United States: Privacy Protection

Dechert's Cyber Bits newsletter delivers biweekly updates on key developments in cybersecurity, privacy, and AI law. This issue covers FTC policy changes, European digital regulation, California's new online safety laws for minors, and emerging enforcement trends in cybersecurity compliance.

A California federal court dismissed claims under the Federal Wiretap Act and California Invasion of Privacy Act, ruling that plaintiffs failed to establish Article III standing when they could not prove their personal information was actually intercepted by third-party tracking technology on a retail website. The decision highlights the evidentiary burden plaintiffs must meet when alleging privacy violations through website tracking pixels and similar technologies.

It's only fitting that when something in Florida sparks interest, we're all over it. I'm back with a follow-up on the proposed Florida Anti-Spam Communications Act.

A federal court suggests that merely providing a phone number to a caller may constitute express consent under the TCPA for robocalls, potentially opening the door for widespread automated calling practices in the GenAI era. The ruling in Smith v. Examworks addresses whether consent must specifically authorize robocalls or if general consent to be called is sufficient, with significant implications for telemarketing compliance.

California has shut down one increasingly popular theory of website-tracking liability. With Governor Gavin Newsom’s signature, SB 690 amends the California Invasion of Privacy Act (“CIPA”) and eliminates the private right of action under Section 638.51 for pen-register and trap-and-trace claims involving websites, online applications, and mobile applications. Enforcement of Section 638.51 will now rest solely with the California Attorney General’s Office.

For three years, the California Invasion of Privacy Act has been the engine driving website-tracking litigation. If your company’s website runs Google Analytics, a Meta or TikTok pixel, a session-replay tool, or a live chat widget, you might have received a lawsuit or demand letter alleging these ordinary web tools amount to illegal “wiretapping” or “spyware.”

Recent developments in Delaware, California, and Texas highlight a common theme that privacy compliance risk is becoming more operational and technical and more likely to arise from practices that may once have appeared routine. (1) Delaware has expanded the reach and substantive requirements of its comprehensive privacy law; (2) California continues its focus on data brokers by bringing a Delete Act action against a data broker; and (3) the Texas Attorney General has warned businesses about a surge in CIPA website tracking demand letters.

A California court examines whether website publishers can be held liable when tracking cookies continue collecting user data after visitors explicitly opt out of non-essential cookies.

For many businesses, a mailing address is an operational detail. For small businesses that are primarily internet-based and operate remotely or without a brick-and-mortar location, a business address is often created at a co-working space or a mail drop. In trademark filings, however, the wrong address can delay examination, trigger an Office Action, increase costs, and put registration at risk. Recent enforcement of the USPTO’s domicile address requirement has made this a front-line filing issue for brand owners and their counsel.