Wrongful collection occurs when a business improperly gathers or shares personal data not due to a hack or breach, but through normal operations. Common examples include using tracking pixels, chat features, or analytics tools without getting proper consent first. If a website collects data without informing visitors, shares it with third parties without their permission, or uses it for purposes beyond what its privacy policy states, that's wrongful collection.

Many brokers use "wrongful collection" to describe any privacy claim that isn't a data breach, but it's actually more specific. Wrongful collection is about improperly gathering data in the first place. Privacy liability is bigger, as it includes using data for the wrong purposes, sharing it without permission, keeping it too long, or failing to delete it when requested. Each of these actions can trigger a lawsuit on its own, no breach required.

Pixels are invisible bits of code on websites that track what visitors do, like which pages they visit or what they click. The Meta (Facebook) Pixel is the most common, but Google, TikTok, LinkedIn, and other platforms have them too. Marketing teams love pixels because they show if ads are working and help target the right customers. The problem is, these pixels start collecting and sharing data the second someone visits a website, often before they can provide consent. Even worse, they sometimes accidentally capture and share sensitive information. This automatic data sharing is what creates wrongful collection risk.

There are several factors contributing to this increase. New tracking technologies, such as pixels and session recording tools, are becoming more commonplace, and new privacy laws and regulations are constantly emerging. But the biggest driver in the United States is an increasingly active plaintiffs' bar. Class action attorneys are using automated tools to scan websites for violations, then bringing lawsuits under both new and existing laws. With statutory damages that can reach thousands per violation and the potential for massive class actions, even minor violations have become targets for litigation.

Yes. Contrary to popular belief, it's not just large companies being targeted. We've seen wrongful collection claims hit SMBs across all industries, with settlement demands often reaching six figures even for businesses under $100M in revenue. Even small companies without dedicated compliance teams need to be aware of this risk and take proactive steps to protect themselves.

Any business with a website needs to consider this risk, but it's especially critical for those in healthcare, finance, e-commerce, and digital media. While B2C companies are the most common targets for litigation, don't overlook B2B businesses — especially those running digital marketing campaigns.

Three key moments: during any cyber renewal, when a client mentions adding new website features or marketing tools, and when privacy laws change in their state. Also flag this for any client in healthcare, finance, or e-commerce - they face higher exposure and often don't know it.

Start with Coalition's Cyber Risk Assessment, which is included with every policy. It now has a dedicated section on privacy exposures that shows clients exactly what tracking technologies they have installed, when their privacy policy was last updated, and other key privacy risks. This gives clients concrete data about their exposure they likely don't know about. For additional guidance and resources, share Coalition's Privacy Best Practices for Small & Midsize Businesses, which contains practical guidance informed by claims data.