Businesses operating public facing websites that employ data analytics software to track users’ website interactions must be aware of a novel use of the California Information Privacy Act (“CIPA”) that has taken the plaintiffs’ bar by storm. Specifically, class action complaints and demands have been filed in abundance under California Penal Code Section 631, California’s equivalent of the federal Wiretap Act (18 USC § 2511), which imposes fines and other penalties for wiretapping and eavesdropping. The spur in litigation is a result of an unpublished Ninth Circuit opinion finding that CIPA “applies to Internet communications.” Javier v. Assurance IQ, LLC, No. 20-CV-02860-CRB, 2023 WL 3933070 (N.D. Cal. June 9, 2023). Plaintiffs’ counsel argue that websites that incorporate third-party data analytics software are illegally aiding, agreeing with, employing, or conspiring with a third party to engage in “eavesdropping” activities.
Why the sudden surge in filings? CIPA imposes a $5,000 statutory penalty per violation. Cal. Penal Code Section 637.2. Businesses that have taken precautions against class actions by including mandatory arbitration provisions in their website’s terms of service/use are not immune from prosecution. Now, Plaintiffs’ counsel are threatening to file or filing these types of claims en masse in arbitration, in the hopes of forcing businesses to settle for a nominal value rather than face paying tens, hundreds, or even thousands of arbitration fees to defend against the claims.
Companies can prevent becoming a target by having well-drafted terms of service and privacy policies (hereinafter “TOS”). For businesses outside of California that operate public facing websites, it is imperative that your TOS are updated to protect against these exploitive claims. We recommend the following strategies when drafting TOS.
Reference the AAA/JAMS Mass Arbitration Rules
Make sure that your TOS specifically reference the new mass arbitration rules employed by AAA/JAMS to ensure the most favorable fee schedule will be applied to your arbitration. Generally, individual arbitration cases require defendants to pay upfront administrative fees for the arbitration, and in the consumer context businesses often pay the lion’s share of the total costs of arbitration. If a company is required to pay multiple fees at a time for identical cases, the costs can become prohibitive. For example, while upfront fees vary depending on the facts of each potential arbitration, assuming a company is required to pay an upfront administrative filing fee of $3,000 per arbitration, if 10 identical cases are filed, a company will be required to pay $30,000 in upfront administrative fees; if 100 identical cases are filed, that number jumps to $300,000; and if 1,000 identical cases are filed, a company will have to pay $3 million just in upfront administrative costs before even addressing the merits of a case.
To address these prohibitive upfront costs, AAA[1] and JAMS[2] have each recently published updated procedures pertaining to mass arbitration and fees schedules that cap administrative filing fees regardless of the number of cases in arbitration filed, with additional fees to be assessed at the merits phase. JAMS has set the initial filing fee for mass arbitrations at $7,500 and AAA has set its initial filing fee for mass arbitrations at $8,125. The JAMS updated procedures apply only when both parties to the arbitration agree to the updated procedures and the AAA updated procedures apply at AAA’s sole discretion. Therefore, specific references to the appropriate mass arbitration fee schedules in your TOS will greatly increase the likelihood they will be applied to your arbitration(s) and protect your company from potentially having to pay five- and six-figure upfront administrative filing fees in arbitration.
Include a Strong Choice of Law Provision
For businesses that are registered or incorporated outside of California or have a principal place of business outside of California, including a strong choice of law provision in your TOS that applies the state law of the state where the company is registered/incorporated or where the company has its principal place of business is essential. CIPA is a California state law and can only be applied where California law is applicable and therefore CIPA’s $5,000 per violation penalties can only be assessed where California law is applicable to a case or controversy. A strong choice of law provision in a website’s TOS that makes clear any and all cases or controversies arising out of the use of the website are to apply that state’s law will make it much more likely California law, and therefore CIPA, will not apply to a particular visitor’s use of your website. A court in Washington recently dismissed a CIPA case against Amazon because it found that Amazon’s conditions of use included a choice of law provision applying Washington law, the choice of law provision was broad enough to include the alleged conduct, and therefore rendered moot the lawsuit’s CIPA claim. See Heinz v. Amazon.com Inc., No. 2:23-CV-1073, 2024 WL 2091108 (W.D. Wash. May 8, 2024).
Include Disclaimers Regarding Data Tracking and Third-Party Software and Require Consent with a Clickwrap Agreement
TOS must include clear and conspicuous disclaimers about any data tracking policies or software employed on the website, with an option to “opt-out” of any such tracking. Obtaining a website user’s affirmative consent to data tracking can be fatal to CIPA claims, and if a website user “opts-out” of tracking, they do not have a CIPA claim regarding data tracking in the first instance. Even California companies may be able to defeat CIPA claims if they can show consent to the alleged “communications.” And courts have held that meaningful assent has been given to an online agreement when 1) the website provides reasonably conspicuous notice of the terms to which the consumer will be bound and 2) the consumer takes some action, such as clicking or checking a box, that unambiguously manifests his or her assent to those terms. Patrick v. Running Warehouse, LLC, 93 F.4th 468, 476 (9th Cir. 2024) (collecting cases).
These types of online agreements are known as “clickwrap agreements” – where an internet user accepts a website’s terms of use by clicking an “I agree” or “I accept” button, with a link to the agreement readily available. See Houtchens v. Google LLC, 649 F. Supp. 3d 933, 939 (N.D. Cal. 2023). Clickwrap agreements are generally enforceable while “browsewrap” agreements – agreements where the terms are typically disclosed only through a hyperlink and assent is manifested by continued use of the website – are not. See Berman v. Freedom Fin. Network, LLC, 30 F.4th 849, 856 (9th Cir. 2022). Therefore, to avoid any doubt concerning consent, companies must employ pop-up consent forms or “clickwrap” agreements which clearly describe the types of data tracking used by the website, clearly display a hyperlink to your TOS, require a website visitor to affirmatively click or check a box acknowledging consent to the TOS, and provide an option to “opt-out” of any data tracking.
Conclusion
If your company uses any type of data tracking on its website, updating your TOS with these strategies in mind is an optimal way to prevent your company from becoming the target of a mass arbitration alleging “eavesdropping” under CIPA. Failure to do so may result in your company facing hundreds of thousands or even millions of dollars in administrative fees.
——————————————————————–
This DarrowEverett Insight should not be construed as legal advice or a legal opinion on any specific facts or circumstances. This Insight is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. The contents are intended for general informational purposes only, and you are urged to consult your attorney concerning any particular situation and any specific legal question you may have. We are working diligently to remain well informed and up to date on information and advisements as they become available. As such, please reach out to us if you need help addressing any of the issues discussed in this Insight, or any other issues or concerns you may have relating to your business. We are ready to help guide you through these challenging times.
Unless expressly provided, this Insight does not constitute written tax advice as described in 31 C.F.R. §10, et seq. and is not intended or written by us to be used and/or relied on as written tax advice for any purpose including, without limitation, the marketing of any transaction addressed herein. Any U.S. federal tax advice rendered by DarrowEverett LLP shall be conspicuously labeled as such, shall include a discussion of all relevant facts and circumstances, as well as of any representations, statements, findings, or agreements (including projections, financial forecasts, or appraisals) upon which we rely, applicable to transactions discussed therein in compliance with 31 C.F.R. §10.37, shall relate the applicable law and authorities to the facts, and shall set forth any applicable limits on the use of such advice.
[1] https://www.adr.org/sites/default/files/Consumer_Mass_Arbitration_and_Mediation_Fee_Schedule.pdf
[2] https://www.jamsadr.com/files/uploads/documents/massarbitrationprocedures-fs_4.29.24.pdf
