Anyone following consumer privacy trends is likely aware of the wave of consumer litigations filed against website owners/operators alleging violations of state wiretapping statutes based on the use of so-called “session replay” software on websites to monitor consumer interactions on the internet.

A recent ruling by the 9th Circuit Court of Appeals went in favor of the plaintiff in such a case, but the top-line holding does not tell the whole story and this decision should not be seen as opening the door to another wave of session replay litigation.

In Javier v. Assurance IQ, LLC, et al., the District Court had dismissed the complaint, finding that plaintiff failed to set forth a valid claim based on the undisputed presence of consent to the recording. Given that consent, the lower court declined to rule on most of the defendants’ arguments concerning why the claim should fail. On appeal, the 9th Circuit reversed. But that does not mean that wiretapping claims based on the use of session replay software are viable.

Both the California Information Privacy Act (CIPA) and Florida Security of Communications Act (FSCA) were drafted to offer protection, and a private right of action, to consumers whose telephone calls were intercepted by third parties without their permission. The statutes pre-date the internet, but have been interpreted to protect against the interception of emails or text messages during their transmission. Because each statute provides for statutory damages, they present a dangerous (potentially bet-the-company) claim for website operators.

As a factual matter, session replay software does not “record” a consumer’s interactions in the same way as a tape or video recorder. Instead, the software is designed to capture information at regular intervals so those movements and inputs can be overlaid with an image of the website to provide a type of “dramatization” of what happened.

Defendants facing session replay claims have asserted many strong (and often successful) arguments. First, consent is a complete defense. Consent can be both affirmative or implied. The consent at issue in Javier was an affirmative, confirmatory click by the consumer accepting the use of session replay software recording his interactions. The District Court held that affirmative consent to recording (including acceptance of the relevant privacy policy and/or terms of use where that recording is discussed) was sufficient to demonstrate consent, even when that consent came at the conclusion of the parties’ interaction, after the recording had already been running.

In addition, session replay claims have failed (and lack merit), because the information captured is not the contents of a communication. Just as a telephone bill or pen register is not considered the contents of a call, neither does capture of a consumer’s device model, operating system or IP address implicate the contents of a communication. For these, and other case-specific, reasons, several cases have been dismissed and/or dropped at the pleading stage.

What’s Next?

The Javier case now returns to the District Court which will, presumably, consider the remaining defenses presented in the defendants’ dispositive motion. Specifically, the court will consider whether implied consent and/or lack of a third-party warrants another dismissal of the complaint. Given the narrow nature of the court’s decision — focused solely on the directive that consent to recording must come at the start, not the end, of the consumer interaction — this decision should not embolden a new wave of consumer litigation.

That said, website operators (and their customers) should be concerned with, among other things:

• relevant terms of their consumer-facing policies
• disclosure language
• relevant vendor contracts
• capture, use, storage and/or sale of any data
• operations of the software
• the risks/benefits of using such software

Any company running, or considering, session replay technology on their consumer-facing website should do so thoughtfully and seek legal guidance from experienced practitioners.

[View source.]