[co-author: Justin Stalberg, summer associates]

On May 31, the Ninth Circuit issued a memorandum disposition in Javier v. Assurance IQ, LLC, addressing two important questions in California: (1) whether a business can record user interactions on its website without their prior consent; and (2) whether obtaining a user’s retroactive consent sufficiently satisfies Section 631(a) of the California Invasion of Privacy Act (CIPA). Though the memorandum disposition is unpublished, it has important implications for businesses operating in California.

The case centered around Assurance’s practice of video recording users’ interactions with its website in real time through a product provided by ActiveProspect. Javier visited Assurance’s website to request an insurance quote, inputting his demographic information and medical history. Assurance recorded the interaction. At the end of this process, Javier clicked a “View My Quote” button that stated by clicking the button, he would agree to Assurance’s privacy policy, which included consent to record the interaction.

Javier filed a class-action complaint against Assurance and ActiveProspect in the Northern District of California. He alleged that the defendants violated Section 631(a) of CIPA because the defendants recorded him without his prior express consent. The district court granted the defendants’ motion to dismiss without leave to amend, holding that retroactive consent is valid under Section 631(a) and that Javier’s claims were defeated because he had retroactively consented to the conduct at issue by agreeing to Assurance’s privacy policy.

The Ninth Circuit reversed the district court’s decision. After analyzing various statutory provisions, the Court of Appeals determined that Section 631(a) of CIPA requires the prior consent of all parties to a communication before recording and that retroactive consent was insufficient. The Court of Appeals remanded the case to the district court for further proceedings.

Practically, the court’s opinion means that businesses operating in California should ensure they receive prior express consent before recording users’ interactions on their websites. Further, while the court did not reach an opinion about the validity of implied consent, businesses should err on the side of caution and assume that prior express consent is required before any recording begins.