In recent years, a noticeable trend has emerged in nationwide data privacy litigation. Class-action lawsuits are being filed against consumer-facing businesses who allegedly violate federal and state wiretapping laws by sharing user data with third parties without consent. Many of these businesses utilize various technologies to gather data from users visiting their websites. Such practices, while designed to enhance user experiences and advertising outreach, are now prompting businesses to thoroughly review their data collection policies in light of increasing litigation.
Many of these new data privacy litigation class actions are predicated on the 1986 Electronic Communications Privacy Act, a federal legislation created to limit wiretapping and electronic eavesdropping. Class-action lawsuits alleging breach of state wiretapping laws are also common, particularly in states like California, Pennsylvania, Florida, Illinois, and Massachusetts.
The California Invasion of Privacy Act (CIPA) is often invoked by plaintiff’s attorneys in class action litigations. Despite the dismissal of various CIPA lawsuits and certain courts maintaining its application exclusively to phone communications, new lawsuits continue to be filed due to inconsistent court rulings regarding the application of CIPA to modern technologies.
In terms of the technologies typically implicated in these cases, notable examples include chatbots, website session replay technology, and pixel tracking. Many plaintiffs’ lawyers argue that chatbots function as covert wiretaps, allowing private conversations to be monitored without user consent. In relation to website session replay technology, it is argued that it allows third parties to eavesdrop on private communications for purposes such as targeted advertising.
At the forefront of innovative arguments are new claims based on identity graphing technology, email marketing technology, and ‘Pen register’ and ‘trap and trace’ tracking software. These technologies, it is argued, enable businesses to de-anonymize site visitors, monitor their activities, and share this data with third parties.
Despite the proliferation of these lawsuits, many courts have dismissed wiretap fraud claims based on the use of chatbots. Nonetheless, businesses operating consumer-facing websites should be wary of this developing area of law due to the lack of consistency among courts on state wiretap statutes.
To safeguard against potential data privacy lawsuits, businesses are encouraged to:
- Ensure that user data isn’t being used by third-party vendors without user consent.
- Implement and regularly update clear data security and privacy policies.
- Disclose policies clearly and ensure they meet federal and state standards.
- Respond promptly to any data breaches to mitigate the risk of a lawsuit.
- Secure explicit consent from users before collecting their data.
The costs of potential class action litigation make these proactive measures worthwhile, even if ultimately unnecessary.