As readers of this blog know, companies continue to be targeted in lawsuits asserting California Invasion of Privacy Act (“CIPA”) tracking claims. The fact that California courts have struggled to determine whether CIPA applies to internet communications has only emboldened the plaintiffs’ bar to continue filing these CIPA tracking lawsuits. More recently, CIPA tracking claims have focused on a provision of the statute that prohibits the use of pen registers and trap and trace devices absent consent or a court order. Below, we discuss: (1) what pen registers and trap and trace devices are and the differences between them; (2) the types of CIPA tracking cases that are most pervasive at the moment; as well as (3) the continued viability of CIPA tracking claims.
Recent CIPA Tracking Claims Explained
Enacted in 1967, CIPA was drafted with the intended purpose of curbing law enforcement’s use of devices to record conversations without a court order or the consent of all parties to the conversation. With the evolution of technology, enterprising plaintiffs’ attorneys began asserting CIPA tracking claims, alleging that companies which employ third-party tracking tools, such as Meta Pixels and Google Analytics, on their consumer-facing websites constitutes the use of illegal pen registers or trap and trace devices in violation of CIPA.
CIPA defines a “pen register” as a “device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.” Conversely, CIPA defines a “trap and trace device” as a “device or process that captures the incoming electronic or other impulses that identify the originating number or other dialing, routing, addressing, or signaling information reasonably likely to identify the source of a wire or electronic communication, but not the contents of a communication.” Put simply, a pen register captures outgoing communications, while a trap and trace device captures incoming communications.
Initially, CIPA tracking lawsuits focused on CIPA’s wiretapping provisions. Fewer of these cases are being filed of late, as California courts have increasingly declined to afford these claims any traction. As a result, CIPA tracking claims now often focus on CIPA’s pen register and trap and trace device provisions. In the past, the terms pen register and trap and trace device were frequently used interchangeably. As CIPA tracking lawsuits have evolved, these claims now allege that companies using third-party tracking software on their consumer-facing websites are employing illegal trap and trace devices because the tracking tools allegedly capture consumers’ incoming internet communications.
Future of CIPA Tracking Claims
Noting the virtual impossibility California courts face in trying to apply CIPA’s statutory language to internet technologies, a California federal judge recently implored the Legislature to rewrite CIPA entirely. Unfortunately, a California Senate Bill that would have exempted tracking technologies used for “a commercial business purpose” from CIPA stalled out in committee and the earliest it could now be reconsidered, if at all, is 2026. As a result, CIPA tracking lawsuits, and the legal uncertainty that comes with them, will continue for the foreseeable future.
Given that CIPA allows for the recovery of: (1) $5,000 per violation; or (2) three times the amount of actual damages, if any; and (3) injunctive relief, these alleged violations, especially when they are brought on a class action basis, can be quite expensive. As such, companies should be overly cautious when using third-party tracking technologies on their websites.
If your company employs third-party tracking software on its consumer-facing website, determining whether you comply with CIPA, and other state privacy laws, requires hiring experienced counsel. The attorneys at Klein Moynihan Turco (“KMT”) have years of experience assisting companies with federal and state marketing and consumer data privacy law compliance. Importantly, the KMT litigation team has successfully defended numerous businesses in CIPA lawsuits and alternative dispute forums. If your company employs third-party tracking software or has been served with a CIPA-related demand, please email us at info@kleinmoynihan.com or call us at (212) 246-0900.
The material contained herein is provided for informational purposes only and is not legal advice nor is it a substitute for seeking legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.
Attorney Advertising
Photo by Mimi Thian on Unsplash
Similar Blog Posts:
Can’t Teach An Old Dog New CIPA Claim Tricks
