If you’ve spent any time in photographer Facebook groups lately, you’ve probably seen the posts. Someone shares a scary graphic about cookie banners, fifty people comment “Wait, do I need one?” and nobody walks away with a clear answer.
So let’s talk it through, Florida photographer to Florida photographer. This isn’t legal advice (none of us are lawyers), but it should help you understand what’s going on and what to do about it.
What is a cookie banner?
If your website uses Google Analytics, the Meta Pixel, or similar tools, those tools collect information about your visitors and send it to Google, Meta, or another company. Most of us didn’t set out to become data collectors. A marketing course or ads dashboard said, “Paste this code into your website,” so we did, and then we went on with our day.
A cookie banner is the pop-up asking visitors to accept or decline tracking. The part most people miss is that a banner only helps if it blocks the tracking until someone clicks “accept.” A banner that says “we use cookies” while the pixel fires in the background doesn’t do much for you.
Does Florida law require a cookie banner?
Not directly, at least not for businesses our size. Florida’s privacy law, the Florida Digital Bill of Rights, only applies to companies with more than $1 billion in annual global revenue that also meet criteria like earning half their revenue from online ads. It’s written for Big Tech, not photographers.
So why is everyone worried?
Because of a much older law. Florida’s Security of Communications Act is our state wiretapping law, and attorneys have started using it against websites with tracking tools. The argument is that when a pixel sends what a visitor does on your site to Meta or Google, a third party is “listening in” on a conversation between you and your visitor. Florida requires all parties to consent before a conversation can be legally recorded.
In 2025, a federal court let one of these claims move forward against Orlando Health over pixels on its patient portal. Then in August 2026, a federal court in Tampa let a class action proceed against BayCare Health System, where plaintiffs claim the hospital system used Google Analytics 4 and a Google ad tracker without visitors’ consent. That one matters for us, because Google Analytics is on a huge number of photography websites.
Is this a real risk for photographers?
So far, the biggest targets have been healthcare and larger companies, though recent Florida settlements have reached retail brands like Barefoot Dreams too. We haven’t seen a wave of suits against small portrait businesses. Still, a demand letter is stressful and expensive to deal with even when you’d probably win.
The detail that matters most is what the tracker captures. The BayCare ruling describes Google Analytics 4 collecting page views, clicks, form submissions, video plays, and file downloads. Think about your inquiry form, where couples type their names, wedding dates, venues, and sometimes pretty personal stories. And keep in mind that your website reaches beyond Florida. California’s wiretap law alone saw more than 1,000 lawsuits in 2025.
Your Action List
Today: find out what’s on your site (about 15 minutes)
- Open your website platform’s settings and look for anything labeled integrations, marketing, analytics, tracking, or header code. Write down every tool you find, including plugins.
- Install Google’s Tag Assistant and Meta’s Pixel Helper, both free browser extensions. Visit your homepage, your pricing page, and your contact page with them turned on.
- Look past Google and Meta. Pinterest and TikTok tags, chat widgets, embedded schedulers, CRM contact forms, and embedded videos can all send visitor information to another company.
This week: decide what stays
- For each tool, ask whether you’ve looked at its data in the last six months. If you haven’t, and you’re not running ads that depend on it, consider removing it.
- Look closely at your inquiry form. If tracking is running on that page, talk with your web person about whether it needs to be.
This month: put real consent in place
- If you’re keeping any tracking, add a consent tool that blocks it until a visitor clicks “accept.” Check whether your website platform has one built in before paying for a separate service.
- If you use Google Analytics, look into Google Consent Mode on the “basic” setting, so Google’s tags don’t load until someone consents.
- Test it. Open your site in a private browser window, don’t click the banner, and run Tag Assistant or Pixel Helper again. If tags fire before you’ve accepted, the banner isn’t doing its job yet.
- Update your privacy policy so it matches what your site really does, and name the specific tools you use. If it currently says you don’t collect personal information, fix that first.
Going forward
- Recheck your site once a year, and any time you add a plugin, switch platforms, start running ads, or connect a new booking or CRM tool.
- If you ever receive a demand letter about your website, don’t ignore it and don’t respond on your own. Contact an attorney.
None of this needs to send you into a panic. It’s one more piece of running a real business in 2026, right next to contracts, model releases, and insurance. A little housekeeping now is a lot more comfortable than a surprise letter later.
This post is for general education and isn’t legal advice. Laws and court decisions in this area are changing quickly, so please consult an attorney about your own website and business.
Sources
Florida Statutes, Chapter 934, Security of Communications Act
https://leg.state.fl.us/statutes/index.cfm/ch0800/index.cfm?App_mode=Display_Statute&URL=0900-0999%2F0934%2F0934.html
Florida Statutes, §501.703, Florida Digital Bill of Rights applicability
https://www.leg.state.fl.us/statutes/index.cfm/Sections/index.cfm?App_mode=Display_Statute&Search_String=&URL=0500-0599%2F0501%2FSections%2F0501.703.html
White & Case, “Florida Enacts the Digital Bill of Rights, Joining the Growing Privacy Landscape”
https://www.whitecase.com/insight-alert/florida-enacts-digital-bill-rights-joining-growing-privacy-landscape
Frankfurt Kurnit Klein & Selz, “Is Florida the Next Frontier for Privacy Class Action Lawsuits?”
https://technologylaw.fkks.com/post/102lwjq/is-florida-the-next-frontier-for-privacy-class-action-lawsuits
Fisher Phillips, “Florida Federal Court Permits Another Digital Wiretapping Claim to Proceed”
https://www.fisherphillips.com/en/insights/insights/florida-federal-court-permits-another-digital-wiretapping-claim-to-proceed
Crespi v. BayCare Health System, order on motion to dismiss (August 11, 2026)
https://www.casemine.com/judgement/us/6a7db6b1002176238713a07d
ClassAction.org, Florida Security of Communications Act news
https://www.classaction.org/news/category/florida-security-of-communications-act
Krieg DeVault, “Latest Developments in Meta Pixel Class Action Litigation”
https://www.kriegdevault.com/insights/latest-developments-in-meta-pixel-class-action-litigation-impacting-financial-institutions
Google, Consent Mode overview
https://developers.google.com/tag-platform/security/concepts/consent-mode
