Wiretapping Law Said to be Abused

Thousands of California businesses, nonprofit organizations, and public agencies are facing a surge of lawsuits from a small number of trial attorneys who are utilizing a 1967 wiretapping law to target standard website technologies. The legal actions allege that the use of everyday internet tools, such as website cookies and internet protocol address trackers, violates the California Invasion of Privacy Act.

In response, state lawmakers are considering Senate Bill 690, a measure designed to exempt routine commercial internet activities from the decades-old criminal statute and put an end to what proponents describe as a coordinated legal extortion scheme.

The California Invasion of Privacy Act, commonly referred to as CIPA, was enacted in 1967 to prevent the unauthorized eavesdropping and recording of landline telephone communications. The penal code includes prohibitions against wiretapping and the use of "pen registers" and "trap and trace" devices, which were originally physical instruments used by law enforcement to record outgoing and incoming phone numbers.

However, in recent years, a select group of law firms has advanced a novel legal theory in federal and state courts. The plaintiffs argue that the software code used by modern websites to track visitor analytics, serve targeted advertisements, or operate customer service chat features functions as illegal wiretapping or pen register devices.

Because CIPA requires all parties to consent to a recording, the attorneys argue that websites must obtain explicit, opt-in consent before collecting any data from a user.

The financial penalties for violating CIPA are severe, which has driven the rapid proliferation of these lawsuits. The statute allows plaintiffs to recover $5,000 in statutory damages for each violation. Under the legal theory driving the current wave of litigation, every individual visit to a website constitutes a separate violation.

For a website with even a modest amount of internet traffic, potential liability can quickly reach into the millions or billions of dollars. Rather than face the prospect of financial ruin in court, many businesses opt to settle the claims out of court. Demand letters sent by the plaintiffs' attorneys typically seek settlements ranging from $15,000 to $50,000.

The scope of the litigation across the state is extensive. According to testimony provided to the California State Assembly, nearly 4,000 lawsuits have been filed under this theory over the past two years.

Furthermore, for every formal lawsuit filed in court, defense attorneys estimate that 10 to 15 private demand letters or arbitration claims are sent to business owners, suggesting that 50,000 entities have been targeted.

The targets are not limited to large technology corporations. Lawsuits have been filed against local food banks, community hospitals, school districts, family-run retail operations, plumbers, and heating and air conditioning contractors.

Usama Kahf, a partner and co-chair of the privacy practice at the law firm Fisher Phillips, testified before the Assembly Standing Committee on Privacy and Consumer Protection that his firm alone has handled approximately 250 CIPA matters. Kahf noted that the litigation is primarily driven by a handful of law firms using repeat plaintiffs.

He testified that one serial plaintiff in particular, who previously spent seven years in federal prison for an extortion-related felony, has sent tens of thousands of automated demand letters seeking $15,000 settlements without any negotiation.

Kahf argued that the lawsuits do not protect consumers, as no individual suffers actual harm from the data collection, and over half a billion dollars has been diverted from California businesses to a small group of attorneys.

The legal strategy has heavily impacted the news media industry. Chris Argentieri, president of the Los Angeles Times, testified before the Assembly Standing Committee on Public Safety that his organization faced a CIPA class-action lawsuit that threatened the company's survival.

The plaintiffs alleged that the newspaper owed $5,000 for each of the millions of Internet Protocol addresses it collected annually for targeted advertising purposes. Jeff Glasser, general counsel for the Los Angeles Times, stated that the media company spent substantial sums fighting and eventually settling the lawsuit, despite believing it was in full compliance with state privacy regulations.

Argentieri warned that the cost of defending against such lawsuits could devastate the local news ecosystem in California, forcing publications to close their doors during times when the public relies on them for emergency information.

Senate Bill 690, authored by Senator Anna Caballero, seeks to halt the litigation by changing how CIPA applies to modern commerce. The legislation would amend the state penal code to exempt the processing of personal information for a "commercial business purpose" from CIPA's prohibitions against wiretapping, eavesdropping, and the use of pen registers.

By defining a commercial business purpose within the statute, the bill effectively draws a legislative line between the 1967 landline telephone law and the operations of the modern internet.

Proponents of the bill argue that online data privacy is already comprehensively regulated by the California Consumer Privacy Act, or CCPA, which was passed by the legislature in 2018 and expanded by voters at the ballot box in 2020. The CCPA requires businesses to disclose their data collection practices and gives consumers the right to opt out of the sale or sharing of their personal information.

Brandon Riley, a partner at the law firm Manatt, Phelps & Phillips, who has advised hundreds of companies on CCPA compliance, testified that the CCPA was explicitly designed to regulate the exact types of third-party website trackers currently being targeted by CIPA lawsuits.

Supporters argue that trial attorneys are intentionally bypassing the modern framework of the CCPA, which generally relies on the state attorney general and the California Privacy Protection Agency for enforcement, in favor of exploiting CIPA's lucrative private right of action for financial gain.

However, Senate Bill 690 faces strong opposition from privacy advocates, consumer protection groups, and civil rights organizations across the state. Opponents argue that exempting commercial business purposes from CIPA will strip Californians of their ability to hold technology companies accountable for invasive digital surveillance.

The Consumer Attorneys of California contend that the CCPA was intended to supplement, not replace, existing privacy laws. They argue that removing CIPA's private enforcement mechanism will grant technology companies and data brokers a blanket license to record and track user interactions for profit covertly.

Opponents point out that the bill's retroactive provisions would eliminate a host of ongoing privacy class actions based on past violations, effectively denying consumers legal redress for past harms.

Juana Chavez, representing the Dolores Huerta Foundation, testified that allowing technology companies to freely collect and sell sensitive data, such as physical locations and search histories, poses a direct threat to immigrant communities who federal immigration enforcement agencies may target.

Similarly, Lang Le, a policy advocate for Asian Americans Advancing Justice Southern California, testified that survivors of domestic violence and human trafficking rely on digital privacy to search for shelters and medical care safely.

Le argued that eliminating CIPA's protections could allow these private internet searches and location data to be tracked and shared without the user's knowledge, directly jeopardizing the physical safety of survivors and vulnerable populations.

Acknowledging the complexity of the issue and the validity of the privacy concerns raised by the opposition, Senator Caballero has agreed to convert Senate Bill 690 into a two-year bill. This procedural move pauses the legislation's progress in the assembly, allowing lawmakers additional time to negotiate with opposition groups and draft further amendments.

The stated goal of the upcoming legislative negotiations will be to strike a balance between ending the wave of lawsuits targeting small businesses and preserving strong legal protections against the unauthorized surveillance of California consumers.

For any inquiries or further information, please contact Jose Cervantes at JoseC.Press@pm.me