The Lyon Firm is investigating new invasion of privacy claims for California residents and plaintiffs nationwide. Recent class action lawsuits have been filed, citing consumer privacy violations. Several website operators may be violating the California Invasion of Privacy Act (CIPA) and other state statutes by using session replay tools and other online recording software.
What is Consumer Wiretapping?
For many years, American businesses have regularly monitored and recorded phone calls with customers to ensure order accuracy or to review employee performance. This is legal as long as the consumer is notified that the interaction is being recorded.
The same largely applies to online browsing. Websites must tell consumers if they are monitoring online activities, or recording and storing your “live chat” interactions.
California Privacy Law forbids anyone from illegally wiretapping a conversation without a court order. While the law specifically addresses the tapping of telephonic devices, consumer privacy lawyers have begun to cite the same statute in online privacy cases. California Penal Code 631 lists the following as potential CIPA violations:
- Using any machine, instrument, or contrivance to intentionally tap or make any unauthorized connection to a telephone conversation
- Trying to read any communication without the consent of all the parties participating in the conversation
- Using any information obtained through a wiretapped conversation
- Conspiring with another person to commit a wiretapping offense
California is a two-party consent state, which means that everyone involved in the call or “live chat” must agree to it being recorded. If just one party does not provide consent, then recording the conversation constitutes a violation of the CIPA and can result in legal action.
It is also important to note that out-of-state businesses still have to respect and comply with California privacy law. Even if the website or individual you interact with is located elsewhere, consumers can still file a lawsuit under the California Invasion of Privacy Act if they were in the state at the time of any CIPA violation.
Understanding The California Invasion of Privacy Act (CIPA)
The CIPA is the California statute that makes it illegal for businesses to wiretap consumer communications or record individual interactions without prior consent. Businesses that violate the CIPA may be subject to both criminal and civil penalties. Consumers who have been wiretapped or recorded without permission have already cited this statute and filed several invasion of privacy consumer class action lawsuits.
California has worked to strengthen consumer protection law in recent years, including passing the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and the California Consumers Legal Remedies Act. Under the California Invasion of Privacy Act, it is illegal for companies to wiretap or record conversations unless all participants have clearly consented to the recording. This applies to telephone conversations and any online communications.
A website’s use of session replay, keystroke logging, or third-party chat-bot technology without consent can constitute an unlawful wiretap or eavesdropping offense under CIPA. The potential recovery of statutory damages can reach $5,000 per violation.
What Are Some Potential CIPA Violations?
In the age of data collection, with data brokers buying and selling huge amounts of personal information, it has been beneficial and extremely profitable for websites to keep records of online interactions and communications with customers.
However, as defined by California’s wiretap law, this could be problematic. If a company uses session replay software or other tracking tools to capture visitor behavior, it may constitute an unlawful intercept of the communication.
Many website operators have installed session replay and “live chat” applications onto their site in which a third-party vendors have real-time access to the chat communications. Session replay software allows websites to monitor how a user interacts with the website. Because it is a machine being used to intercept and record communications possibly makes this a violation of the CIPA.
This may only be lawful if such web operators adequately disclose this and acquire the user’s consent.
What are Pen Register Cases?
One of the means by which websites capture digital fingerprints is by deploying pen register and trap and trace spyware. Some companies have been able to record location, event, and data tracking on smart phones. The FTC recently ruled that many widely used location data tracking tools used by data brokers constitute an invasion of consumer privacy.
The term “pen register” has long referred to devices that record outgoing phone numbers dialed on a telephone. Trap and trace devices, conversely, record incoming phone numbers. The definition has evolved over time, and now the term “pen register” is often used to refer to certain software or fingerprinting tools used to track users’ online activity.
California law specifically prohibits the installation of a pen register without first obtaining a court order. The CIPA defines “pen register” as “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.”
The CIPA states: “Advances in science and technology have led to the development of new devices and techniques for the purpose of eavesdropping upon private communications and that the invasion of privacy resulting from the continual and increasing use of such devices and techniques has created a serious threat to the free exercise of personal liberties and cannot be tolerated in a free and civilized society.” § 630 (California Penal Code: Part 1, Title 15, Chapter 1.5 “(Invasion of Privacy”) Cal. Penal Code §§ 630-638).
Personal privacy should remain a basic, protected individual right for American consumers. Big Tech and data brokers, however, have continually pushed the limits on what it means to respect consumer privacy and operate within ethical and legal boundaries.
Any violation of the right to privacy is grounds for legal action. Thus, to further ensure the privacy of consumers, California passed the California Invasion of Privacy Act (CIPA). CIPA reviewed existing federal privacy law, added further consumer protection, and strengthened the definitions of privacy to adapt to modern digital technologies.
New technologies have made it extremely simple for companies to eavesdrop on private consumer communications. In a rush to collect data, which can be very valuable, some companies have violated federal and state consumer privacy laws.
In recent consumer privacy lawsuits filed in California, plaintiffs allege instances of illegal wiretapping and eavesdropping on their online communications. Complaints have noted that certain websites are recording live chats and using session replay software without consumers’ consent. Privacy lawyers have interpreted such actions as wiretapping offenses.
Invasion of Privacy Damages
Individuals suffer a great deal of emotional distress in times of private uncertainty. CIPA lawsuits can recover compensation for the following:
- Emotional pain and suffering
- Disgorgement of any illicit monetary gains
- Punitive Damages
As technology enters into almost every aspect of our daily life, we are seeing our privacy diminish. Instances of invasions of privacy are reported in many corporate and private affairs. The loss of private data can lead to identity theft and fraud, and require legal action.
CIPA Statute of Limitations
A Statute of limitations refers to the period of time a plaintiffs has to file a lawsuit before legal action is no longer possible. These time period differ based on practice area, location and circumstance.
Plaintiffs generally have one year from the date of the act to contact an attorney and file a CIPA claim. Settlements are likely in pen register and consumer wiretapping cases where there is clear and preserved evidence.
