SSA Blog

The utilization of old laws to challenge modern technological practices presents growing concerns for online businesses, including storage operators with online platforms. Plaintiffs’ lawyers use these old laws to bring class action lawsuits against businesses that adopt new internet-based technology. Lawsuits have been filed in California against businesses for violation of the state’s Invasion of Privacy Act (CIPA), a law first enacted in 1965 and updated several times. Lawsuits alleging that replay software is an illegal wiretap in violation of the CIPA have not been as successful in California courts as plaintiffs hoped, but resourceful plaintiffs’ lawyers have found another section of the law that may prove more fruitful. For example, CIPA Section 638.51 states:

(a) Except as provided in subdivision (b), a person may not install or use a pen register or a trap and trace device without first obtaining a court order pursuant to Section 638.52 or 638.53.

The law has a number of exceptions, the most relevant to business websites being that the consent of the website
visitor has been obtained. What is a “pen register” or a “trap and trace” device? A pen register is a device that monitors numbers dialed from a telephone line. It does not record the contents of communications. The same is true of trap and trace devices, except these devices identify the originating number of calls to a telephone line. Trap and
trace describe what every mobile phone does with incoming calls. These laws were thought to apply only to a physical, electronic device attached to a phone line. Plaintiff lawyers have brought suits alleging that these laws are violated by businesses that use website software that can perform these prohibited functions. These lawsuits are in the early stages, and most courts that have reviewed complaints have dismissed such suits out of hand, but a few have concluded that the allegations state a plausible claim for violation of the law. The CIPA authorizes plaintiffs to collect $5,000 per violation. Websites that attract thousands of unique visitors could face enormous damages.

Visitor Consent

Until the courts determine if a law enacted before there was an internet applies to these new situations, self storage operators should discuss this issue with their website vendor. One solution is to make sure all website visitors consent to certain information being collected during their visit. A popup banner that alerts visitors that cell phone numbers or IP addresses may be captured while visiting the website should suffice.

It should be noted that at least one California court, in Licea v. Hickory Farms LLC, 23STCV26148 (L.A. Super. Ct., filed Oct. 25, 2023), has pointed out the absurdity of class action lawsuits brought under the CIPA. Judge Stephen Pfahler of the Los Angeles County Superior Court concluded that:

The court also finds public policy strongly disputes the Plaintiff’s potential interpretation of privacy laws as one rendering every single entity voluntarily visited by a potential plaintiff, thereby providing an IP address for purposes of connecting the website, as a violator. Such a broad-based interpretation would potentially disrupt a large swath of internet commerce without further refinement as the precise basis of liability, which the court declines to consider.