A California federal court recently allowed a Federal Wiretap Act case to proceed against Six Flags Entertainment Corporation, opening a potential avenue for a nationwide class action against the theme park. The court’s December 15, 2025 decision to greenlight the case could provide plaintiffs’ attorneys with a roadmap for filing such lawsuits, greatly expanding the threat of privacy litigation for businesses nationwide. While many similar privacy claims have been successful under state laws, the Federal Wiretap Act applies to businesses and users across the nation. With the threat of a potential nationwide class action now on the table, here is what you need to know to protect yourself from one of these privacy claims.
The Case at a Glance
The plaintiff claimed she visited a website owned and operated by Six Flags that allowed her to choose to browse without being tracked, followed, or targeted by third-party data brokers and advertisers. But, even after users elected to “deny non-essential” cookies, she claims Six Flags permitted third-party cookies to be placed on users’ devices, which then tracked users’ website browsing activities and eavesdropped on users’ private communications with the website, according to the lawsuit. Specifically, the plaintiff alleges that third-party cookies intercepted personal information such as “search queries,” “products searched for,” “user interests,” and “browsing habits.”
The court ruled that the allegations were sufficient to state claims alleging violations of the Federal Wiretap Act and the California Invasion of Privacy Act (CIPA) as well as common law claims for intrusion of seclusion, invasion of privacy, and unjust enrichment. In addition to privacy claims, the court ruled that the plaintiff had sufficiently pleaded fraud arising from the ineffective opt-out.
What You Can Do Next
1. Review What Data Your Website is Collecting: Some of the key allegations in the Six Flags suit involved tracking technologies intercepting search terms. If your website has a search bar function, be sure to audit whether the queries entered are being disclosed to third parties. More broadly, be sure to review all website tracking technologies in use, including cookies, pixels, chatbots, and similar tools, to understand all data they may be collecting – not just data from search bars.
2. Ensure Your Consent Management Platform Works as Advertised: Six Flags allegedly prompted users with the option to reject all “non-essential” cookies, despite not actually implementing the user’s preferences. Consider hiring an independent third party engaged through outside counsel (for attorney-client privilege purposes) to regularly test your cookie consent process – you can’t rely on your website operator or consent management platform alone.
3. Understand the Import of Your Tracking Technologies. Your business’s strategy on website tracking technologies is going to be led by the need for such technologies and your risk tolerance. Decisions to turn off such technologies altogether, sanitize data, or disclose data with appropriate permissions should be driven by considerations unique for your business.
4. Utilize Tools to Minimize the Ability of Litigants to Identify Visitors Based on The Data Collected. For example, URL sanitation technology removes potential identifiers like user IDs or website activity (via redirects) that may be included in a URL, before storing or transmitting URL data to third parties.
