In today's world, information is key to ensuring a good customer experience. Especially in the post-COVID digital age, shoppers have come to expect retailers to provide easy-to-navigate, bug-free, quick-moving digital platforms, and instantaneous responses to customer service inquiries. This is accomplished through data collection. Although numerous retailers have turned to session-replay and chatbot technology to optimize their websites and meet customer demand, these software systems have been hit by a tidal wave of recent lawsuits and lawsuit threats, alleging that the use of these technologies, without customer consent, amounts to wiretapping.
Since December 2020, over 65 lawsuits have been filed, in addition to many dozens of litigation warning letters sent to retailers. Almost 40 of these suits have been filed in California since May 31, 2022, when the Ninth Circuit Court of Appeals reversed a district court's decision granting a motion to dismiss on a session-replay case. On August 16, 2022, the Third Circuit Court of Appeals reached a similar decision, spurring additional claims in Pennsylvania. Although most of these new suits have been filed by law firms established in the website accessibility space, the steep damages at issue in these cases have led plaintiffs to expect much larger payouts than in the accessibility context. Retailers who use session-replay or chatbot technology should therefore act quickly to determine and understand potential litigation risks.
What Is Session-Replay?
Session-replay is software, usually provided by third-party vendors, that allegedly records data concerning customers' interactions with a given website. Unlike a video camera though, which records a customer or a customer's screen, session-replay collects specific actions like bounce rates, clicks, and views. These data collection points are then added to a log of the user's actions, which is used to reproduce (replay) the customer's interaction (session) with the website. These reproductions allow retailers to fix website bugs, investigate issues reported by customers, and optimize market engagement.
The Relevant Statutes
The session-replay and new chatbot suits are filed under so-called "two party consent" (or, more accurately, all party consent) statutes, which require companies to inform all parties who are part of a conversation that they are being recorded and further obtain their consent to the recording. Most notably:
- The California Invasion of Privacy Act (CIPA), Section 631 provides that anyone who "reads, or attempts to read, or to learn the contents" of a communication "without the consent of all parties to the communication" is in violation of Cal. Penal Code ' 631(a). The statute provides damages in the amount of $2,500 per violation or $10,000 per violation for repeat offenders, in addition to potential jail time.
- Since this fall, plaintiffs have also begun bringing claims under Section 632.7 of CIPA, which focuses on cellular devices This section provides that anyone who "without the consent of all parties to a communication, intercepts or receives and intentionally records ... communication...
