USA – WASHINGTON Trends and Developments Contributed by: Amy Weston, Eva Novick, Brian Esler and Lauren Fricke, Miller Nash LLP
Additionally, these cases rarely rely only on the MHM - DA and typically incorporate other causes of action. Another major trend is the rise of “dark pattern” liti - gation. Plaintiffs’ attorneys are successfully arguing that website designs and user interfaces that make it difficult to find privacy controls or that nudge users towards sharing data constitute unfair or deceptive practices under the CPA. Simply having a privacy notice is no longer a defence if the actual user expe - rience contradicts disclosures or hides consumer choices. • Examples of alleged “dark patterns”: buried con - sent buttons, pre-checked boxes for data sharing, confusing toggle switches, and requiring account creation to exercise data rights. • Implied consent challenges: businesses that claim “implied consent” from continued website use are losing cases, as courts demand clear, affirmative and unbundled consent for data collection and sharing. • Vendor liability: lawsuits increasingly name both the primary business and its third-party data proces - sors (such as analytics or marketing vendors), arguing shared responsibility for unlawful data flows. In parallel with the trends described above, businesses should expect expansive privacy litigation around AI- driven profiling and automated decision-making that leverage broad categories of “health data”, including purchase histories for supplements, fitness tracker outputs, symptom-related search queries, and well - ness app information, all of which are now routinely treated as protected. This expansion heightens dis - crimination and bias risk for businesses that deploy machine-learning models in marketing, personalisa - tion or eligibility determinations, because allegedly biased inferences or opaque data flows can be framed as unlawful “collection”, “sharing”, or “sale” of health data without clear, affirmative and unbundled con - sent. Implicit in the “dark patterns” litigation described above is the argument that confusing consent flows or buried controls render algorithmic processing non- transparent or deceptive. Litigants are increasingly targeting both the primary business and its analytics or marketing vendors under shared-responsibility the -
ories. Businesses should expect courts and regulators to assess the reasonableness of governance over AI tools (including vendor use of business data to train models) and to treat vendor practices as extensions of the business, reinforcing the need for contractual audit rights and alignment between disclosures and actual data flows. Businesses can further expect fallout from the 2026 Washington Supreme Court ruling in Brown v Old Navy (2:23-cv-00781-JHC) that advertisers cannot send emails that contain any false or misleading infor - mation in the email subject line. Brown expands the scope of Washington’s anti-spam law, the Commer - cial Electronic Mail Act (CEMA). CEMA was passed in 1998 to address the influx of unsolicited, deceptive or misleading commercial emails received by Wash - ington consumers. The court in Brown construed the law broadly, holding that it prohibits any false or mis- leading information in the subject line, even informa - tion that only misrepresents the commercial nature of the message such as “Today Only” or “Three Days Only” for a sale that in fact lasts longer than adver - tised. Washington businesses should exercise cau - tion when relying on their email marketing vendors to ensure compliance with anti-spam laws. Most vendors are familiar with the federal Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM), but CAN-SPAM does not pre-empt state laws that prohibit material falsity or deception in any portion of a commercial email. Businesses now face penalties of up to USD500 per violation or actual damages, whichever is greater, if their email subject line creates a false sense of urgency about discounts. As is the case elsewhere, the plaintiffs’ bar in Wash - ington is actively monitoring data breach reports, searching out affected individuals, and filing follow- on class action complaints. Evolving Washington case law has recognised potential common law duties to safeguard information, and that organisations that manage greater amounts of sensitive data have a cor - respondingly greater duty to safeguard that informa - tion. Organisations in particular sectors that are known to be targeted by data thieves (such as healthcare and education) may be particularly easy targets for plaintiff class action lawyers, since the evolving case law seems to assume that entities in those sectors
630 CHAMBERS.COM
Powered by FlippingBook