by Aidan Gross and Halyna Hnatkiv

From left to right: Aidan Gross and Halyna Hnatkiv (photos courtesy of Hunton Andrews Kurth LLP)

In the latest evolution of lawsuits challenging technologies that track website users, California class action plaintiffs have begun to file under a new theory—the pen register and trap and trace device theory under Section 638.51 of the California Invasion of Privacy Act (“CIPA”).

Over the last two years, courts have seen an influx of putative class action lawsuits targeting businesses with websites that utilize technology to track users’ website interactions. Most of the lawsuits have been filed in California under CIPA. These previous lawsuits alleged a violation of section 631 of CIPA, which protects against (1) intentional wiretapping of any telegraph or telephone wire, line or cable; (2) willfully and without the consent of all parties attempting to learn the contents of a communication in transit; and (3) attempting to use or communicate information obtained as a result of engaging in either activity. The statutory penalty is $5,000 per violation.

The cases have often failed at the motion to dismiss stage. Courts have dismissed some suits for lack of standing given the absence of a concrete injury. A number of courts have found that the information collected must in itself have a reasonable expectation of privacy. Plaintiffs are now trying their luck under the pen register and trap and trace theory. Continue reading →