If you are “tester” who actively seeks out privacy violations and files lawsuits to ensure legal compliance (as many class action lawsuit plaintiffs are), you do NOT have Article III standing to sue, according to a recent ruling in the U.S. District Court for the Central District of California.
The ruling in a case where the plaintiff alleged California Invasion of Privacy Act (CIPA) pen register violations and wiretapping.
Simply put, if you visit and enter information into the defendant’s website as a tester — expecting the information to be accessed, recorded and disclosed — you cannot claim an injury in connection with invasion of privacy violations. Your expectations were ultimately met.
Privacy violations depend on reasonable expectations. If you are a tester, you have no expectation of privacy because you expect your privacy to be invaded, and thus, suffered no injury in fact. This is even if you are also a legitimate user of the service.
This is different from First Amendment of ADA cases, where “tester” standing was confirmed. That is because there, the plaintiff suffered injury regardless of their expectations or intentions.
Regarding pen registers, the court also held that:
- The definitions of pen registers and trap and trace devices under Section 638.50 of CIPA “are not so limited” and that courts should “focus less on the form of the data collector and more on the result.”
- Users of websites do not implicitly consent to tracking software on a website just because IP addresses are collected by many websites.
[View source.]
