9th Circuit Ruling Against Bloomingdale's Indicates Shift Toward CIPA Privacy Protections
In a reversal, the 9th U.S. Circuit Court of Appeals recently decided a privacy case against Bloomingdale's, ruling that the retailer violated the California Invasion of Privacy Act (CIPA) when it tracked an online shopper's movement without consent. The decision indicates the court's favorable sentiment concerning protecting citizens' privacy and a shift in its approach to the wiretapping statute, Loeb & Loeb privacy lawyer Allison Cohen blogged.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
In Mikulsky v. Bloomingdale’s, plaintiff Erica Mikulsky alleged the department store used third-party tracking software without her consent to collect information -- including mouse movements, keystrokes and URLs of webpages visited -- in violation of CIPA.
In May, the U.S. District Court for Southern California granted Bloomingdale’s motion to dismiss, ruling Mikulsky failed to allege the department store captured the ‘content’ of communications; the plaintiff appealed to the 9th Circuit.
In the circuit court's reversal of the dismissal, it held Mikulsky "sufficiently alleged Bloomingdale’s disclosed the ‘contents’ of website communications to a third-party session-replay vendor,” Cohen said.
The decision, Cohen added, lowered the pleading threshold, reinforced prior consent and affirmed California jurisdiction over companies collecting data from residents. In sum, “it broadens CIPA exposure for companies using tracking technologies without clear, upfront user notice and consent.”
In a blog post Wednesday, David Klein of Klein Moynihan, a firm that represents online companies, said the ruling "undoubtedly will embolden the plaintiffs’ bar to continue filing CIPA-pixel tracking lawsuits.” However, "the significance of this ruling is mitigated by the fact that it is an unpublished decision (and thus, has limited precedential value)," he added.
Klein recommended companies “carefully review their websites to ensure that they are providing adequate notice of the use of third-party tracking software,” and “disclose on their website’s landing page that the site uses third-party tracking software and require visitors to affirmatively consent to its use” before tracking begins.
“In addition, online businesses should regularly review and update their privacy policies to reflect changes to their data collection, use and sharing practices, as well as to comply with ever-evolving privacy laws,” he said.