As The CIPA World Turns…

With what is becoming the regular cadence of a daily soap opera, the developments in what has become known as “CIPA law” continue to evolve quickly.

In the past couple of weeks, we have written on several instances that could impact the litigation posture for any company sued or threated to be sued in California for alleged violations of the both potential legislative action and action in the courts that might provide relief to businesses being sued or threatened to be sued for violations of the California Invasion of Privacy Act (CIPA).

Here’s a quick recap of our recent articles on CIPA:

1. CIPA Demands. Here is a quick breakdown on CIPA and how it is being used by plaintiff’s counsel to threaten or sue for violations of the law when websites use tracking technologies without prior consent of the visitor. 
2. Legislative Action. We previously wrote about California’s SB 690 which, if signed into law, will likely shut down a significant volume of no-harm litigation built on a statute designed for covert government surveillance, not analytics pixels on websites. 
3. Court Action. While courts remain split on whether CIPA applies to business websites, another court held CIPA does not apply to business websites in Blaker v. NetScout Systems, Inc.

This past week, the U.S District Court for the Central District of California issued an uncommon order declaring Vivek Shah, a serial pro se litigant, to be a “vexatious litigant.” What does that mean? The Court, in receipt of a filing from Mr. Shah in Shah v Crain Communications, stated that Shah’s approach and intent was not designed to seek relief in good faith and on the merits, but rather was used to harass defendants into coercive settlements. (Indeed, we have received dozens of such demands on behalf of many clients.) In short, the Court’s order requires Mr. Shah to get permission of the Court before he can file any new civil actions sounding in the Central District of California.

So, while this would appear to be significant development in favor of businesses trying to operate their websites and businesses without interference, it is important to enumerate the limits of this order.

1. The order does not prevent Mr. Shah from filing such suits. Indeed, it did not dismiss his case against Crain Communications. It merely provides some speed bumps that will likely limit the number of suits Mr. Shah might pursue. And nothing in the order stops Mr. Shah from sending his demand letters. 
2. The order is limited to the U.S. Direct Court for the Central District of California. It has no effect in other federal districts or state courts, or on any arbitration.
3. The order’s scope is limited to CIPA demands involving websites and related technologies. Mr. Shah is not restrained from filing other suits invoking other business practices or other laws. 
4. Naturally, the order is limited to Mr. Shah. It does not apply to other plaintiffs’ counsel that are likewise actively pursuing similar claims against businesses.

What Businesses Can Do

Although the order is a positive development in a series of them in recent months, nothing really changes as far as recommendations we have provided previously.

1. Website tracking technology inventory. Review your company website and make sure you have a full inventory of all data processing activity on that website, including tracking technologies that automatically collect data from a website visitor’s device and possibly share that information with a third party. Such technologies include cookies, pixels, session replay technology, and chat tools.
2. Review and update your website privacy policy. Ensure your privacy policy is current and not only discloses the use of such technologies but also meets applicable state privacy law(s).
3. Prior notice and consent. In addition to a proper privacy policy, you should consider providing any new visitor prior notice of your data processing activities, including tracking technologies. We recommend the use of a banner or pop up that provides advance notice of your processing activities and records a visitor’s acknowledgement of such technologies before they activate.