Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

There has been a significant increase in claims arguing that website advertising cookies, pixels and similar technologies violate the California Invasion of Privacy Act’s restrictions on pen registers and trap-and-trace devices. As the&nbsp;U.S. District Court for the Central District of California&nbsp;noted in Byars v. Hot Topic Inc. (656 F. Supp. 3d 1051, 105/1-/20 (C.D. Cal. 2023)), it is common for CIPA litigators to simply “copy and paste” their complaints “over and over again” to target new companies as potential violators. These CIPA lawsuits can disproportionately affect small businesses and can force them to choose between incurring costs to defend their business practices in court or through arbitration or settling the matter quickly to resolve the issue and make it go away.

contentpilot/introduction

Unfortunately for businesses, a July ruling by the Central District of California will likely increase the volume of CIPA claims for the foreseeable future. In Dino Moody v. C2 Educational Systems, Judge R. Gary Klausner denied the defendant’s motion to dismiss the CIPA claim it was facing. He concluded that the plaintiff’s allegations suggesting that the defendant’s use of the TikTok marketing pixel on its corporate website might be comparable to unlawfully installing a pen register or trap-and-trace device, thus potentially violating CIPA, were plausible.

core/paragraph

It is the first time a federal court has adopted such a broad interpretation of CIPA, and it may set a precedent for state courts to rule in the same manner. The plaintiff’s counsel in C2 Educational Systems <a href="https://www.law.com/2024/07/31/federal-ruling-sets-precedent-for-trap-and-trace-software-class-actions-in-calif/" target="_blank" rel="noreferrer noopener">told Law.com</a> that these CIPA claims “have become quite valuable” given Judge Klausner’s recent holding, which could be an indication that privacy advocates will increase their search for CIPA violations and target businesses with additional lawsuits.

There are several measures businesses can undertake to avoid these CIPA claims, including adopting an opt-in approach to using third-party website advertising technologies.

Background: Dino Moody v. C2 Educational Systems

C2 Educational Systems provides online tutoring programs and, like many other businesses, operates a public-facing website that deploys advertising cookies and pixels.

On May 22, plaintiff Dino Moody filed a class action against C2 Education, alleging that the C2 website unlawfully processed data related to him and other users without their express or implied consent.

Specifically, the complaint alleged the C2 website deployed the TikTok pixel to capture form data entered by users on the C2 website (e.g., name, date of birth, addresses) and undertake a fingerprinting process to uncover the identities of individuals who accessed the C2 website. It argued that these activities violated Section 638.51(a) of the California Penal Code, which generally prohibits a person from installing or using a pen register or a trap-and-trace device without proper consent or a court order.

C2 Education filed a motion to dismiss and put forth several arguments describing why the plaintiffs were not entitled to relief. These arguments mirror those raised by many other defendants in CIPA actions filed in California state court.

For example, the motion to dismiss argued that, based on the text and structure of CIPA, the law’s provisions on pen register and trap-and-trace devices are intended to regulate the interception of specific, targeted telephonic communications rather than general website tracking pixels. It also cites a federal court decision that concluded pen registers and trap-and-trace devices are limited to physical devices attached to telephone lines, and therefore they exclude website tracking software.

Separately, the motion to dismiss argued that the plaintiffs were not entitled to relief because of CIPA’s user consent exception. In particular, C2 Education argued that it&nbsp;<a>– </a>and not the plaintiffs&nbsp;– is the user of the C2 website, and C2 Education consented to this data processing by installing the TikTok pixel in the first instance.

In his ruling, Judge Klausner indicated on multiple occasions that C2 Education’s arguments were “persuasive” but did not satisfy the level of certainty needed to allow the case to be dismissed at its current stage of litigation.

Perhaps most importantly, Judge Klausner rejected C2 Education’s argument that CIPA does not provide a private right of action for violations arising from Section 638.51(a) because it is a criminal statute that imposes only criminal penalties. According to Judge Klausner, the complaint demonstrates that C2 Education collected the plaintiffs’ information “through the use of the TikTok Software ... constituting an invasion of privacy,” which “are actionable injuries” under the law.

core/heading

Given Judge Klausner’s holding and the contradictory CIPA opinions emerging from California state courts, organizations should adopt measures to better safeguard themselves against CIPA lawsuits.

For instance, organizations should ensure they appropriately document how their websites collect, process and retain data, including through advertising pixels and cookies. They should also establish protocols for modifying website configurations and specifically delegate authority and accountability to an official to approve such changes.

Companies should ensure their privacy statements and terms of service properly address their data processing activities, including ensuring compliance with the broad range of privacy notice requirements outlined in the myriad consumer data protection laws in the United States.

An organization’s website terms of service should clearly specify governing law and dispute resolution processes applicable to its online services, including provisions prohibiting class actions. Organizations should ensure their notices and terms are legally binding on end users, for example, by using click-wrap agreements.

One of the more aggressive tactics that an organization can undertake to protect itself from CIPA claims is to require all end users to affirmatively agree to the use of advertising cookies and pixels, even though this all-encompassing opt-in approach is contradictory to the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA).

For example, under the CCPA/CPRA, Californians have the right to opt out of a covered business using advertising cookies and pixels. The law gives more opt-out rights to Californians if a business uses advertising cookies and pixels to collect consumers’ sensitive personal data, such as their precise geolocations, in certain circumstances.

However, under the CCPA/CPRA, a covered business cannot use such advertising cookies and pixels about Californians under age 16 or under age 13 without prior opt-in authorization from them or their parents or guardians, respectively.

Further, the CCPA/CPRA does not apply to all businesses located in, or doing business in, California. Rather, it only applies to a subset of companies that collect large volumes of personal information or generate significant revenue each year. In creating these applicability thresholds, the <a>California legislature</a> reflected the interests of its citizens not to impose complex mandates on small businesses’ online cookie or pixel management practices.

Notwithstanding the CCPA/CPRA’s general opt-out framework for deploying advertising cookies and pixels designed to collect nonsensitive data from individuals over age 16, all organizations doing business in California may consider adopting an all-encompassing opt-in consent approach to the deployment of their advertising cookies and pixels to safeguard themselves from CIPA-related litigation.

Such an opt-in consent process will better enable organizations to invoke the user-consent exception within CIPA and defeat arguments that the use of advertising cookies and pixels causes an invasion of privacy or other harm to a website end user.

By thoroughly examining the plain text, structure and legislative history of CIPA and other California privacy laws, there are strong arguments that website advertising cookies and pixels should not be considered pen registers and trap-and-trace devices under the law.

If a contrary interpretation of CIPA were to be adopted, then many organizations could be exposed to criminal liability for not obtaining proper cookie consent from each end user who voluntarily accesses their websites or online applications.

However, until this issue is fully resolved by the courts or the California legislature, organizations should consider implementing risk mitigation measures to deter CIPA lawsuits in the first instance, which may include adopting an all-encompassing opt-in approach for deploying advertising cookies and pixels on their websites.

https://admin.thompsonhine.com/wp-content/uploads/2024/09/Thompson-Hine-Newsletter-Business-Law-Update-September-2024.pdf

core/file

This article may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgement of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

Opting In to CIPA Risk Mitigation After New Precedent

Services