Readers of this blog are familiar with the California Invasion of Privacy Act (“CIPA”), and the systematic transformation of CIPA wiretapping cases since their inception. Applying CIPA, a Washington State federal court recently denied a motion to dismiss a putative class action alleging that defendant violated CIPA by wiretapping plaintiff’s conversations with a third-party. Below, we discuss the facts of the case, the Court’s decision, and the ramifications of the Court’s decision.  

Gladstone v. Amazon Web Services, Inc. 

Between March and October 2022, plaintiff alleged that she made several telephone calls to her banking institution. Plaintiff further alleged that her banking institution used defendant’s proprietary telecommunications software without her consent to capture and record these conversations, and that defendant accessed and analyzed these conversations. As a result, plaintiff filed a class action lawsuit alleging that defendant violated CIPA by illegally wiretapping her customer service conversations with her banking institution. 

In response to the lawsuit, defendant moved to dismiss plaintiff’s CIPA claims on five separate grounds: (1) defendant argued that it is exempt from liability because it falls under the “party exemption” to the statute (a person who is a “party” to a communication is exempt from liability); (2) that defendant’s proprietary software is not a “device” for the purposes of CIPA; (3) that defendant merely enables customers (such as plaintiff’s banking institution) to use its software, and that defendant itself did not “use” the software to record or eavesdrop on plaintiff’s calls; (4) plaintiff’s communications with her banking institution were not “confidential communications;” and (5) plaintiff failed to allege that defendant acted intentionally or willfully.  

The Court denied defendant’s dismissal motion in its entirety. In its decision, the Court explained that plaintiff sufficiently pled that defendant violated CIPA because plaintiff had alleged that defendant was capable of using the data collected “to improve its own products and services, which shows that it is capable of creating, recording, and retaining data for purposes other than sending the data back to [the banking institution].” In its analysis of whether defendant’s software constitutes a “device” within the meaning of CIPA, the Court looked to the federal Wiretap Act, and determined that the term “device” includes defendant’s software for CIPA purposes. Regarding the confidentiality of plaintiff’s communications, the Court found that plaintiff’s allegations of a reasonable expectation of confidentiality were sufficient to survive dismissal because reasonableness is a question of fact for a jury to determine. The Court also held that a more fulsome evidentiary record was required in order to determine whether defendant acted intentionally or willfully. 

CIPA Wiretap Lawsuits Continue to Evolve 

This decision is significant because it requires companies, at the beginning of their phone calls, to (at the very least) disclose not only: (1) that calls are being recorded; but also (2) the identity of the entity recording the call. To avoid potential CIPA wiretapping claims, the Court’s decision makes it imperative that businesses immediately evaluate their data collection technologies and practices, and how consent to use consumer data is obtained. 

[View source.]