Latest Updates to Wiretap Litigation

The California Invasion of Privacy Act (CIPA), a 1967 penal code law originally designed to protect the privacy rights of California residents, has become the basis for a recent surge in demands and lawsuits. Plaintiffs’ attorneys are suing companies across the country for using tracking technologies on their websites without proper cookie consent software.

CIPA has many subsections. Most notably, under CIPA, parties may not intercept or record private communications without the consent of everyone involved. Plaintiffs argue that online tracking tools, such as chatbots, tracking technologies, and session replay scripts, inadvertently or intentionally intercept and record communications in violation of the statute. It is also unlawful for someone to install or use a pen register or trap and trace device without a court order. Plaintiffs often allege that the use of tracking technologies, including analytics and fraud prevention tools, constitute the unlawful use of a pen register or trap and trace.

It is important to note that comprehensive privacy laws in the United States specifically address certain website tracking – namely technology used for targeted advertising. Those laws, including California’s Consumer Privacy Act (CCPA), require that website visitors be given the right to opt-out of covered tracking. CIPA, on the other hand, is generally an opt-in or consent based statute. That runs contrary to comprehensive privacy laws that require an opt-out. As a result, businesses that comply with opt-out laws can still be the subject of CIPA litigation.

Demand Letter Surge, But Don’t Panic

Plaintiffs’ firms and pro se litigants across the country continue to send hundreds of CIPA demand letters every month. Indeed, it is estimated that one notable serial litigator, Vivek Shah, has single-handedly sent thousands of demand letters to companies across the country and across all sectors alleging violations of CIPA. These demand letters seek monetary payments and threaten lawsuits.

CIPA cases and demands are not all the same. The decision about whether and how to respond is a tactical decision that should be made in consultation with legal counsel. If your company receives a demand letter, promptly reach out to knowledgeable counsel for a tailored response strategy.

If Your Business Receives a Demand Letter

The person or law firm sending the demand letter significantly affects the risk exposure. Contact counsel so they may advise you based on the demanding party’s history.
Privacy laws are evolving quickly. An analysis of the current state of the legal and regulatory environment based on your circumstances will influence the appropriate response.
While you consider your response, retain records of what website tracking tools you are running, what data they collect, and the purpose / use of those tools

The Future of Privacy Litigation in California

The California Assembly Privacy and Consumer Protection Committee advanced Senate Bill 690. The Bill would prevent private litigants from suing under Section 638.1 of CIPA which prohibits the use of pen register and trap and trace devices to record information contained in electronic communication. However, the prohibition would not extend to other sections of CIPA that plaintiffs cite to support lawsuits, including Section 631 the statute’s prohibition on the intentional interception or reading of communications in transit.

In a bit of relief for companies, the pro se litigant Vivek Shah was recently declared a vexatious litigant in the Central District of California by Judge R. Gary Klausner. As a result, Mr. Shah must obtain the court’s permission before filing any new CIPA claims. Judges also have discretion to require that Mr. Shah post a bond for costs early in a lawsuit, which would protect a defendant who prevails but is unable to recover attorneys’ fees from Mr. Shah. It remains to be seen how this development will influence Mr. Shah’s approach going forward.

Compliance Reminders

The ongoing abundance of privacy litigation is a good reminder to check whether your company and its website are properly collecting and storing data, and whether your disclosures are sufficient. Privacy policies should be updated yearly, and every time you make a change to your website, compliance should be revisited.

Common Compliance Mistakes

Not knowing what information you collect and whether you need it
Failing to provide proper notice about recordings
Not knowing the laws and regulations of all states where you serve customers
Not maintaining, updating, or following a privacy policy
Failing to post a privacy notice on your website.

Best Practices for Compliance

Monitor changes in the law. States are amending their wiretap and privacy laws with regularity
Evaluate necessity of data collection, identify risks, and implement protections to mitigate those risks
Conduct a privacy assessment to evaluate the technology tools used by your business
Maintain a conspicuous link to your privacy policy on your website
Review and update your privacy policy on a regular basis
Your privacy policy should specify what personal information you collect across your organization, how it is used, how it is disclosed, how long it is retained, and how customers can contact you to correct or delete their information
Train employees, marketing, and IT staff to ensure compliance with your privacy policy
Prominently display how website visitors can opt out (or possibly opt in) to cookies and tracking technologies
Update your vendor agreements with appropriate data protection addendums.

How We Can Help

Womble Bond Dickinson’s Privacy and Cybersecurity team regularly advises clients on website compliance, privacy policies, and responding to demand letters. If your company has received a CIPA demand letter or would like to proactively assess your website’s privacy compliance, we can help you:

Evaluate and respond to demand letters
Conduct assessments of your data collection practices and privacy assessments of your website
Draft or update privacy policies to ensure compliance with applicable federal and state laws and regulations
Advise on cookie consent and tracking technology compliance.

You also may want to read Increasing Risks for the Advertising Ecosystem: Lawsuits Relying on the Bulk Data Transfer Rule Gain Traction.