As a spate of recent decisions makes clear, companies conducting e-commerce may be subject to liability under state wiretap laws for their use of software designed to track consumer behavior on their websites. 

Businesses employ various tools to understand and analyze consumer behavior.  “Session replay” software is one such tool; it allows a business to recreate a visitor’s activities on and interactions with its website as it occurred in real time.  The software can recreate a visitor’s mouse movements, clicks, scrolling, tapping, and other actions.  Companies use session replays to monitor customer behavior, improve customer experience, and study how visitors are interacting with their websites or apps.  Several class action complaints recently filed in California, Florida, and Pennsylvania challenge the legality of session replay software on the grounds that it constitutes impermissible “wiretapping.” 

As it concerns wiretapping, California, Florida, and Pennsylvania are all “two-party consent” states, meaning that all parties to a communication are required to consent before one can lawfully record the communication.  Plaintiffs have focused their filings in those three states both because they are “two-party consent” states and because their wiretapping statutes include a private cause of action, allowing plaintiffs to sue to recover monetary damages. 

Plaintiffs bring actions in these states alleging that the use of session replay software violates the relevant wiretapping statute because the software constitutes “recording” of communications without the plaintiffs’ consent.  Such actions first gained traction in California and have since expanded east to Florida and Pennsylvania.  Recent appellate court decisions in California and Pennsylvania have emboldened plaintiffs and increased the number of class actions being brought in those states, while a Florida district court decision has opened the door for similar suits brought on the basis of “live chat” recordings.

The Statutes

In California, plaintiffs bring their claims under the California Invasion of Privacy Act (“CIPA”), which provides that anyone who “reads, or attempts to read, or to learn the contents” of a communication “without the consent of all parties to the communication” is in violation of California law.¹  In Florida, plaintiffs bring their claims under the Florida Security of Communications Act (“FSCA”).²  The FSCA provides a cause of action against parties that intercept or use private communications without the speaker’s consent.  Plaintiffs in Pennsylvania bring their claims under Pennsylvania’s Wiretapping and Electronic Surveillance Control Act (“WESCA”), which imposes liability on a person who “intentionally intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept any wire, electronic or oral communication.”³  These statutes, while not identical, are similar in that they allow plaintiffs to bring suit by alleging (among other elements) that they have not consented to the use of session replay software. 

The Case Law

California

A recent Ninth Circuit decision has emboldened plaintiffs to bring session replay class actions under CIPA in California.  See Javier v. Assurance IQ, LLC et al. No. 21-16351 2022 WL 1744107 (9th Cir. May 31, 2022).  In Javier, the plaintiff brought a claim in the U.S. District Court for the Northern District of California alleging that a business’ use of session replay software violated CIPA.  He alleged that when he visited insurance websites to obtain a quote, the defendant companies used session replay software to record his activities on those websites.  The district court dismissed the plaintiff’s complaint for failure to state a claim.  

The Ninth Circuit reversed, concluding “that the California Supreme Court would interpret [the California wiretap statute] to require the prior consent of all parties to a communication.”⁴  The court remanded the case to the district court to consider whether, based on the complaint’s allegations, the plaintiff had impliedly consented to the data collection, and to consider the plaintiff’s other arguments that were not previously considered at the motion to dismiss stage. 

Relying on the Ninth Circuit’s decision in Javier, plaintiffs who allege that they did not consent to the use of session replay software are likely to survive a motion to dismiss in California.  Not surprisingly, Javier has led to a rise in session replay complaints citing to Javier in California federal courts.⁵ 

For more information concerning wiretapping class actions filed in California challenging session replay software and “live chat” website features, see a recent update written by our colleagues in California, entitled “New Wave of “Live Chat” and “Key Stroke” Wiretapping Class Actions Hits California Courts.”

Florida

Most of the session replay software cases brought in Florida federal district courts have been dismissed for failure to state a claim.⁶  In one recent case, the U.S. District Court for the Southern District of Florida dismissed a complaint, holding that the session replay software at issue did not record conversations in the manner contemplated under the FSCA.  Goldstein v. Costco Wholesale Corp., 559 F. Supp. 3d 1318 (S.D. Fla. 2021).  The court analogized the activities captured by session replay software to the activities captured by a security camera in a physical retail store.  The court relied on the plain language of the statute and found that session replay tracking did not fall under the purview of the FSCA.  Goldstein and similar decisions seemingly spelled the end of session replay cases under the FSCA.

