USA – CALIFORNIA Trends and Developments Contributed by: Christina M. Morgan and David M. Liu, Buchalter LLP
Businesses Operating in California Are Also Facing a Wave of Litigation Relating to the Use of Third- Party Cookies and Tracking Technologies The California Invasion of Privacy Act (CIPA) is a crimi - nal statute enacted in 1967. In addition to criminal liability, it creates a private right of action for acts such as wiretapping, eavesdropping, and the use of a pen register. Enterprising attorneys have taken this law and applied it to new, web-based technologies, such as third-party cookies. There are two primary theories. One, that the use of third-party cookies constitutes wiretapping, because the cookies read or attempt to read the contents of a communication between the website and its visi - tor without the visitor’s consent. Two, the cookies or tracking technologies are “pen registers” because they are devices or processes that record electronic communications. There is not uniform treatment of these claims by the courts. However, we are seeing more and more fed - eral courts allow these claims to proceed, while state courts tend to be more skeptical. CIPA imposes a fine of USD2,500 per violation. Typi - cally, these suits are brought by individual plaintiffs and seek damages of approximately USD30,000. However, there is a risk of a class action, which could expose businesses to significant liability. There have been several attempts by the legislature to limit these claims. Most recently, on 3 June 2025, the California Senate passed Senate Bill 690, which would create a “commercial business purpose” exception to CIPA. The bill is still active; it is in the committee process. Until this or a similar law is passed, many businesses are implementing new cookie practices, akin to the European standard, to reduce their risk of CIPA liability.
Disney did not have effective opt-out mechanisms. The opt-out toggle only applied the request to the specific streaming service the user was watching and often only the specific device being used. Webform opt-outs were not effective for embedded third-party tracking pixels. Global Privacy Control signals were only honored on the device used to make an opt-out request rather than on all user devices. Based on Disney and other recent settlements, user opt-outs appear to be a high priority for the Attorney General. The CPPA Also Implements and Enforces Laws Relating to Data Brokers A “data broker” is a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. Data brokers must register with the CPPA on or before 31 January of each year. Data brokers must register for California’s accessible deletion mechanism, referred to as “DROP” (Delete Requests and Opt-Out Platform). Data brokers must check the platform at least once every 45 days then: (i) process all requests, and (ii) direct all service provid - ers or contractors to delete the consumer’s personal information, as well. In addition, data brokers must make additional disclo - sures in their privacy policy. Namely, by 1 July 2026, data brokers must disclose: • the number of deletion requests received in the previous calendar year; • the number of requests complied with in the previ - ous calendar year; • the number of requests denied in the previous cal - endar year, along with the reason(s) for the denial; and • the median and mean number of days that it took to respond to requested received during the previ - ous calendar year. Further, starting on 1 January 2028, and every three years thereafter, data brokers must undergo an audit by an independent third party to determine compli - ance with the data broker statutes.
569 CHAMBERS.COM
Powered by FlippingBook