UnscrIPted

Over the last decade, Plaintiffs’ firms and pro se individuals capitalized on ambiguities in California’s Invasion of Privacy Act (CIPA) (“the pen register statute”) to allege violations by consumer companies based on their websites. Given high user traffic on these commercial websites and the threat of damages of up to $5,000 per individual violation, e.g., each visit to a website, companies are incentivized to enter into monetary settlements due to potential statutory exposure. Notably, the LA Times recently agreed to a settlement of $3.85 million to quash a pen register suit alleging unauthorized sharing of pixel data with third-party advertising companies. California recently enacted legislation Senate Bill 690 (SB 690) to amend CIPA and protect its business owners. It remains to be seen if other states will follow.

The pen register statute, originally enacted in 1967 to cover telephone lines, did not provide a clear definition of a pen register, a trap-and-trace device, or user consent, which define the intended reach of the statute. The ambiguity stemmed from the fact that the statue prohibited installation or use of a pen register or a trap-and trace-device without a court order, but at the same time, with user consent, allowed an electronic or wire communication service provider to use a pen register or a trap-and-trace device to operate, maintain, and test a wire or electronic communication service.

Broad interpretations of the 1967 statute extended reach of the pen register statute from phone lines to modern day recorded information, user device data, and marketing and targeted advertising cookies shared by websites without consent. This made commercial websites that collect and share user website analytics and recorded information vulnerable to pen register suits. Websites that failed to include privacy cookies or banners requesting explicit user consent before sharing user website analytics and recorded information with third-party advertising companies were easily targeted under the broad interpretations. Such websites were characterized as unauthorized pen registers. Due to this recent influx of multi-million-dollar settlements, courts have found that such broad interpretations of the pen register statute are incorrect as these consumer websites do not actually intercept data. These courts believe that CIPA was intended to be applied only to telecommunications, since it was enacted before the rise of the modern internet.

California has been the first to address this ambiguity and recently passed Senate Bill 690 (SB 690) to quell broad interpretations of the pen register statute. SB 690 amends the pen register statute such that only the California Attorney General can bring civil lawsuits for website-based pen register claims. SB 690 takes effect next year and is retroactive to claims filed two years prior. Accordingly, this should reduce private civil causes of action for website-based pen register claims, though it is still important for consumer companies to maintain legally compliant data tracking and cookie management policies.

Author: Sara Desai

Edited by Craig Drachtman and April Capati

For more articles like this, click the link below:

https://www.lernerdavid.com/news-successes/unscripted