Written by Jennifer M. Oliver*
While more U.S. states are introducing and enacting new privacy legislation, plaintiffs are increasingly turning to laws that have been on the books for 50 or more years to pursue individual and class action privacy litigation against companies using software vendors to analyze web traffic or ad tracking technology, such as Meta Platforms Inc.'s Pixel tracking tool.
These session replay software, third party chat features, and pixels are commonplace on consumer facing websites. But now plaintiffs are alleging that when these tools capture browsing data and share it with third parties, for example software providers and social media companies, the companies utilizing them violate state wiretap acts—notably in Florida, Illinois, Pennsylvania, and, perhaps most commonly, California. Several district court decisions allowing these claims to proceed past the pleading stage on a theory of aiding and abetting against a website owner, allowing a third party to facilitate its chat function, has emboldened class action attorneys in California.1
California courts have seen a significant uptick in putative class actions under Section 631 of California's "wiretapping" statute.2 There, plaintiffs claim that where a third-party provider of chat, session replay, or Pixel functionality has simultaneous, real-time access to website "communications," without the website user's knowledge or consent, the website operator is "aiding and abetting" the third-party vendor's Section 631 violation.
And a review of class actions on the public dockets reveals only the tip of the iceberg: there are many more individual private arbitrations being filed against companies with arbitration clauses contained in their website term and conditions as well. Because a putative plaintiff need only visit a public facing website to bring a claim, it is relatively easy for plaintiffs' firms to amass a large number of individual arbitration claimants. While may companies believe that mandatory arbitration clauses and class action waivers are protecting them from costly class action litigation in court, when dozens or even hundreds of individual claims are filed, the cost of filing fees alone can compound and exceed in court litigation. For example, cases with only a single $5,000 violation, represent a significant percentage of the value of each individual claim.
CHAT AND SESSION-REPLAY CASES
Chat and session replay software were the first wave of suits in California courts. Chat bots are familiar to most internet users, many consumer-facing website use a third-party chat provider to enable the feature on their site and allows consumers to chat in real time with consumer service representatives. But where a third party has access to those chants, and consumers do not consent to that access, plaintiffs will allege that a wiretap has occurred.
Session-replay software allows website operators to record mouse movements, keystrokes, and search information inputted into websites, as well as pages and content viewed. In this way, session-replay software allows a website operator to "replay" a visitor's journey on a website or within a mobile or web application. Rather than focusing on user activity after leaving a particular website, session-replay software focuses on how a user interacts with a specific website. Marketing departments use this data to better understand the users' experiences and gain visibility into the bugs, errors, or confusing moments they may encounter.
[Page 10]
Again, if the session replay vendor has access to the session repay data, plaintiffs will allege that a wiretap has occurred.
One key consideration is whether any involved session replay vendor or service provider is limited by agreement (or otherwise) to using the website activity data only to analyze the website's functionality for the company's benefit, rather than for the provider's own independent purposes. There is at least some good news for website operators on this front: at least one court has held that session-replay technology cannot form the basis of a California Invasion of Privacy Act (CI PA) claim because a service provider does not use the data for its own purposes; it is an extension of the website provider, and a party cannot "tap its own wire."3 However, even where there are such terms favorable to defendants, they can be challenging to introduce at the motion to dismiss stage where defendants are limited to the four corners of the pleadings.
But, on the other hand, in Saleh v. Nike, Inc.,4 the court found that where a third-party software provider has simultaneous, real-time access to a customer's website communications, without the customer's consent, that third-party vendor cannot avail itself of the rule that parties to a communication cannot also be wiretappers under CI PA. Although that logic would seem to implicate the vendor as the "wiretapper" and not the website operator, the Saleh court went on to find that the website operator "aided and abetted" the violation, creating a real risk for website operators embedding chat software to communicate with California customers.5
META PIXEL CASES
Perhaps the most popular brand of wiretapping cases as of late are those involving use of the Meta Pixel tracking tool. The Meta Pixel is free code, courtesy of Meta, that can be used on a company's website to track user activity. Used by companies for targeted advertising, the code transmits certain information about a user's interaction with a website that uses the Pixel to Meta, including the HTTP headers, pixel-specific data (Pixel ID and cookie), and other information based on company configuration.
Here, plaintiffs allege that the Pixel shares browsing data with Facebook and Facebook is a third party wiretapper collecting this data for its own gain. This distinguishes these cases from...
