Businesses operating public facing websites that employ data analytics software to track users’ website interactions must be aware of a novel use of the California Information Privacy Act (“CIPA”) that has taken the plaintiffs’ bar by storm. Specifically, class action complaints and demands have been filed in abundance under California Penal Code Section 631, California’s equivalent of the federal Wiretap Act (18 USC § 2511), which imposes fines and other penalties for wiretapping and eavesdropping. The spur in litigation is a result of an unpublished Ninth Circuit opinion finding that CIPA “applies to Internet communications.” Javier v. Assurance IQ, LLC, No. 20-CV-02860-CRB, 2023 WL 3933070 (N.D. Cal. June 9, 2023). Plaintiffs’ counsel argue that websites that incorporate third-party data analytics software are illegally aiding, agreeing with, employing, or conspiring with a third party to engage in “eavesdropping” activities.
Why the sudden surge in filings? CIPA imposes a $5,000 statutory penalty per violation. Cal. Penal Code Section 637.2. Businesses that have taken precautions against class actions by including mandatory arbitration provisions in their website’s terms of service/use are not immune from prosecution. Now, Plaintiffs’ counsel are threatening to file or filing these types of claims en masse in arbitration, in the hopes of forcing businesses to settle for a nominal value rather than face paying tens, hundreds, or even thousands of arbitration fees to defend against the claims.
Companies can prevent becoming a target by having well-drafted terms of service and privacy policies (hereinafter “TOS”). For businesses outside of California that operate public facing websites, it is imperative that your TOS are updated to protect against these exploitive claims. We recommend the following strategies when drafting TOS.
Reference the AAA/JAMS Mass Arbitration Rules
Make sure that your TOS specifically reference the new mass arbitration rules employed by AAA/JAMS to ensure the most favorable fee schedule will be applied to your arbitration. Generally, individual arbitration cases require defendants to pay upfront administrative fees for the arbitration, and in the consumer context businesses often pay the lion’s share of the total costs of arbitration. If a company is required to pay multiple fees at a time for identical cases, the costs can become prohibitive. For example, while upfront fees vary depending on the facts of each potential arbitration, assuming a company is required to pay an upfront administrative filing fee of $3,000 per arbitration, if 10 identical cases are filed, a company will be required to pay $30,000 in upfront administrative fees; if 100 identical cases are filed, that number jumps to $300,000; and if 1,000 identical cases are filed, a company will have to pay $3 million just in upfront administrative costs before even addressing the merits of a case.
To address these prohibitive upfront costs, AAA[1] and JAMS[2] have each recently published updated procedures pertaining to mass arbitration and fees schedules that cap administrative filing fees regardless of the number of cases in arbitration filed, with additional fees to be assessed at the merits phase. JAMS has set the initial filing fee for mass arbitrations at $7,500 and AAA has set its initial filing fee for mass arbitrations at $8,125. The JAMS updated procedures apply only when both parties to the arbitration agree to the updated procedures and the AAA updated procedures apply at AAA’s sole discretion. Therefore, specific references to the appropriate mass arbitration fee schedules in your TOS will greatly increase the likelihood they will be applied to your arbitration(s) and protect your company from potentially having to pay five- and six-figure upfront administrative filing fees in arbitration.
Include a Strong Choice of Law Provision
For businesses that are registered or incorporated outside of California or have a principal place of business outside of California, including a strong choice of law provision in your TOS that applies the state law of the state where the company is registered/incorporated or where the company has its principal place of business is essential. CIPA is a California state law and can only be applied where California law is applicable and therefore CIPA’s $5,000 per violation penalties can only be assessed where California law is applicable to a case or controversy. A strong choice of law provision in a website’s TOS that makes clear any and all cases or controversies arising out of the use of the website are to apply that state’s law will make it much more likely California law, and therefore CIPA, will not apply to a particular visitor’s use of your website. A court in Washington recently dismissed a CIPA case against Amazon because it found that Amazon’s conditions of use included a choice of law provision applying Washington law, the choice of law provision was broad enough to include the alleged conduct, and therefore rendered moot the lawsuit’s CIPA claim. See Heinz v. Amazon.com Inc., No. 2:23-CV-1073, 2024 WL 2091108 (W.D. Wash. May 8, 2024).
Include Disclaimers Regarding Data Tracking and Third-Party Software and Require Consent with a Clickwrap Agreement
TOS must include clear and conspicuous disclaimers about any data tracking policies or software employed on the website, with an option to “opt-out” of any such tracking. Obtaining a website user’s affirmative consent to data tracking can be fatal to CIPA claims, and if a website user “opts-out” of tracking, they do not have a CIPA claim regarding data tracking in the first instance. Even California companies may be able to defeat CIPA claims if they can show consent to the alleged “communications.” And courts have held that meaningful assent has been given to an online agreement when 1) the website provides reasonably conspicuous notice of the terms to which the consumer will be bound and 2) the consumer takes some action, such as clicking or checking a box, that unambiguously manifests his or her assent to those terms. Patrick v. Running Warehouse, LLC, 93 F.4th 468, 476 (9th Cir. 2024) (collecting cases).
These types of online agreements are known as “clickwrap agreements” – where an internet user accepts a website’s terms of use by clicking an “I agree” or “I accept” button, with a link to the agreement readily available. See Houtchens v. Google LLC, 649 F. Supp. 3d 933, 939 (N.D. Cal. 2023). Clickwrap agreements are generally enforceable while “browsewrap” agreements – agreements where the terms are typically disclosed only through a hyperlink and assent is manifested by continued use of the website – are not. See Berman v. Freedom Fin. Network, LLC, 30 F.4th 849, 856 (9th Cir. 2022). Therefore, to avoid any doubt concerning consent, companies must employ pop-up consent forms or “clickwrap” agreements which clearly describe the types of data tracking used by the website, clearly display a hyperlink to your TOS, require a website visitor to affirmatively click or check a box acknowledging consent to the TOS, and provide an option to “opt-out” of any data tracking.
Conclusion
If your company uses any type of data tracking on its website, updating your TOS with these strategies in mind is an optimal way to prevent your company from becoming the target of a mass arbitration alleging “eavesdropping” under CIPA. Failure to do so may result in your company facing hundreds of thousands or even millions of dollars in administrative fees.
[1] https://www.adr.org/sites/default/files/Consumer_Mass_Arbitration_and_Mediation_Fee_Schedule.pdf
[2] https://www.jamsadr.com/files/uploads/documents/massarbitrationprocedures-fs_4.29.24.pdf
[View source.]
