Duane Morris Takeaway:This week's episode of the Class Action Weekly Wire features Duane Morris partner Jerry Maatman and senior associate Hayley Ryan with their discussion of two major rulings issued by Illinois federal courts addressing privacy claims aimed at companies utilizing advertising technology ("adtech") and education technology ("edtech").
Check out today's episode and subscribe to our show from your preferred podcast platform: Spotify, Amazon Music, Apple Podcasts, Samsung Podcasts, Podcast Index, Tune In, Listen Notes, iHeartRadio, Deezer, and YouTube.
Episode Transcript
Jerry Maatman: Thank you, loyal blog readers and listeners, for being here again for our next episode of our weekly podcast series entitled The Class Action Weekly Wire. I'm Jerry Maatman, a partner with Duane Morris, and joining me today for the first time is our senior associate, Hayley Ryan. Thanks so much for being on the podcast today.
Hayley Ryan: Great to be here, Jerry. Thanks for having me.
Jerry: Today, we're diving into two major decisions out of the Northern and Central Districts of Illinois that are making waves in the adtech or internet-based technology litigation space. Let's start with the basics. The two decisions came down on August 20 – Hannant v. Sarah D. Culbertson Memorial Hospital and Q.J. v. Powerschool Holdings. What's the big picture here?
Hayley: These are both part of a much broader wave of class actions we've seen across the country involving adtech and edtech – things like the Meta Pixel, Google Analytics, and Heap Autocapture. These tools track user interactions on websites. The central claim in both actions is that these tools intercept users' communications without consent and transmit them to third parties like Meta or Heap in violation of the Electronic Communications Privacy Act, or ECPA.
Jerry: Right, and that ECPA claim carries some serious weight and is worth a considerable amount of money because the potential statutory damages are $10,000 per user per violation. That's pretty significant when you add up what occurs in a class action.
Hayley: Exactly. When you're talking about websites with hundreds of thousands of visitors, those numbers add up fast. And while most of these lawsuits have targeted healthcare providers, we're now seeing claims against education platforms, retailers, and more.
Jerry: So, let's break down the rulings, and let's start with the Hannant case. What happened here?
Hayley: So, in Hannant, the plaintiff sued a hospital, claiming that by embedding the Meta Pixel on its site, the hospital sent Meta a duplicate of her web-browsing data without her consent. Judge Sara Darrow dismissed the ECPA claim, but importantly, she allowed the plaintiff to re-plead. The court said the plaintiff might be able to survive dismissal by adding details about how the alleged data sharing violated HIPAA, which would support a claim that the hospital acted with a criminal or tortious purpose, which is a key requirement under the ECPA exception.
Jerry: And what about the Powerschool decision in terms of the court going the other way?
Hayley: Yes. In that case, the plaintiff sued the Chicago school board and its edtech provider over their use of a third-party tool called Heap Autocapture. Judge Jorge Alonzo denied the motion to dismiss, finding that the plaintiff had plausibly alleged violations of ISSRA, which stands for the Illinois School Student Records Act, and FERPA, which is the Federal education privacy statute. Both decisions leaned on plaintiff-friendly precedent from the Northern District of Illinois, but in Hannant, the court wanted more detail to support the theory of a criminal or tortious purpose. In Q.J., the court was satisfied that the allegations, as pleaded, crossed the threshold.
Jerry: Let's talk about the implications of these two opinions. These are just two of hundreds of similar claims, but what are these rulings signaling to corporate counsel?
Hayley: We're seeing a clear trend. Illinois federal courts are becoming outliers, more willing to let these ECPA claims proceed than courts in other jurisdictions. In most other states, courts are dismissing ECPA claims at the pleading stage, finding either no true interception or no criminal/tortious purpose when the use was for advertising or analytics.
Jerry: So, for companies operating in Illinois, is the big picture that pixels and cookies aren't just marketing tools anymore, but can constitute legal landmines?
Hayley: Absolutely, Jerry. These decisions are making Illinois a hotbed for ECPA class actions. And while the Seventh Circuit hasn't ruled on these issues yet, defendants need to preserve arguments now for a potential appeal later.
Jerry: So, if you're a corporate counsel, what's the big picture here in terms of things you should be doing to mitigate your risks?
Hayley: So there's three key steps. Review your arbitration clauses, as making them airtight can help deter class actions or mitigate the risk of mass arbitration. Update your website privacy policies, terms of use, and vendor agreements. Audit your use of adtech and edtech tools – know what data is being collected, where it's going, and whether it's encrypted, anonymized, or otherwise protected.
Jerry: And I suppose the other issue is you're dealing with a patchwork quilt of rulings, decisions going one way in Illinois and other ways in other jurisdictions. So, what's a corporate counsel to do in the greater scheme of things?
Hayley: In other jurisdictions, defendants are still winning on motions to dismiss by arguing there's no interception, or that there's no criminal or tortious intent, when the purpose is legitimate business analytics.
Jerry: Seems to me the big takeaway, then, is that companies operating in Illinois need to be vigilant in compliance with these laws. So, Hayley, thanks so much for your thought leadership and for joining us for your maiden voyage on our podcast. Appreciate your expertise and your views of these two significant rulings. And for our listeners, please subscribe to our blog posts and sites, and listen in on our weekly podcasts. Thanks so much for being here.
Hayley: Thanks for having me on the podcast, and thanks to the listeners for being here.
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.
