Readers may recall our recent article discussing a new trend in California Invasion of Privacy Act (“CIPA”) litigation in which enterprising plaintiffs’ attorneys have brought CIPA allegations against companies that use tracking software on their websites. This latest wave of CIPA litigation focuses on CIPA’s definition of “pen registers” and “trap and trace devices,” devices that law enforcement has historically utilized to capture outgoing and incoming telecommunications signaling, respectively. With the evolution of technology, however, plaintiffs’ attorneys now are claiming that certain tracking software that captures user interactions on business websites falls within CIPA’s definition of what constitutes a “pen register” or “trap and trace device.” Absent certain exceptions, including user consent and/or Privacy Policy disclosures, tracking software that could be construed as a “pen register” or “trap and trace device” may be actionable under CIPA. Against this backdrop, if you receive a formal demand letter or are named in a CIPA lawsuit alleging that your business violated CIPA, the initial steps you take are critical.
Initial Steps To Take If You Receive a Demand Letter or Are Named in a CIPA Lawsuit
First, take a deep breath, step back and do not panic. Receiving a demand letter or lawsuit does not mean that you have necessarily done anything which could expose your business to liability under CIPA.
Second, preserve all documents. As tempting as it might be to create, alter or destroy documents, it is nearly impossible to conceal this fact during the discovery portion of the litigation. Furthermore, if document tampering or spoliation is uncovered, it will create only more problems for your business.
Third, contact experienced counsel immediately. Oftentimes, plaintiffs’ attorneys send demand letters or bring CIPA lawsuits in an effort to shakedown businesses to extract a quick settlement. Experienced Internet counsel can (1) help determine whether the tracking software your business uses falls within the definition of a “pen register” or a “trap and trace device;” and (2) provide your business with several defenses in responding to a CIPA demand letter or lawsuit. If a CIPA lawsuit has been commenced, the goal is to get an expeditious and cost-effective resolution in the least painful manner. If the resolution involves a written settlement, it is critical that the injunctive provisions be narrowly-tailored to allow your business to continue operating lawfully, while contemplating future compliance as technologies, business models and interests evolve. Unfortunately, there are a litany of examples of attorneys who, either employed the wrong tactics or lacked relevant industry knowledge, and turned winnable cases into tortuous and costly nightmares.
Lastly, the best way to avoid a CIPA lawsuit is never to receive one. Retaining knowledgeable and experienced attorneys in the areas of Internet marketing practices and consumer privacy could save you substantial time, money and peace of mind.
[View source.]
