Topics that we often discuss on this blog are the use of third-party tracking tools and the California Invasion of Privacy Act (“CIPA”). Less discussed of late, however, is the California Consumer Privacy Act (“CCPA”) which, like CIPA, provides consumers with a private right of action. Until recently, private lawsuits brought under the CCPA typically have been limited to data breach incidents. However, a recent California federal court ruling has paved the way for a lawsuit to proceed alleging CCPA violations in the absence of a data breach. Below, we discuss the decision, the similarities between CIPA and CCPA claims, and the implications of the decision for online businesses.
Tracking Software and Potential CCPA and CIPA Liability
The CCPA provides a private right of action for any “consumer whose nonencrypted and nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security practices.” In Shah v. Capital One Financial Corp., Plaintiffs filed a putative class action alleging that Capital One’s use of third-party tracking tools, such as Google Analytics and Facebook’s Meta Pixel, violated the CCPA and CIPA. By using these third-party trackers, Plaintiffs alleged that Capital One disclosed their personal information to third parties without their consent in violation of the CCPA. This disclosure, Plaintiffs further alleged, constituted illegal wiretapping and eavesdropping in violation of CIPA. In response, Capital One filed a Motion to Dismiss Plaintiffs’ CCPA and CIPA claims. Although the court granted Capital One’s motion in part, it declined to dismiss Plaintiffs’ CIPA and CCPA claims.
Construing the CCPA’s private right of action broadly, the Court held that Plaintiffs were not required to allege a data breach for their CCPA claims to survive dismissal. The Court similarly denied dismissal of Plaintiffs’ CIPA claims, finding that Plaintiffs had sufficiently alleged that: (1) Capital One accessed Plaintiffs’ communications “in transit”; and (2) provided details on how Capital One installed third-party trackers on its website. Because these trackers allegedly recorded and tracked Plaintiffs’ activities and personal information while visiting Capital One’s website, the Court held that Plaintiffs plausibly alleged that Capital One unlawfully wiretapped Plaintiffs’ communications. The Court declined to grant Capital One’s Motion to Dismiss Plaintiffs’ CCPA and CIPA claims on the grounds that Plaintiffs consented to the use of third-party trackers.
Was Your Company Named in a CCPA or a CIPA Lawsuit?
The use of third-party tracking technologies on websites is relatively common. The decision in this action and the expansion of the CCPA private right of action beyond the traditional data breach context opens the floodgates for the plaintiffs’ bar to bring lawsuits against online businesses on two fronts. The CCPA provides for statutory damages ranging from $100 to $750 per violation. As our readers know, CIPA also provides for statutory damages, which are even greater than those under the CCPA ($5,000 per violation). If found liable, violations of the CCPA and/or CIPA can be quite expensive, especially when they are brought as a class action.
[View source.]
