Contradictory CIPA rulings leave both sides saying they’re right

Two Los Angeles County judges recently issued contradictory rulings in seemingly identical California Invasion of Privacy Act lawsuits. Attorneys on both sides of the bar believe these rulings bolster their claims. But the absence of appellate clarification or new legislation means that attorneys are litigating these kinds of cases anew.

Judge Cherol J. Nellon last week overruled Choice Hotels’ demurrer to a complaint accusing it of installing code on a website visitor’s device that allegedly surveils browsing activity. Daryl Levings v. Choice Hotels International Inc., 23STCV28359 (L.A. Super. Ct., filed Nov. 20, 2023).

Nellon’s ruling came some two weeks after her colleague, Judge Stephen P. Pfahler, sustained a demurrer in a seemingly identical case against Hickory Farms. Both cases were filed by Pacific Trial Attorneys. Jose Licea v. Hickory Farms LLC, 23STCV26148 (L.A. Super. Ct., filed Oct. 25, 2023).

In these cases, the plaintiffs contend that any device that tracks online activity – including IP addresses – is a pen register according to the California Invasion of Privacy Act (CIPA), which was passed by the Legislature in 1967 to prevent the unauthorized interception, monitoring and recording of private conversations.

The act says a pen register is “a device or process that records or decodes dialing, routing, addressing, or signaling information transmitted by an instrument or facility from which a wire or electronic communication is transmitted, but not the contents of a communication.”

“This is the newest breed of CIPA case,” Jeremy S. Goldman said. He is a partner with Frankfurt Kurnit Klein & Selz PC’s Litigation Group and co-chair of the Emerging Technology Group.

“The vast majority of cases get settled before there’s any adjudication. The majority of cases have not gone to the appellate level,” Goldman continued. “What’s somewhat frustrating and bewildering is that the California Legislature passed the most robust privacy statutes, the [California Privacy Rights Act] and [California Consumer Privacy Act], and websites that comply with the CPRA and CCPA are being dinged with violations of a 55-year-old law.”

Pacific Trial Attorneys’ founder, Scott J. Ferrell, welcomed Nellon’s ruling.

“We are obviously pleased that the court vindicated important consumer privacy rights and look forward to extending the law in this area further,” Ferrell said about the Choice Hotels ruling in an emailed statement. He did not elaborate.

Ferrell filed separate but seemingly identical complaints against Hickory Farms and Choice Hotels alleging that they violated the California Invasion of Privacy Act by embedding software on a user’s device which allows third parties to compile enough information to assemble detailed pictures of visitors’ online and offline activities. That code meets the CIPA’s definition of a pen register or a trap and trace device, which cannot be used without a court order, according to the complaints.

Hickory Farms demurred, arguing that the complaint failed to establish the use of a pen register and trap and trace device within the meaning of the California Invasion of Privacy Act. Hickory Farms also said that the subject devices were limited to telephonic devices, including cellular phones, and not internet connected devices with unique IP addresses.

Pfahler agreed with that argument, writing in his order, “The court considers the telephonic functionality represented limitation. CIPA begins with Penal Code Section 630, with definitions and limitations reflecting an era of cordless radio phones and cellular phones at the time.”

Nellon took a different tack when she overruled Choice Hotels’ demurrer two weeks later.

“On the first point, plaintiff has pled ... that defendant ‘deployed a software device and process’ which first recorded the information being transmitted by plaintiff’s device, and then used that information to install tracking code on plaintiff’s device. That is sufficient to describe a pen register as defined in Section 638.50(b), and the illegal use of such a pen register as prohibited in Section 638.51(a),” Nellon wrote.

“On the second point, the various exceptions contained in Section 638.51(b) create possible affirmative defenses,” Nellon continued. “Plaintiff is not necessarily required to plead their absence. In any event, defense’s argument appears to be that plaintiff gave consent simply by visiting the website. Accepting this argument would allow the exception to swallow the rule whole. If merely visiting a website constitutes consent to the use of a pen register, then Section 638.51(a) would be a dead letter. It could never be violated. That is not an acceptable consequence.”

Choice Hotels’ attorney, Hazel Mae B. Pangan, said she was not at liberty to discuss the case as it was ongoing. Pangan is a partner with Gordon Rees Scully Mansukhani LLP.

The director of Southwestern Law School’s Entertainment and Media Law Concentration, Michael M. Epstein, said the situation was fundamentally about the law trying to catch up with the marketplace.

“Judges are not experts on the technology, that’s quite clear. They’re not credentialed to determine the impact: What are the implications, the consequence of a ruling?” Epstein said. “A number of attorneys might just throw up their hands. It may come down to who you get as a judge. Do you get a judge like in the Hickory Farms case or do you get one like in the Choice Hotels case?”

Patricia Brum, a Snell & Wilmer LLP partner with dozens of clients facing similar allegations, said Pfahler’s ruling in the Hickory case was significant because it points the way forward for hundreds of businesses defending themselves from nearly identical allegations in state and federal court. Nellon’s ruling in the Choice Hotels matter, on the other hand, was disappointing, she said.

“We’re back to a situation where plaintiffs still have legal support for their position so they will keep pushing their issue,” Brum said. She is not involved in the Hickory Farms or Choice Hotels matters.

“Hickory Farms raised five grounds on demurrer. Choice Hotels raised two grounds,” Brum said. “Two appeared similar to what Hickory Farms argued in demurrer but they were slightly different,” she continued. “Choice relied on affirmative defense that the plaintiff consented to web analytics that captured the IP address.”

Most of Brum’s clients opt to settle, she said.

“These cases are being brought on an individual basis. It’s not so much as class action. From the client’s perspective, it could mean the difference of settling for tens of thousands of dollars or fighting for hundreds of thousands of dollars,” Brum continued.