However, another federal court in Florida reached a different conclusion with respect to  a FSCA claim challenging the use of a website’s “live chat” function.  See Makkinje v. Extra Space Storage, Inc., 8:21-CV-2234-WFJ-SPF, 2022 WL 80437 (M.D. Fla. Jan. 7, 2022).  In Makkinje, the plaintiff alleged that the “live chat” function on a storage company’s website, which was recorded by the company, violated the FSCA.  The court denied the defendant’s motion to dismiss, finding that the plaintiff alleged a plausible claim for relief under the FSCA.  In so doing, the court distinguished the complaint’s allegations from the previously dismissed session replay cases.  The court found that the case was distinguishable “because Defendant’s use of session replay software during [plaintiff’s] visit to its website recorded more than just her non-substantive browsing movements.”⁷  The court also noted, however, that the question of whether the FSCA applied to a website’s recording of its live chats could be resolved at summary judgment.  The Eleventh Circuit has not ruled on a session replay case, but the two district court cases are instructive.  In Florida, a suit under the FSCA challenging the use of live chat function is likely to survive a motion to dismiss while a suit challenging the use of session replay software is not.

Pennsylvania

The Third Circuit’s recent decision in Popa v. Harriet Carter Gifts, Inc., 45 F.4th 687 (3d Cir. 2022) has opened the door for plaintiffs to bring session replay software claims under WESCA.  The plaintiff visited Harriet Carter Gifts’ website on her smartphone and added a product to her cart.  Unbeknownst to the plaintiff, Harriet Carter Gifts was using session replay software to track her interactions on its website.  The plaintiff alleged that Harriet Carter Gifts (and a third-party marketing company) violated the WESCA by recording and intercepting her communications with Harriet Carter Gifts’ website.  The district court granted summary judgment in defendant’s favor.  Reversing that ruling, the Third Circuit found that the defendants’ use of session replay software constitutes an “interception” under WESCA, even though the interceptors (i.e., the defendants) were a direct party to the communication.

The Popa court also addressed a jurisdictional issue that was absent in the other cases discussed above.  More specifically, the court analyzed the question of whether interceptions occurring outside of Pennsylvania are covered under WESCA, given that the statute only applies to conduct occurring in Pennsylvania.  The court explained that if the interception occurred when the communications sent from the plaintiff’s browser reached the defendants’ servers in Virginia, WESCA would not apply because the interception would have occurred in Virginia.  On the other hand, if the interception occurred when the communications were sent from the plaintiff’s browser (located in Pennsylvania) to the defendants’ servers, WESCA would apply because the interception occurred in Pennsylvania.  In other words, the key distinction analyzed by Popa was whether the interception occurred when the communications were received (at the defendants’ servers in Virginia) or when the communications were sent (from the plaintiff’s browser in Pennsylvania).  The court left two questions for the district court to address on remand: (1) whether the interception occurred in Pennsylvania or Virginia, and (2) whether the plaintiff’s actions demonstrated implied consent to the recording of the communications.

The defendants in Popa filed a petition for panel rehearing and a petition for rehearing en banc., which were denied in relevant part, and the court issued a revised opinion on October 18, 2022 that affirmed its prior rulings.

Takeaways

A company conducting e-commerce activities nationally must ensure that its website policies and technologies comply with the wiretap laws of each state where its website is accessed.  Irrespective which state’s law applies, a plaintiff’s consent will preclude a claim under a wiretapping statute containing a two-party consent requirement.  To that end, companies should ensure that they effectively obtain the consumer’s consent to the use of such software and understand the laws governing such consent.

In California and Pennsylvania, plaintiffs bringing wiretapping claims based on session replay software are likely to survive a motion to dismiss if they allege that they did not provide consent to the use of session replay technology.  In Florida, courts are likely to dismiss such complaints.  As illustrated by recent cases in Florida, however, plaintiffs will continue to focus on other website technology (including live chat functionality) in an attempt to bring their claims within the fold of those states’ wiretapping statutes.  Consequently, companies should confirm that all of the various tools they use to interact with website visitors and to analyze their behavior comply with all arguably applicable wiretap laws.

1. Cal. Penal Code § 631.
2. Fla. Stat. § 934.01 et seq.
3. 18 Pa. Cons. Stat. § 5701 et seq.
4. Javier v. Assurance IQ, LLC, No. 21-16351, 2022 WL 1744107, at *2 (9th Cir. May 31, 2022).
5. See, e.g., Compl., Licea v. Old Navy, LLC, Case No. 5:22-cv-1413 (C.D. Cal. Aug. 10, 2022) (alleging wiretapping violations based on session replay software and citing to Javier).
6. See, e.g., Goldstein v. Costco Wholesale Corp., 559 F. Supp. 3d 1318 (S.D. Fla. 2021) (dismissed), Swiggum v. EAN Servs., LLC, No. 8:21-493, 2021 WL 3022735, at *2 (M.D. Fla. July 16, 2021) (dismissed).
7. Makkinje v. Extra Space Storage, Inc., 8:21-CV-2234-WFJ-SPF, 2022 WL 80437, at *1 (M.D. Fla. Jan. 7, 2022).