There is a growing trend in which bad-faith litigants in California are filing suit against out-of-state entities based on alleged privacy violations committed by those entities’ websites. These cases arise under the California Invasion of Privacy Act (CIPA). Although it was first enacted to combat wiretapping, eavesdropping, and the recording of conversations, the CIPA has more recently been interpreted to cover website communications and data collection.
The theory behind this CIPA application is that when someone uses a website’s search function, that person is “speaking” to the site in a direct and confidential manner. By collecting the data from searches, websites are able to share these searches and other related information to third parties, which California courts have found to be in direct violation of the CIPA.
Even though the CIPA is a California state law, it affects companies across the nation. Courts have found that any communication that involves a California-based user is covered, to the point where someone accessing a website from a California IP address puts the website operator at risk. As these CIPA cases continue, out-of-state operators have routinely and successfully been sued. Each individual search query that is impermissibly shared can be counted as a distinct CIPA violation subject to a $2,500.00 fine. As a result, liability under the CIPA often adds up to tens or hundreds of thousands of dollars.
The best way to defend against CIPA actions is to establish the consent of the user to any data collection and dissemination before those activities occur. Such consent must also be given after a clear disclosure is made about what data is collected and how it is used. This defense is strongest where users are required to affirmatively provide their consent (such as by checking a box).
KDDK urges all website operators to revisit their privacy and data collection policies accordingly. If you have questions or would like more information about how CIPA may affect you, contact Lee M. Braun, Monica E. Edwards or a member of KDDK’s Intellectual Property and Technology practice.
