Hunton Retail Law Resource

Over the past few years, retailers and online businesses with California-accessible websites have been forced to grapple with the California Invasion of Privacy Act (CIPA)—a statute originally designed to protect telephonic communications but now frequently invoked by the plaintiffs’ bar in connection with online tracking technologies.  A recent decision by Judge Vince Chhabria of the Northern District of California—Doe v. Eating Recovery Center LLC (“ERC”)—highlights the urgent need for legislative clarity with respect to the application of CIPA to the internet.

In Doe v. ERC, the plaintiff claimed ERC’s use of Meta Pixel on its website allowed Meta to “intercept” her communications with ERC; thus, according to the plaintiff, ERC allegedly aided and abetted Meta’s violation of CIPA.  Judge Chhabria granted summary judgment on the CIPA claim, holding that CIPA’s prohibition on reading, attempting to read, or learning the contents of a communication while in transit or being sent did not apply to Meta’s post-receipt data processing.  The court found that:  (1) Meta’s automated filtering and logging did not constitute “reading” or “learning” the contents of any communication; and (2) such filtering and logging occurred after the communication had already traveled from the plaintiff to ERC’s website.  Accordingly, those activities fell outside the statute’s narrow “in transit” language.  Judge Chhabria emphasized that, as a penal statute, CIPA must be construed strictly, and any ambiguity should resolved in favor of the defendant.

Perhaps more notable, Judge Chhabria expressed his frustration with recent efforts to apply CIPA—a “statute [that] was not drafted with the internet in mind”—to online technologies.  In no uncertain terms, Judge Chhabria described the language of CIPA as a “total mess” and the state of affairs with CIPA as “untenable”: “Courts are issuing conflicting rules, and companies have no way of telling whether their online business activities will subject them to liability.” 

Judge Chhabria noted that the “mess gets bigger and bigger as the world continues to change and as courts are called upon to apply CIPA’s already-obtuse language to new technologies”—to the point where “it’s often borderline impossible to determine whether a defendant’s online conduct fits within the language of the statute.”  As many have decried, Judge Chhabria rightly observed that “California has since adopted other statutes that more clearly speak to the practice of data sharing”—namely, the California Consumer Privacy Act. 

Many businesses targeted by the plaintiffs’ bar would agree with Judge Chhabria’s conclusion that the “California Legislature needs to step up,” particularly given “CIPA imposes criminal liability and punitive civil penalties.” 

Notwithstanding Judge Chhabria’s clear call to action, the California Legislature has stalled efforts to bring the clarity and certainty needed.  Indeed, SB 690—a bill that passed unanimously in the California Senate that would update CIPA to address digital communications and modern tracking technologies—has stalled in the Assembly, where lawmakers recently decided to make it a two-year bill.  By deferring final action until at least the next legislative session, the Assembly has left courts and businesses in limbo, perpetuating the uncertainty spotlighted in Doe v. ERC.

What Does This Mean for Businesses?

• Short-Term Help:  Where the facts permit, Doe v. ERC provides a good defense to CIPA claims alleging interceptions of communications “in transit.”
• Long-Term Uncertainty:  Notwithstanding Judge Chhabria’s stated concerns, the Legislature’s delay on SB 690 means retailers must continue to monitor judicial developments and work to square the “conflicting rules” noted by Judge Chhabria.  
• Mitigation Strategies:  Businesses should continue to regularly review privacy disclosures, consent mechanisms, and tracking technology deployments.

In the end, Judge Chhabria’s ruling speaks directly to the concerns of businesses seeking clarity under CIPA.  While SB 690 would provide that clarity, the California Legislature’s decision to make SB 690 a two-year bill leaves the “total mess” that is CIPA in place even longer.