The Massachusetts’ Consumer Privacy in Commercial Transactions Act (the “Act”) limits companies’ ability to request and collect personal identification information (“PII”) that is not required for a transaction. The Act does not mention ecommerce and predated online retail, but, like many privacy litigation trends, this privacy law is now being tested in the online context. The Act gives a private right of action and has statutory damages of $25 per violation (and a knowing violation of the Act permits recovery of up to three times the statutory amount).
What can we learn from these filings?
Plaintiffs are watching online data collection practices, even those that are pervasive. In these Massachusetts cases, the plaintiffs examine the consumer experience at checkout, looking at each retailer’s messaging about marketing emails. These cases examine three different options: (1) an unticked box with a call-to-action to check the box to receive marketing messages; (2) a message to consumers that completing their transaction indicates their agreement to receive marketing messages subject to their unsubscribe actions; and (3) no message about marketing at all. Regardless of the messaging, the plaintiffs allege the retailers sent unlawful email marketing messages. While these cases focus on email at checkout, online checkout is likely not the only source of consumer emails at a company. Companies should understand how they collect emails at checkout and any other sources of email collection. It is possible that the same data point is collected via multiple means and by different teams across the business. Consider connecting with website teams, marketing teams, and agencies to better understand your company’s practices and identify potential risk.
Is the United States an opt-in to email marketing jurisdiction?
Generally no, but context matters. The federal CAN-SPAM Act continues to be an email “opt-out” or “unsubscribe” law. However, your email marketing program and guidance should factor in laws that regulate collection of personal information, including in specific applications like checkout, and state consumer privacy laws, the FTC Act, and state UDAP laws. The FTC Act and state UDAP laws prohibit unlawful and/or deceptive trade practices and cover promises made by a company about how it will (or will not) use consumer data. For example, an email sign-up experience presents consumers the choice to opt-in to email marketing via tick boxes. A consumer may have certain expectations about the types of messages it will receive from the company based on that sign-up experience (and remember to look at other sign-up experiences that may be different!) and be more likely to complain if the company appears to send messages despite the tick box selection which could turn into regulatory scrutiny or litigation risk.
What are some takeaways? Fact gathering and process controls (such as standardized email sign-up messaging) can help create consistency across the organization where appropriate. Different language and experiences will create complexity to your email sign-up and marketing email guidance, but business needs may drive these differences. Cross-functional communications can help the different business functions understand the business goals and evaluate if the user experience meets those goals and the business’s risk tolerance.
Our discussion in this alert is focused on email collection under Massachusetts law, but online retailers should also be aware of cases in California challenging collection of IP addresses in online checkout experiences under the Song-Beverly Credit Card Act. You can read about that topic here.
[View source.]
