DISCLAIMER! I AM NOT A LAWYER.
I am a website designer and developer producing this article in good faith to help small businesses and website owners understand, defend against and fight these anti-small business lawsuits. Do not take or use any of this article as legal advice. They are opinions and compiled resources from various legal websites to provide you with better knowledge surrounding these cases.
Table of Contents
Resources for your legal teams
Navigating CIPA: Recent Court Decisions and Potential Legislative Reform
https://www.cdflaborlaw.com/blog/navigating-cipa-recent-court-decisions-and-potential-legislative-reform
California’s Invasion of Privacy Act: A New Frontier for Website Tracking Litigation
https://www.americanbar.org/groups/business_law/resources/business-law-today/2024-august/californias-invasion-privacy-act/
California State Court Holds That A Concrete Injury-In-Fact Is Required To Bring Claims Under CIPA
https://www.insideclassactions.com/2024/09/10/california-state-court-holds-that-a-concrete-injury-in-fact-is-required-to-bring-claims-under-cipa/
SB 690: A Potential Pause in CIPA Litigation
https://calawyers.org/privacy-law/sb-690-a-potential-pause-in-cipa-litigation/
WORK IN PROGRESS:
MORE UPDATES AND INFORMATION COMING SOON!
This article is a work in progress. I will be adding information over the course of a few days as I can.
Please refer back to this article as I fill it with everything you need to know!
Please also send this to all the other local businesses you know to help everyone protect against these fraudulent and evil tactics against small businesses.
Introduction
In the past six months, website lawsuits have been surging through the roof with over 5,000 of them being filed against businesses targeting their website tracking technology and claiming violations of the CIPA (California Invasion Privacy Act).
This is a major concern as violations of CIPA carry a penalty of $5,000 for every violation. If successfully applied, this would stack a $5,000 penalty for EVERY website visit and visitor, with no limit to the amount of damages they may claim and sue you for. This opens the potential for a class action lawsuit.
You can see how clearly damages can stack up and the nature of these lawsuits. They have the ability to completely bankrupt a business. Even worse, they specifically target small businesses who do not have the resources to fight these suits.
Understanding the California Invasion Privacy Act (CIPA)
The laws have NOT kept up with technology
This results in a ton of old, outdated laws that can be misconstrued and apply to situations that never existed or were never meant to be applied to.
CIPA: Not the official law on privacy, tracking and data processing
They use the California Invasion of Privacy Act, which has nothing to do with websites. It was originally created regarding wiretapping, in a time before websites and tracking technologies existed at the level they do today.
However, the language used in the law is broad allowing it’s interpretation to be bent and manipulated by predatory lawyers. These lawyers are attempting to bend CIPA to apply to website tracking technology to win their case.
CCPA & CPRA: The official laws for privacy, tracking and data processing in California
The official laws for privacy and data concerns, specifically in California, are the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). These two laws govern privacy, tracking and data processing in California.
They are the strictest regarding online privacy compared to the majority of states who have not passed any laws regarding privacy online in the United States.
These two laws only apply based on a specific set of thresholds that a business MUST meet for them to apply:
- Annual Gross Revenue: Has annual gross revenues exceeding $26,625,000 (adjusted for inflation from the original $25 million, effective January 1, 2025).
- Data Volume: Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more California consumers or households (the CPRA raised this from 50,000 and removed “devices” from the threshold).
- Revenue Source: Derives 50% or more of its annual revenue from selling or sharing consumers’ personal information (the CPRA explicitly added “sharing” for cross-context behavioral advertising).
- Does not apply to nonprofits
Source: California Civil Code Section 1798.140(d)
How these malicious, CIPA lawsuits work
Demand for jury trials
The general public lacks any of the technical knowledge to understand what’s going on. This fact is highly manipulated and taken advantage of in these technology lawsuits.
They aim to sway the general public using emotional appeals, rather than logical information grounded in a true understanding of the technology and uses for it.
These law firms will pretend to be on the public’s side and argue from a “privacy” point of view. As if they are the defenders and protectors of privacy. Who doesn’t want privacy?
However, if they were concerned about privacy, they’d sue with CCPA or CPRA
The dangers
CIPA lawsuits carry a $5,000 penalty PER violation. A violation counts for each visitor, each time they visit, allowing the lawsuit to snowball into a class action lawsuit.
What they want from you
They want settlement money. It’s a racket to give them money so they’ll stop bothering you. A shakedown if you will.
The known players
These malicious suits aren’t practiced by all lawyers. There is a specific set of lawyers and firms who are the only ones taking these legal actions. They take advantage of small business owners who don’t have the knowledge or resources to fight them on it. Driving some even into bankruptcy.
It’s an evil, malicious, wicked and ANTI-BUSINESS tactic. Evil by all moral standards.
Here is a list of the known law firms and lawyers filing CIPA lawsuits:
- Mou Law PC – Yao Mou – State Bar No. 322659
- Swigart Law Group
- Kazerouni Law Group
Fighting and defending against a CIPA website lawsuit
There are a few defenses against this claim:
The technology itself
Tracking technologies such as Google Analytics have specific data processing agreement. Google also anonymizes tracking information which makes it indistinguishable from.
The vast majority of tracking on websites is used for statistical purposes. The actual data itself is less about the individual person but about providing insights to the website owner to help them serve their visitors better. Information such as how the visitor found them, what pages they visit, what pages they leave, what marketing efforts are effective, etc.
Plaintiff must prove intent
Notably, a key California court ruling which asserts that claims MUST prove the intent to access and read “intercepted” data in the moment, as a wiretap would do. That they MUST prove the business or organization willfully and specifically accessed data in real time to eavesdrop.
Proposed Senate Bill 690
Senate Bill 690 is also a new forefront to help prevent these lawsuits.
Superior Court rules there must be a “concrete injury-in-fact” rather than abstract
A California Superior Court decision, Rodriguez v. Fountain9, Inc., 2024 WL 3886811, at *4 (Cal. Super. July 9, 2024), confirmed that a plaintiff cannot satisfy this statutory standing requirement unless the plaintiff alleges “a concrete injury-in-fact.”
How to protect against these lawsuits
The surest way to protect against these lawsuits is a strong privacy policy, opt-in preferences, disclaimers and legal jargon present and relevant to your website and practices. In addition to a consent management platform, aka a cookie banner.
The cookie banner blocks all tracking and cookies unless the visitor agrees to them.
The major downsides of cookie banners
It breaks and practically destroys your website analytics.
What we can do to improve the landscape for businesses
We can do two things:
Support SBA 690
This is a Californian legislative bill aimed at curbing the malicious and frivolous use of CIPA against businesses.
Support the Reform CIPA Coalition
This is a group that has been formed and supported by businesses, chambers of commerce, and nonprofits all across California to create the pressure needed for change.
Supporting the group is as simple as signing up to be a member. The more businesses signed up, the more weight the group has to make changes happen.
What we can hope for
We can hope for better judges and better laws against these malicious practices. We can also petition and work to drive technology forward and modern laws that are applied fairly and justly with regard for businesses.
It is my belief that these lawyers and plaintiffs should be forced to pay for all the damages and more that they are attempting to bring upon a small business. This is possible but the issue is the high cost of legal services, money and time to make it happen.
