An insurer has asked a federal court to declare it owes nothing on a $5 million excess demand, saying the coverage beneath its policy was never used up.
Evanston Insurance Company filed a declaratory judgment complaint on August 4, 2026, asking a California federal court to find that it owes no coverage to FullStory, the software company behind "Session Replay" tracking tools. According to the filing, FullStory has demanded $5 million under an excess cyber policy and says its defense costs exceed $10 million.
The complaint offers a clear look at how an excess "follow form" policy is meant to work - a policy that sits above a primary insurer and largely mirrors its terms.
According to the complaint, Evanston's layer carries a $5 million limit but attaches only above a $5.01 million "Underlying Limit." That figure includes a $5 million primary policy issued by two primary insurers, plus a $10,000 retention.
The filing centers on the policy's trigger language. Evanston's policy states that its coverage attaches only after the underlying insurers or the insured "pay in legal currency as loss covered under the Underlying Insurance the full amount of the Underlying Limit." Evanston reads that to mean someone must actually pay $5.01 million in covered loss before its own limit is reached.
The backdrop is the wave of Session Replay litigation. The complaint says the software records keystrokes, mouse clicks, and other user activity on websites and apps. Since October 2020, according to the filing, at least thirty purported class actions have been brought against FullStory or its clients, alleging that the tracking invaded consumer privacy and violated state and federal wiretapping laws. The complaint states that FullStory noticed twenty-six of those claims to Evanston.
An earlier court ruling narrowed the field. According to the complaint, in an October 24, 2023 ruling the same court held that the primary insurers had a duty to defend just four of the noticed claims. Evanston builds its case on that finding, arguing that only defense costs tied to those four claims could count toward the underlying limit.
The complaint alleges those four claims were inexpensive to defend. It states that two were voluntarily dismissed within weeks of filing, a third was dismissed on the pleadings within a year, and the fourth was stayed in November 2024 and voluntarily dismissed in May 2026. On that basis, Evanston alleges there is no reason to believe FullStory spent anywhere near $5.01 million defending them.
The filing then addresses the larger sum. It states that in October 2025, FullStory produced 141 invoices totaling $10,358,220.17 for legal work. Evanston alleges that 83 of those invoices, worth $6,724,519.44, were billed to claims the primary insurers had no duty to defend. It further alleges that only 53 invoices, totaling $3,387,350.00, were billed to the privacy class actions or general litigation, and that even those did not exceed the $5.01 million underlying limit.
Evanston also points to the settlement that ended the earlier coverage litigation. According to the complaint, that settlement did not allocate any amount to the four covered claims and stated that it was not evidence of covered amounts and would not prejudice other insurers, including excess carriers. The filing adds that Evanston's policy provides it is not bound by the actions of any other insurer.
The complaint raises a consent issue as well. It states that the primary policy, which Evanston follows, bars the insured from incurring expense or entering settlements "without our prior written consent." Evanston alleges that FullStory incurred more than $10 million in defense costs, largely on lawsuits that did not name FullStory as a defendant, without notice to or consent from Evanston. According to the filing, some of that spending related to claims never reported under the Evanston policy.
In total, the complaint brings six declaratory causes of action, including that FullStory must prove exhaustion of the underlying limit, that there is no coverage for lawsuits not naming FullStory or for client "claims," that notice was late or insufficient, that Evanston need not reimburse voluntary payments, that FullStory breached its duty to cooperate, and that a "Prior Knowledge Exclusion" may bar coverage. Evanston also asks the court to declare it is not liable for statutory penalties that, according to the filing, FullStory threatened under Georgia's O.C.G.A. § 33-4-6 and Illinois's 215 ILCS 5/155.
For carriers writing excess layers, the complaint frames a familiar question: whether incurring defense costs is the same as exhausting an underlying limit through the actual payment of covered loss.
These are allegations contained in a complaint filed by Evanston. The allegations have not been tested in court, and no judge has ruled on them.
