There is a new wave of lawsuits targeting online businesses, including adult websites. These suits involve the California Invasion of Privacy Act (CIPA), and they are becoming increasingly prevalent. In fact, three different clients of my law firm were recently served or threatened with CIPA lawsuits — all in the same week.
The problem is, plaintiffs and their lawyers seem to be going down lists of websites, so it’s hard to predict who will next be subject to this kind of lawsuit. The sensitivity of the information you handle could increase your exposure — for example, records of searches for particular sex acts — but in general, there is simply no way to know if you might become the next defendant.
It is also your duty to make sure third-party vendors aren’t tracking your users. Make sure to review your agreements with all third-party vendors, even those that provide trackers and analytics for free, like Google.
Since plaintiff lawyers are asking for settlement sums ranging from $10,000 to $50,000 to settle these actions, it makes sense to try to avoid these types of lawsuits by taking whatever preventative steps you can. This article will explain what CIPA is, the current status of CIPA lawsuits, and what you can do to head off such lawsuits and protect your business.
What is CIPA?
First enacted in 1967 and codified in sections 630-638 of the California penal code, CIPA prohibits improper monitoring of someone’s communications without their consent or a court order, such as by wiretapping, or using trap-and-trace devices or “pen registers.”
The term “pen register” formerly referred mainly to a device that records the numbers of outgoing calls dialed by a specific phone. According to some plaintiffs’ lawyers, however, it also refers to monitoring of internet communications and activity. Other attorneys, including me, do not agree with this interpretation.
Each CIPA violation comes with a penalty of $5,000, or three times the actual damages. Importantly, the law doesn’t only impact businesses based in California. Anyone in California can sue you for an alleged violation as long as your business interacts with California residents.
The Current Status of CIPA Lawsuits
Attorneys representing the plaintiffs in these CIPA suits contend that the websites they are suing are violating CIPA by planting trackers and cookies, and sharing information about site users, before obtaining those users’ permission.
Defense lawyers argue that since internet technology did not exist and had not been contemplated when the law was enacted in 1967, CIPA should not be applied to websites at all. They point out that even when California has amended CIPA over the past 20 years, it still didn’t add websites specifically, and that most information collected and shared is not private, damaging or embarrassing.
As of this writing, the question of whether CIPA applies to websites remains up in the air. Some courts have ruled that CIPA does not apply, while others have ruled that the law may apply and allowed lawsuits to proceed, setting up a potentially expensive path for defendants. Until a high enough court sets a binding precedent, the issue remains unsettled, so your outcome in court may depend on factors like who your trial judge is and where the lawsuit is filed.
What Protective Measures Should Adult Websites Take?
Although there is no surefire way to guarantee that you won’t be sued or threatened with a lawsuit, taking the following precautions will make it harder for plaintiffs to attack your business.
- Block all tracking until users consent to/accept tracking software like pixels, cookie trackers, browser fingerprinting, embedded scripts, web beacons, session reply tools, analytics, advertising trackers, chat widgets, AI support or analysis widgets and live chat widgets.
- Block all tracking until users accept your terms of use/terms of service, your privacy policy, and your cookies policy if different from your privacy policy. Provide hyperlinks to all those policies on the initial pop-up screen.
- If you don’t sell your users’ information to third parties, state this above the “accept” button. You might also explain that trackers and cookies are there to help make the website operate more smoothly and provide better and more customized services. This may earn more user buy-in and more “accepts.”
- If you find that you are not using the tracking tools that are in place, consider removing them. Unused trackers that are never viewed and rarely provide any benefit can still get you into trouble.
- Be sure to make “accept” and “decline” buttons equally visible.
- There must be deliberate, affirmative action by the user, such as checking an item and pressing a button. Posting passive language like “By continuing to browse or enter this website, you consent to our terms of use, privacy policy and other policies” is not good enough.
- Don’t hide important language within broader terms or policy documents. Use at least 12-point font and consider putting specific consent provisions in bold type.
If the above steps are too difficult or burdensome, consider blocking California visitors altogether.
Follow-Up and Proof
You did everything right. Now you must make sure to follow through on your stated policies.
When someone declines or doesn’t opt in, be certain you don’t continue to obtain any information. Don’t forget that users — and lawsuit filers — have access to reports that show what the website has shared and when.
Thorough follow-up will require technical audits of every tracking tool, cookies, etc. Perform these audits after every tech or policy update. It can be tempting to keep adding new online services and trackers, but this can get you into trouble if you add new services that record or share information before the opt-in.
Be ready to show proof of whether a particular user consented or declined, and what information can or cannot therefore be tracked, shared or saved. Keep a time-stamped log of consent interactions. Be able to prove in court what you did and didn’t do based on a user’s actions.
It is also your duty to make sure third-party vendors aren’t tracking your users. Make sure to review your agreements with all third-party vendors, even those that provide trackers and analytics for free, like Google and Meta. Confirm with them — in writing, if possible — that they aren’t tracking your users without the users having opted in, and make sure their actions also comply with your terms of use and other policies. Include all third-party search functionality suppliers and other vendors.
Potential Changes to CIPA
I am not alone in believing that CIPA is being abused by plaintiff lawyers. A bill to update the law has been passed by California’s Senate and is currently winding its way through the committee process in the state Assembly. SB 690, as it stands now, would narrow the scope of the law, so that only the state attorney general would be able to sue for CIPA violations. It would even be partially retroactive, applying to some pending claims.
Many organizations are backing SB 690 in order to protect businesses, but plaintiff lawyers and some privacy rights activists are aggressively fighting against the proposed legislation. If you are in California, contact your Assembly member. Urge them to support SB 690.
As I cautioned earlier, there is no 100% certain way to prevent your site from being threatened with a CIPA lawsuit. However, taking the proper steps as described above can help you avoid such a scenario, and defend yourself if a lawsuit does happen.
This article is not intended as legal advice and should not be relied upon as such, but only to present information and analysis to help guide businesses. The facts of any individual case can and do vary widely.
Nader “Nick” Zargarpour is a business lawyer with over 25 years of trial experience. His firm handles the writing, negotiating and enforcement of contracts, as well as partnership disputes and various other business litigation.
