and Health Care and Social Assistance at 30.4%.

A Scalable Litigation Model Built on Routine Website Behavior

Unlike ransomware or data breach claims, cookie and tracking litigation does not require an adversarial cyber event, according to KYND. Claims are instead driven by routine website configurations: cookies, tracking pixels, analytics integrations, and session-replay software deployed by default and rarely scrutinized from a legal perspective.

Plaintiffs increasingly rely on statutes such as the California Invasion of Privacy Act, a 1960s wiretapping law now applied to modern tracking technologies. Nearly 75% of web privacy lawsuits cited CIPA, according to Coalition’s 2025 report. These statutes allow statutory damages without proof of financial harm, enabling claims to scale rapidly across large user populations.

A pivotal November 2025 federal ruling in Camplisson vs. Adidas America held that certain third-party tracking pixels could qualify as “pen registers” under CIPA if they collect personally identifiable information without prior consent, the report said. Legal commentary from Baker Donelson and Fisher Phillips predicted the ruling would increase demand letters and filings against non-enterprise organizations lacking robust prior-consent controls.

The resulting litigation model is industrialized, according to KYND. Plaintiff firms use scanning tools to identify common tracking technologies, assess consent mechanisms, and issue standardized demand letters across large populations of similar organizations, the report noted. Well over 90% of these civil cases settle without trial, KYND noted.

Why SMBs Face Disproportionate Risk

Several dynamics make smaller organizations attractive targets for privacy claimants, according to the report. Extracting modest settlements across many smaller defendants can be more reliable than pursuing prolonged litigation against a single large enterprise. Defense cost asymmetry also plays a critical role — SMB cases are more likely to resolve quickly due to cost pressure and uncertainty around statutory exposure.

Technical defaults compound the problem. SMBs frequently rely on out-of-the-box implementations of tools such as Google Analytics, session-replay software, or live-chat widgets, according to the report. Without dedicated technical resources, consent logic is often misconfigured, allowing trackers to fire before consent is obtained or to continue operating after opt-out — precisely the behaviors alleged in claims.

Marketing teams legitimately adopt pixel-based tracking tools to measure website performance, the report said, but these services are often implemented by non-technical stakeholders who may not understand the breadth of data being collected or shared with third parties.

Allianz reported in 2024 that data and privacy-related elements accounted for two-thirds of large cyber claims, with both frequency and severity increasing, the KYND report noted.

Implications for Risk Management and Underwriting

For risk managers, the exposure is significant because it stems from normal digital operations rather than security failures. Any organization with a public-facing website and common marketing tools may carry latent privacy risk that does not surface through traditional disclosures or questionnaires, KYND said.

The absence of a single, unified U.S. privacy law compounds the challenge. Organizations must navigate a patchwork of state-level privacy and wiretapping statutes, each with its own requirements. Achieving consistent compliance across dozens of jurisdictions is inherently difficult, and gaps can emerge as a result, the report said.

Obtain the full report here. &

The R&I Editorial Team can be reached at [email protected].

More from Risk & Insurance