Over the last several years, litigation (often class actions) premised on the use of technology like session-replay products, web beacons, pixels, and cookies has proliferated. Typical theories include plaintiffs claiming that data from their interactions with websites was gathered or recorded and was shared with third parties, in some cases allegedly used to create a consumer profile that can be monetized. The potential impact of these lawsuits is complex and far-reaching. The plaintiffs’ bar, for example, has previously targeted products that businesses use to comply with statutes like the Telephone Consumer Protection Act under the guise that those products allegedly violate statutes like the California Invasion of Privacy Act. In a recent appellate decision, Jones v. Bloomingdales.com, LLC, the Eighth Circuit has cast doubt over the merits of these lawsuits at the federal level.
The case originated when the plaintiff allegedly learned that two websites she visited permitted third parties to record her interactions using session-replay technology:
Jones alleges that she visited the companies’ websites and, unbeknownst to her, they employed “session replay” technology that allowed them to discern and record things like her “mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), search terms, URLs of web pages visited, as well as . . . what [she] searched for, what [she] looked at, the information [she] inputted, and what [she] clicked on.” She says that this technology compiles what “is essentially a video of [her] entire visit” . . . .[1]
Based on these allegations, the plaintiff brought several claims including for intrusion upon seclusion and under the Electronic Communications Privacy Act, Stored Communications Act, and Computer Fraud and Abuse Act.[2] Her claims were dismissed at the district court level, which the Eighth Circuit affirmed on the basis of a failure to allege a concrete injury supporting Article III standing.
The plaintiff’s theory, premised on a “harm to her privacy,” did not suffice because it was based on the alleged recording of non-sensitive information. Plaintiff “does not allege, for example, that session-replay technology captured her inputting and then deleting personal information like her social security number, medical history, bank account figures, or credit card information.”[3] In addition to finding that the allegations did not involve sensitive information, consent also supported the Court’s holding, given that the plaintiff “voluntarily conveyed the information she says is private to the defendants.”[4] Rather than an invasion of privacy, the “situation is akin to the commonplace use of a security camera at a brick-and-mortar store to record customers as they shop.”[5]
While Jones does not put to the rest the uptick in litigation tied to consumer interactions with websites, the common-sense result provides comfort to businesses’ continued use of session-replay and similar technology. In addition to keeping up with this legal space, businesses with an online presence should understand what technology is deployed on their website(s), how it is being deployed, and should consider measures to stave off litigation (like consent mechanisms and class action waivers coupled with arbitration clauses).
[View source.]
