The claim against Parkwood Entertainment was straightforward. Mary Conner, who is blind, alleged that beyonce.com violated the Americans with Disabilities Act because its images had no alt text, its menus couldn't be operated without a mouse, and a screen reader couldn't make sense of the page. Her attorney put it plainly: there are important pictures on the site that lack a text equivalent, so blind customers "are unable to determine what is on the website, browse the website or investigate and/or make purchases." It was filed as a class action covering every legally blind person in the country who had tried to use the site.
One of the most sophisticated organizations in entertainment, and the exposure was in the markup.
The same playbook, a new target
Last month a different kind of complaint crossed our desk — not ours, not a client's. A Florida resident sued a small business because its website loaded advertising trackers before asking permission.
The suit runs under Florida's Security of Communications Act, a wiretapping law that makes it unlawful to install a "pen register or trap and trace device" without consent. That language was written for telephone lines. It is now pointed at marketing pixels, on the theory that third-party scripts capture routing and addressing information — a visitor's IP address — and that this is interception.
It is worth being precise about what a filing like this is built to do, because the design is the point.
Damages are pleaded as the greater of $1,000 or $100 per day, deliberately kept under the small-claims ceiling. Attached to that is a claim for attorney's fees. No individual case is worth much, and none of them is meant to be. The economics only work at volume, and the volume is possible because the evidence is produced by software: the plaintiff's exhibit is an automated privacy scan of the website, run before anyone filed anything.
Nobody investigated this business. A crawler did.
And the goal is rarely a verdict. A defendant facing a few thousand dollars in exposure and an open-ended fee claim does the math and settles. That is the product.
Why entertainment sites are unusually exposed
An artist's website is rarely maintained by one party. The label adds a pixel for an album campaign. The promoter adds one for a tour. A merch partner, a ticketing platform, an agency running paid social — each has a legitimate reason to ask for a tag, and each request arrives separately, months apart, usually to whoever is fastest to reply.
Nobody in that chain is doing anything wrong. But there is often no one whose job it is to know the full list, and that list is exactly what a scanner reports.
Tour dates, merch, presales and ticket links also mean real commerce, which is what makes a site worth scanning in the first place.
What "protected" actually means
Here is the part that catches people out: the business in that Florida filing already had a cookie banner.
The plaintiff's scan reported two findings side by side — consent banner detected, and consent banner not blocking tracking. The complaint describes a banner that appeared "only after third-party cookies had already been deployed without the Plaintiff's consent."
A banner is not the test. Whether the trackers actually wait is the test. The most common way a working banner quietly stops working is a pixel added later through a tag manager, where Google's consent controls govern Google's own tags and do nothing at all to a Meta or TikTok pixel sitting beside them.
Where we stand
Knowing which of these risks are real, and which are noise, is part of what you hire an agency for. So we build the protection in rather than leaving it as one more thing to remember. Every StoryCanvas site ships with a consent gate: analytics and advertising tags are held inert until a visitor accepts, declining actually declines, and it works on every page — not just the home page, because people arrive from a search result or an ad, not through the front door.
What no platform can do is account for a tag it was never given. A pixel dropped straight into a tag manager by a label, a promoter or an agency sits outside the gate, because nobody told the gate it existed. That is the gap worth closing, and closing it is a conversation, not a project.
So the honest version is this: the protection is on by default, it needs to match the tags you actually run, and someone should look again whenever partners change. Our Cookie Consent guide covers the settings and how to check your own site in about five minutes.
We are not attorneys and this is not legal advice. But we can tell you exactly what your website loads, and when, and who put it there — and for most managers that is the conversation worth having first.
