California Privacy Class Actions Target Website Analytics Tools

There has been a spate of claims against small website operators in recent years, claiming that the pixels, cookies, and other trackers implemented on their sites violate some state or federal “wiretap” or similar laws against illegally intercepting communications.  So far, these claims are being taken seriously by the courts, but have not produced much substantively for plaintiffs.  Some decisions by California courts late in the summer, however, may change that.  Several class actions filed in late September in California seek to capitalize.

WHY IT MATTERS

Many small website operators use tools or integration links provided by Google, TikTok, Meta, and other large companies.  Those companies can then gather information about the website's users, match it up with the information they already hold about those users, and thus improve their ability to target ads and other material to those users.  Often, these trackers are installed immediately upon a user's access to the site, before they can review a cookie banner or privacy policy.  The back-end trackers are what plaintiffs complain about as an illegal wiretap or similar interception device.  

The California decisions in late summer do two things: introduce confusion about what constitutes an illegal interception device, and weaken the defense that users consent to such tools via cookie banners or privacy policies.  

Small companies that integrate services or links from social media and other analytics providers can take measures to try to forestall such claims, including (1) updating privacy policies to disclose these practices, (2) using a third party to provide a “cookie banner” or other tool that allows users to configure and accept or reject cookies and trackers, and (3) configuring their websites to respond to “do not track,” Global Privacy Control, or other universal privacy signals.