Has your company received a CIPA demand letter or been sued in court or arbitration for alleged CIPA violations? If not, you are one of the lucky few. Plaintiffs’ firms and pro se individuals are sending demand letters and filing suit under California’s Invasion of Privacy Act (“CIPA”), Cal. Pen. Code §§ 630-638, based on your business website’s use of cookies.
Commonly thought to be part of normal website set-up and business activities, Plaintiffs are targeting websites’ use of non-essential cookies and other tracking technologies. Likely because there is generally no private cause of action under states’ data privacy laws, Plaintiffs have dug up an old statute from 1967 – CIPA – that applies to eavesdropping or wiretapping on communications without consent. CIPA also applies to “trap and trace” devices, which is using a device or process the captures incoming electronic impulses identifying the originating number or other dialing, routing, addressing, or signaling information.
In the present day, Plaintiffs are using CIPA to claim that cookies capturing and sharing website browser activity violates CIPA’s eavesdropping provisions. Regarding CIPA’s “trap and trace” provisions, Plaintiffs are claiming that identifying the devices that website visitors use to access websites violates CIPA.
There are a number of ways to tackle CIPA allegations, but after a particular CIPA demand or suit is resolved, there is the lingering threat of receiving additional alleged CIPA violations.
To reduce the risk of receiving – or continuing to receive – CIPA demand and suits, businesses should consider implementing certain changes to their website and governing documents. If your business and website is operating and doing business in the U.S., consider taking the following actions:
- Cookie Banner. Implementing a robust cookie banner can promote the business’s argument that website visitors consented to the use of cookies, which is a defense to CIPA claims. If your business’s website uses non-essential cookies, such as analytics and advertising cookies, your banner should inform website visitors that the website uses cookies, pixels, and other tracking technologies to enhance user experience, analyze site usage, and provide targeted advertising, including sharing information with third parties. Include on the banner that by accessing your website, users consent to your Privacy Policy and Terms of Use (which should be hyperlinks to the documents). Provide options for users to Accept All, Reject All, or customize Cookie Settings.
- Cookie Usage. Ensure that non-essential cookies do not “fire” or activate immediately upon visitors accessing the website. Instead, create a delay in firing the cookies until visitors have had an opportunity to make their cookie selections on the website banner.
- Privacy Policy. Include that by using your website, visitors consent to the website Privacy Policy. Ensure that the Privacy Policy discloses the use of cookies, pixels, and other tracking technologies for analytics, advertising, and any other applicable purposes. Include a disclosure that website cookies may collect information such as browser searches, device information, IP address, and any other information that is collected by the cookies used on the website. Clearly disclose that website visitors’ information and data may be shared with third parties.
- Terms of Use. Consider including a mandatory arbitration provision and class action waiver agreement in the website’s Terms of Use. Be sure that the scope of the arbitration provision is broad enough to include that the arbitrator shall resolve gateway issues of arbitrability. This can reduce the risk of class action lawsuits being filed in court.
These measures can help reduce the risk of your business being subjected to claims of CIPA violations, as well as alleged violations of similar state statutes and federal statutes.
[View source.]
