Welcome back to our three-part series providing an overview of CIPA, recent CIPA class actions, and class action defenses. In Part I we provided an overview of CIPA and its recent resurgence in the age of smart speakers.  In Part II we highlighted recent class actions alleging CIPA violations involving the use of smart speakers. Here, we address potential defenses in response to a motion to certify a CIPA class.

Defenses to a CIPA Class Action

These recent lawsuits are good reminders of the real privacy concerns with new developing technologies.  Below is an overview of practice pointers and lessons learned from CIPA lawsuits if you are named in CIPA litigation.

Is the Named Plaintiff Representative, E.g. a Member of the Class He Seeks to Represent? 

Defendants facing a CIPA action should investigate whether the named plaintiff falls within the proposed class definition. In Reyes v. Educational Management Corporation, the plaintiff alleged that the defendant unlawfully recorded his and other class members’ cell phone conversations with defendant in violation of CIPA.[1] The district court certified a class of callers who were recorded by defendant without consent.[2] However, the district court did not decide whether the named plaintiff heard the warning that the call was being recorded, which, under state law, would constitute consent to recording.[3] For this reason, it was not clear that the named plaintiff was even a member of the class he sought to represent.[4] Accordingly, the Court of Appeals, vacated the district court’s order granting plaintiff’s motion for class certification noting that, “[b]ecause a class action cannot go forward without a named plaintiff, a putative class action lacking an appropriate named plaintiff should be dismissed.”[5]

Is the Putative Class Ascertainable? 

Because CIPA only protects individuals physically present in California at the time of the alleged violation, a company defending a CIPA class action should determine whether plaintiff has carried its burden in proving that it can be ascertained whether putative class members were physically present in the state. In Raffin v. Medicredit, the plaintiff alleged the defendant debt collector violated CIPA by calling her on her cell phone, making a recording of the call, and failing to disclose that the call was being recorded.[6] Based on these allegations, the plaintiff brought a CIPA putative class action on behalf of persons in California whose in-bound and out-bound telephone conversations were recorded without their consent.[7] The defendant successfully argued that the plaintiff had not met her burden in showing that it was possible to ascertain whether putative class members without a California area code were physically present in California at the time phone conversations were recorded by the defendant, a prerequisite for CIPA liability.[8] The court conceded that the plaintiff’s briefing focused exclusively on putative class members with California area codes, despite the fact that the proposed class definitions encompassed individuals who did not have California area codes at the time of the call.[9] Accordingly, the court narrowed the class definition to only those individuals with California area codes.[10]

As discussed above, we are seeing a new wave of CIPA class actions alleging that individuals have been unlawfully recorded by voice-activated smart devices without prior consent. These class actions define their putative classes to include not only those who purchased such devices but also individuals who did not purchase such devices and minors. At a minimum, defendants should challenge such class definitions on the grounds that individuals who neither purchased nor were the registered user of a voice-activated devices cannot be ascertained.

Is the Action is Barred by the Statute of Limitations?           

The statute of limitations for bringing a CIPA claim is short, just one year.[11] The statue begins to run when the plaintiff “knew or should have known of the defendant’s unlawful acts.”[12] In Brodsky v. Apple Inc., 2019 WL 4141936, at *11 (N.D. Cal. Aug. 30, 2019), the plaintiffs brought suit alleging that Apple’s two-factor authentication process violated CIPA and other laws.  The court found the plaintiff’s claims were time-barred and that neither the “continuous accrual doctrine,” “continuing violation doctrine”, nor the “delayed discovery rule” applied.

As recent CIPA class action litigation has shown, there are significant and inherent privacy risks surrounding voice-activated smart speakers. Defendants facing putative CIPA class actions should investigate whether the class is defined to only include putative class members who were present in California during the alleged violation and if the class is even ascertainable where the class is defined to include individuals who did not purchase the device in question, e.g. friends and relatives visiting the registered user’s house over a one-year period.

Does the Plaintiff Have Standing?

While a recent Northern District of California decision came out the other way, it is worth considering whether to raise an Article III Spokeo standing argument.  In Matera v. Google, the Northern District of California found the plaintiff had Article III standing without actual damages.[13] The plaintiff there had alleged that Google intercepted and stored the emails of non-Gmail users without their consent in violation of CIPA. Google challenged the action solely on the basis of standing on the grounds that the plaintiff failed to allege a concrete and particularized injury. Using the two-pronged analysis articulated in Spokeo[14] as its guide, the district court held that plaintiff had CIPA standing. Under the first prong—whether the statutory violation bears a close relationship to a traditionally recognized right,—the court reasoned that alleged statutory violation bears a “close relationship” to the common law right to privacy. Under the second prong—congressional judgment in establishing the statutory right—the court affirmed that “Congress is “well positioned to identify intangible harms that meet minimum Article III requirements.” The court was further persuaded by the fact that CIPA provides: (1) a private right of action, (2) statutory damages, and (3) substantive rather than procedural rights.

More information about CIPA, its recent resurgence in the age of smart speakers and recent class actions alleging CIPA violations involving the use of smart speakers can be found here and here. 

[1] Reyes v. Educ. Credit Mgmt. Corp., 322 F.R.D. 552, 557 (S.D. Cal. 2017), leave to appeal granted, No. 17-80199, 2017 WL 6762227 (9th Cir. Dec. 21, 2017), and vacated and remanded, 773 F. App’x 989 (9th Cir. 2019).

[2] Id. at 571.

[3] Reyes v. Educ. Credit Mgmt. Corp., 773 F. App’x 989 (9th Cir. 2019).

[4] Id. at 990.

[5] Id.

[6] Raffin v. Medicredit, Inc., 2017 WL 131745, at *1 (C.D. Cal. Jan. 3, 2017).

[7] Id. at 1.

[8] Id. at 3.

[9] Id.

[10] Id.

[11] Ion Equip. Corp. v. Nelson, 110 Cal. App. 3d 868, 880 (1980).

[12] Montalti v. Catanzariti, 191 Cal. App. 3d 96, 97–98, (Ct. App. 1987).

[13] Matera v. Google Inc., 2016 WL 5339806, at *1 (N.D. Cal. Sept. 23, 2016).

[14] Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016), as revised (May 24, 2016).