Privacy developments-legislation, enforcement, and litigation in the U.S.-are heating up along with temperatures this summer. The past year brought a slew of website "invasion of privacy" litigation in which putative class representative and individual plaintiffs relied on wiretapping statutes and the Video Privacy Protection Act to pursue claims against companies deploying session replay and pixel software to assist in data analysis and ad targeting on their websites. Now there is another technology in the crosshairs: lead generation software.
Website lead generation software generates "actionable" lead data on users who visit websites, and there are a handful of software companies competing for the market in this space.1 Lead generation software complaints typically allege that the website owner is using the software to "deanonymize" or "dox"2 its website visitors by leveraging cookies that obtain information such as name, I.P. address, LinkedIn profile, and email address.3
Like the initial wave of website invasion of privacy lawsuits related to pixels and pixels and session replay software, plaintiffs in the lead generation wave of cases typically rely on state laws that provide for statutory damages, such as the California Invasion of Privacy Act (CIPA). CIPA is California's state wiretapping law, which plaintiffs typically claim is not limited to phone lines but rather extends to "newer technologies such as computers, the Internet, and email."
Plaintiffs are also claiming that lead generation software violates California's unfair competition statute or can give rise to a claim for unjust enrichment. Some even go so far as to allege that lead generation software violates the California Unauthorized Access to Computer Data Act (CUACDA), which the legislature intended to address hacking and other cybercrimes.5 Under CUACDA, "the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation . may bring a civil action against the violator for compensatory damages and injunctive relief or other equitable relief." Attorney's fees are also permitted under the statute.
Companies using this type of software should be aware of this trend and consider consulting counsel to explore mitigating measures-e.g., public-facing privacy statement disclosures and methods of obtaining user consent-and to ensure compliance with applicable privacy laws.
Footnotes
1. Munoz v. I.P.S. Group, Case No. 30-2023-01337861-CU-CR-WJC (Superior Court of California, County of Orange).
2. Google's Oxford Language Dictionary defines "dox": "search for and publish private or identifying information about (a particular individual) on the internet, typically with malicious intent."
3. Munoz v. I.P.S. Group, Case No. 30-2023-01337861-CU-CR-WJC (Superior Court of California, County of Orange).
4. Munoz v. I.P.S. Group, Case No. 30-2023-01337861-CU-CR-WJC (Superior Court of California, County of Orange).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.