Privacy: Plaintiffs’ Attorneys Test Theories To Bring Claims Against Companies Using Customer Data

After a surge in privacy class action lawsuits in 2024, San Francisco-based Crowell & Moring partner Kristin Madigan says she expects to see more of the same in the year ahead, as plaintiffs’ lawyers continue testing out new legal theories to bring claims against any company that collects, uses, or sells customer data.

A record number of data breaches has fueled much of the rise in privacy litigation and government scrutiny, as it has become all but inevitable that a company that has been a victim of a data breach involving customer data will also get hit with a class action lawsuit and government investigation, says Madigan, who is a member of the firm’s Litigation and Privacy and Cybersecurity groups.

But less conventional suits targeting how companies handle personal customer information and the role of consumer notice and choice—even in the absence of a data breach—are increasingly common as well, says Madigan, most notably under California’s Invasion of Privacy Act (CIPA), a Cold War-era wiretapping statute passed to protect citizens from eavesdropping on private conversations. Unlike the California Consumer Privacy Act (CCPA/CPRA), CIPA provides for a broad private right of action and statutory damages.

CIPA was enacted with telephone communications in mind in 1967, decades before the internet would become commonly used by businesses to interact with customers. Then in 2021, the plaintiff in Javier v. Assurance IQ claimed an insurance company and its software provider violated CIPA when it used session replay software to record his interactions with the company’s website as he sought an insurance quote.

A California district court quickly granted a motion to dismiss for failure to state a claim on the basis that the plaintiff had retroactively consented to the recording by agreeing to the company’s privacy policy. But the 9th Circuit reversed in an unpublished opinion on the grounds that the defendant started recording the plaintiff as soon as he began inputting his personal information and that prior consent was not obtained.

The suit was dismissed in 2023 after a court ruled that CIPA’s one-year statute of limitations had lapsed before the plaintiff filed suit. But by that time, the number of CIPA claims was already on the rise, and in 2024 there were hundreds of such cases filed in California, with plaintiffs targeting not just tech companies or firms that collect sensitive personal information but also defendants in every sector, from apparel retailers to fast-food chains.

Targeting Data Analytics and Tracking Tools

The range of website technology targeted in CIPA suits has expanded well beyond session replay software. Plaintiffs have argued that widely used third-party data analytics and tracking tools and even search bars on websites violate CIPA’s prohibition on the use of pen registers, which record outgoing phone numbers, including the date, time, and length of calls, and trap and trace devices, which record incoming phone numbers.

In Greenley v. Kochava, for example, the defendant offered a software development kit to application developers that allowed the defendant to obtain geolocation data of app users, which it then sold to clients for advertising purposes. The U.S. District Court for the Southern District of California rejected the defendant’s argument that app users consented to the information sharing when they downloaded the apps but never opted out of the location sharing, and it denied the motion to dismiss, saying the software could in fact qualify as a pen register. (The court granted a joint motion to voluntarily dismiss the case in mid-October 2024, as both parties said they were near a settlement.)

In another case that survived a defendant’s motion to dismiss, the U.S. District Court for the Central District of California found that the transmission to third parties of search terms entered by plaintiffs into the search bar of a website could violate CIPA.

Most recently, a plaintiff filed suit in the Northern District of California claiming that a customer service software company violated CIPA when it surreptitiously recorded consumers’ telephone conversations with its satellite TV-provider clients, then analyzed those conversations by using artificial intelligence to identify patterns and classify the data so their clients could “optimize the [consumers’] buying journey to drive more revenue.”