A recently filed class action offers a snapshot of the ongoing wave of lawsuits under the California Invasion of Privacy Act (CIPA) – something that has been a topic for a few years now. This latest case shows that CIPA continues to be a tool for plaintiffs’ law firms to pursue companies using online tracking tools. But why?
According to the complaint, Carvana, an online platform for buying used vehicles, allegedly installed third-party trackers on its website. These trackers then collected and sent users’ personal information (e.g., their IP addresses, browsing history, and the exact web pages they viewed), to outside companies. The plaintiffs argued that Carvana did this without giving users proper notice or getting their consent. This type of claim essentially attacks the way in which websites function and lies at the core of most plaintiffs’ CIPA claims. With each new CIPA lawsuit, plaintiffs attempt to enforce alleged obligations, using these old laws (like CIPA), often trying to hold companies to higher standards than what is in state “comprehensive” privacy laws.
Here, the complaint asserts that Carvana’s actions amount to illegal wiretapping, improper use of “pen register” technology, and an invasion of privacy. The plaintiff based their claim on the argument that people believe companies will not gather or sell “sensitive” browsing data, such as which cars they view, unless the company gets their consent first. As of right now, many state and federal courts have allowed these claims to proceed.
Putting it into Practice: This case demonstrates an ongoing trend for plaintiffs’ attorneys: using CIPA as a cudgel to elicit settlements from companies whose sites collect information through cookies and other tracking tools. The case can serve as a reminder to conduct cookie and consent audits if using website third-party tracking mechanisms.