Duane Morris Class Action Review - 2023 - Report - Page 28
The Illinois Supreme Court likely will rule on these key BIPA matters in the early part of
2023 and the statute will continue to drive class action litigation. Its technical
requirements, combined with stiff statutory penalties and fee-shifting, provide a recipe
for attention from the plaintiff’s class action bar, and companies’ continued development
and use of innovative technologies are apt to provide a veritable barrel of opportunity.
B.
Class Action Suits Alleging Wiretapping Violations
A new wave of class action lawsuits filed in California, Florida, Massachusetts, and
Pennsylvania targeted companies that use technologies to track user activity on their
websites, based on the theory that such practices violate electronic interception
provisions of various state laws when done without consent.
The plaintiffs’ bar grounded these claims in the electronic interception provisions of
various state laws. Wiretap statutes like the California Invasion of Privacy Act, the
Pennsylvania Wiretapping and Electronic Surveillance Act, and the Florida Security of
Communications Act generally prohibit the unauthorized interception or disclosure of
communications transmitted electronically.
The plaintiffs’ bar targeted technologies that track a user’s interactions with the website
(e.g., clicking, scrolling, swiping, hovering and typing) and create a recording of those
interactions and inputs – known as session replay software. They also attacked coding
tools that create and store transcripts of conversations with users in a website’s chat
feature. The plaintiffs in this new string of class actions allege that recording their
interactions with a website and sending that recording to a third party for analysis
without their consent is an illegal invasion of their privacy.
Recent decisions from the Ninth and Third Circuits fueled the swell of lawsuits alleging
violations of these wiretap statutes. In May 2022, in Javier, et al. v. Assurance IQ, LLC,
2022 U.S. App. LEXIS 14951 (9th Cir. May 31, 2022), the Ninth Circuit held that the
California Invasion of Privacy Act requires prior consent and explicitly rejected the
argument that this wiretap statute allows a business to obtain consent to the use of
session replay software after the recording already has begun. The Ninth Circuit,
however, did not comment on what would amount to effective consent to the use of
session reply software under the wiretap statute. A few months later, the Third Circuit in
Popa, et al. v. Harriet Carter Gifts, 2022 U.S. App. LEXIS 22707 (3d Cir. Aug. 16, 2022),
ruled that an electronic interception violating the Pennsylvania Wiretapping and
Electronic Surveillance Act occurred when the plaintiff visited a website to purchase a
product and her interactions on that site were recorded and transmitted to a third-party
marketing firm. The Third Circuit concluded that the location of the interception was
plaintiff’s browser, and it rejected the defendants’ argument that the wiretap statute did
not apply because the third-party marketing firm’s servers - where the information was
sent - were located in Virginia. If other circuits follow the Third Circuit’s approach, it
could subject companies to liability under a state wiretap statute each time a user
accesses its website from that state.
27
© Duane Morris LLP 2023
Duane Morris Class Action Review – 2023