California courts have experienced a surge in class action filings pursuant to the California Invasion of Privacy Act (“CIPA”), California Penal Code Sections 630 et seq., the California analogue to the federal Wiretapping Act.  These latest filings target the “live chat” functionalities commonly installed on customer facing websites.  This Article describes this latest wave of “wiretapping” class actions and provides guidance for website operators on steps to be taken now to minimize the risk of being targeted with such a lawsuit.

CIPA background

CIPA was enacted in 1967 to address a host of privacy concerns, including traditional forms of wiretapping, eavesdropping, and non-consensual telephone call recording.  For decades CIPA was rarely, if ever, applied in the class action context.  That all changed in the late 2000s.  A 2006 California Supreme Court opinion (Kearney v. Salomon Smith Barney, Inc., 39  Cal. 4th 95 (2006)) dramatically expanded CIPA’s geographic reach.  In addition, the plaintiffs’ bar also took note of the mandatory, “$5,000 per violation” civil penalty provision, which eliminates a key hurdle to class certification:  the need to prove causation, an actual injury, and compensatory damages, on an individual, plaintiff by plaintiff basis.

In the aftermath of Kearney, California courts saw a virtual onslaught of CIPA class action filings. That initial wave was brought under the call-recording provisions of CIPA Section 632 and 632.7, against business that recorded inbound or outbound telephone calls without the consent of the call participant.  In 2014, Dentons prevailed in the first class certification ruling to reach the California Court of Appeal (Hataishi v. First American Home Buyers Protection Corp., 223 Cal. App. 4th 1454 (Feb. 21, 2014).  The Hataishi Court affirmed the denial of plaintiff’s motion for class certification, agreeing with Dentons that individualized issues of “consent” would render class certification unmanageable.  The Hataishi opinion substantially stemmed the tide of Section 632/632.7 call recording filings and gave defendants significant leverage in settlement negotiations.

CIPA section 631’s “wiretapping” prohibition

This year has seen a new surge in CIPA class actions, this time under Section 631, titled “Wiretapping.”  In pertinent part, that Section makes it unlawful for any person to

1. “intentionally tap[], or make[] any unauthorized connection, . . . with any telegraph or telephone wire, line, cable,” or;
2. “willfully and without the consent of all parties to the communication, or in any unauthorized manner, read[], or attempt[] to read, or to learn the contents or meaning of any message, report, or communication while the same is in transit or passing over any wire, line, or cable, or is being sent from, or received at any place within this state.”

Unlike its federal counterpart, CIPA provides for a “$5,000 per violation” statutory penalty, with no requirement to prove actual damages.

In 2020, the Ninth Circuit directly addressed allegations of wiretapping in the context of website communications, albeit not involving chat communications.  See In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020).  In that action, Facebook users filed suit under both CIPA Section 631 and the federal Wiretapping Act, alleging that Facebook improperly used plug-ins to track logged-out users’ browsing histories when they visited third-party websites and then compiled the browsing histories into personal profiles that were sold to advertisers.  A key question was whether Facebook was a “party” to those communications and therefore covered by the “party exemption” from liability, which provides, in essence, that a party cannot “wiretap” its own  communications, such as customer communications with a company’s own website.

As a matter of first impression, the Ninth Circuit held that the simultaneous, unknown duplication and forwarding of so-called “GET requests” made to a third-party web page's server do not qualify for the “party exemption.”  The Facebook opinion emphasized two basic principles of wiretapping jurisprudence:  (1) that only third parties can “wiretap” communications, and not the actual parties to the communication; and (2) that to qualify as a wiretap, the “tap” must occur simultaneously, in real time (as opposed to the recording of a website communication that is only later transmitted to a third party).

Not long after the Ninth Circuit’s Facebook opinion, a series of Section 631 wiretapping class actions were filed, directed at the use of “session replay” software, which enables a company to record and visually play back a user’s session on its website.  Several of these “session replay” lawsuits were challenged at the pleading stage.  The resulting district court rulings confirmed that, under the “party exemption,” a website operator cannot be liable for “tapping its own wire” – i.e., tapping communications between customers and the company’s own website with “session replay” technology.  See, e.g., Graham v. Noom, Inc., 533 F. Supp. 3d 823, 831 (N.D. Cal. 2021).

However, one federal district court carved out an important exception to this principle.   In Saleh v. Nike, Inc., 562 F. Supp. 3d 503 (C.D. Cal. 2021), the district court held that, to the extent a third-party vendor (e.g., the provider of the session replay software) has simultaneous, real time access to a customer’s website communications, without the customer’s consent, that third-party vendor cannot avail itself of the “party exemption” rule.  Moreover, while the Saleh court confirmed that the website operator could not be directly liable for a Section 631 wiretapping violation, the court allowed a claim against the website operator to proceed under the theory that the operator was “aiding and abetting” the software vendor’s direct violation.  Id.  at 520-21.

The new wave of “live chat” class actions

Perhaps emboldened by the Saleh Court’s permissive treatment of aiding and abetting liability, in 2022 several plaintiff class action law firms began filing CIPA Section 631 lawsuits directed at the “live chat” feature prevalent on many customer-facing websites.  Like the “session replay” lawsuits, these actions allege that a third party vendor (the provider of the chat functionality) has simultaneous, real time access to the chat communications, without the website user’s knowledge or consent.  These lawsuits further allege that the website operator is “aiding and abetting” the third-party vendor’s Section 631 violation.

What this means for website operators

To the extent website operators incorporate “live chat” applications into their site, they should audit that functionality to determine whether, as if often the case, a third party vendor has simultaneous, real-time access to those chat communications.  If so, operators should ensure that this functionality is adequately disclosed up front to website users in a manner that qualifies as the user’s implied consent.  These disclosures should be conspicuous under federal and state standards, particularly given plaintiffs’ arguments that they may have used a website’s chat function prior to noticing – or affirmatively agreeing to – a website’s terms and conditions.  See, e.g., Johnson v. Blue Nile, Inc., 2021 WL 1312771, at *2 (N.D. Cal. Apr. 8, 2021).

If you or your company would like more information about CIPA, and how it may impact your operations, Dentons’ team of Privacy and Cybersecurity litigation and regulatory lawyers and professionals is ready to help. From data-mapping to cybersecurity risk assessments, our cross-practice team is well suited to provide guidance on compliance efforts or to assist with your litigation needs. With rare depth in this area, Dentons is well-equipped to hit the ground running.