Wrongful Data Collection Driving Cyber Claim Frequency

A growing source of cyber insurance claims is wrongful data collection. Even though the cost of these claims individually is generally low, their rising frequency should be of concern to underwriters and policyholders. California has now narrowed one of the legal theories behind these claims, but the exposure is far from over.

Wrongful data collection claims typically result in settlements between $10,000 and $30,000, far below the multimillion-dollar losses common in ransomware claims. In its Midyear Cyber Risk Report, Resilience found ransomware and extortion claims accounted for nearly 75% of cyber claim costs in the first half of 2026, making them high on the severity scale. Wrongful data collection lawsuits, on the other hand, were the third-largest source of cyber losses, at less than 4%, behind transfer fraud, which accounted for about 9%.

Ransomware and wrongful data collection claims also differ in their frequency. Lawsuits alleging wrongful data collection appeared in 16.7% of all Resilience cyber claims in the first half of 2026, up from 7.3% a year earlier.

Why the Claims Have Been Growing

What is causing the increase? Wrongful data collection lawsuits are becoming more frequent due to two overarching trends:

• Proliferation of website visitor tracking and data sharing with third parties. Virtually every website collects information on visitors, and consumer businesses want to know their customers’ buying habits. This isn’t necessarily nefarious, but the widespread collection of data creates opportunity for plaintiffs.
• State and federal laws governing data privacy. Plaintiffs are filing lawsuits under the California Invasion of Privacy Act (CIPA), the federal Wiretap Act, and the California Comprehensive Computer Data Access and Fraud Act. Many recent cases rely on two parts of CIPA: Section 638.51, which targets “pen register” and “trap and trace” devices, and Section 631, which addresses wiretapping.

The legal theory is essentially the same in all wrongful data collection claims: company websites are tracking people and sharing that data without their consent, in violation of one or more laws. In practice, plaintiffs are following two different approaches.

One is from pro se plaintiffs, who represent themselves, typically under CIPA. These are high-volume, low-severity cases that may be resolved within a client’s self-insured retention. A second type of wrongful data collection claim is more intricate, brought by law firms. These range from demand letters to outright lawsuits, often under California laws, the federal Wiretap Act and other laws.

Large corporations and organizations with experienced in-house counsel typically are aware of data collection requirements and how to mitigate complaints. Smaller businesses are preferred targets for high-volume claims. Serial filers know it’s inexpensive to send demand letters or complaints and seek quick settlements. Most plaintiffs do not have an appetite or budget for protracted litigation, and many defendants view these claims as a cost of doing business.

California’s response is likely to change that calculus. On Sept. 30, Gov. Gavin Newsom signed SB 690, which ends the private right of action for claims under CIPA’s pen register and trap-and-trace provision (Section 638.51) when the conduct occurs on a website, online application or mobile application. Plaintiffs had argued that cookies, pixels and analytics tools fall under that section, and its $5,000 per-violation statutory damages made demand letters and complaints attractive to serial filers. For that conduct, only the California attorney general may now bring those claims. The law takes effect Jan. 1, 2027, and applies to pending claims in actions commenced on or after Jan. 1, 2025. Pre-suit demand letters that never became lawsuits may fall outside that reach, and plaintiffs are expected to challenge retroactive application.

SB 690 does not end the exposure. It leaves private claims under CIPA’s wiretapping provisions and the federal Wiretap Act untouched, and plaintiffs have already begun shifting to those theories. Frequency of Section 638.51 claims, particularly the high-volume pro se filings, may fall, but claims under the remaining laws could continue and may be more costly to defend.

The high frequency of wrongful data collection claims could create large aggregate losses for cyber insurers, if retentions remain low or the costs of defending, including discovery, increase. At the moment, the aggregate loss line for such claims is flat. Whether SB 690 reduces frequency or simply redirects claims will become clearer in 2027.

Coverage Questions

Coverage of wrongful data collection claims in cyber insurance is not uniform. Under some policies, the claims trigger coverage, while others don’t. Some policies exclude wrongful data collection. The industry does not have a singular approach to these kinds of claims. SB 690 may prompt some insurers to revisit their wording, and retroactivity could affect how pending claims are reserved.

Cyber underwriters should inquire about data collection practices to ensure a policyholder is not violating the law. Questions to ask include:

• What data are you collecting?
• Which tracking tools (pixels, analytics, session replay, chat) are on your website, and are they configured to honor visitor consent?
• How long are you holding that data?
• Do you inform your customers that you’re collecting their data?
• Is the data collection obvious?
• Is your organization sharing that data with anyone else?

Collecting data on website visitors is not by itself the problem. The laws’ intent is to protect privacy by requiring notification and consent of those whose data is collected and shared. Insurance exists to offer protection when a policyholder does everything right, but a loss still happens. The cyber insurance industry will have to sort out the question of whether data collection is an insurable business activity or should be excluded.

Mitigation Tips

Organizations can mitigate the risk of wrongful data collection lawsuits by taking several actions. These include:

• Improve risk governance. Organizations should ensure compliance with all applicable laws. This generally includes informing site visitors if tracking tools are collecting and sharing their data, and recording users’ consent. SB 690 is not a reason to scale back consent practices, because the wiretapping theories that remain turn on notice and consent.
• Communicate data collection internally. Tracking site visitors and monitoring their online behaviors is typically done for valid business reasons, such as to improve the marketing of products or services. The marketing team, however, might fail to discuss the use of data collection tools with the general counsel or chief financial officer. Internal departments need to talk to each other, so all teams remain aware of legal requirements.
• Manage third-party risks. Organizations that use vendors to gather data on their behalf will be responsible at the outset even if a vendor wrongfully collected the data. Contractual risk transfer, with indemnity and hold-harmless agreements, can mitigate third-party risks. Recourse also can occur through subrogation.

Liability exposure arising from wrongful data collection can be reduced with appropriate protocols and well-constructed cyber risk management programs. Organizations should work with their legal and risk advisors and cyber insurance partners to maximize the benefits of data collection while minimizing the risks.

Gittler is the global head of claims at Resilience, a cyber insurance and risk management company.