Compliance Stuff

If you were hoping the courts would offer clarity to the wave of California privacy litigation targeting website tracking technology, four decisions issued in just 10 days this April suggest you may be waiting a while . Four judges recently tackled nearly identical questions about whether the California Invasion of Privacy Act (CIPA) applies to the kind of third-party tracking tools that millions of websites use every day – and reached strikingly different conclusions. Here is what employers and businesses need to know about this eye-opening spate of rulings. The Core Legal Question At the heart of all four cases is the same statute:  CIPA’s pen register and trap and trace provisions . Plaintiffs across the country have been filing suit arguing that common website tools like session replay software, third-party advertising trackers, and analytics platforms constitute illegal “pen registers” or “trap and trace devices” under CIPA because they c apture information about website visi...

Several recent California state court decisions have thrown companies into a state of confusion about whether they can face claims under the California Invasion of Privacy Act (CIPA) for use of tracking technologies on websites and apps. In two cases, courts dismissed the claims without leave to amend, while a third case – sitting in the same courthouse as one of the first two – allowed the claim to proceed. The two helpful court decisions concluded that CIPA’s “trap and trace” provisions don’t extend to website analytics or similar internet tracking technologies. But the other troubling ruling went the opposite way and said that website cookies might qualify as pen registers or trap and trace devices . These rulings create uncertainty for businesses operating in California and raise many questions about best practices. This Insight will dive into the three cases and provide businesses with a game plan to manage this turbulent time. What Courts Have Decided? Schallert v. Palo Alto N...

A California bill aimed at curbing the explosion of lawsuits filed against businesses using common website tools like cookies, pixels, and session replay software has stalled out in the 2025 legislative session, meaning your business will remain vulnerable to the newest type of privacy litigation for at least the next year . Despite the Senate unanimously approving SB 690 just a month ago, the bill’s author announced on July 2 that it would be made into a “two-year bill” – meaning it will not advance further this year but may be taken up again in 2026. What does your business need to do to put yourself in the best position to defend against these California Invasion of Privacy Act (CIPA) wiretapping claims? CIPA’s Emergence as a Class Action Weapon CIPA was originally enacted in 1967 to combat traditional wiretapping and eavesdropping, primarily in the context of telephone communications. It was never designed to address the complexities of the digital age or regulate how businesses t...