Recent months have seen a dramatic increase in demand letters and litigation targeting websites and mobile apps. These claims often allege privacy violations stemming from the use of various technologies such as chat bots, chat features, website analytics, ad campaign tracking, and social media tools. Interestingly, these claims are often based on an old California law aimed at banning pen registers and eavesdropping—a throwback for those who remember pen registers!
Companies operating websites or mobile apps should consider proactively addressing these concerns. Here are some key questions to consider:
- Do you operate a website or mobile app? Websites and mobile apps are often the primary platforms where privacy issues arise.
- Does your website offer or use a chat bot or other chat feature? Chat bots and chat features can collect and process user data, which may be subject to privacy regulations. It’s important to know whether these technologies are in use.
- Does your website use any analytics, online marketing, or social media tools? Analytics tools, online marketing strategies, and social media integrations often track user behavior and collect data. These activities need to be transparent and compliant with privacy laws.
- Does your website have a privacy policy? A privacy policy is essential for informing users about how their data is collected, used, and protected. It should be comprehensive and up-to-date.
- Does your website have a cookie notice? Cookie notices inform users about the use of cookies and similar technologies on your site. They are a key component of compliance with privacy regulations.
- Does your website have a chat bot disclaimer on your chat features? Disclaimers for chat bots should clearly communicate how data collected through these features will be used and protected.
Recommended Actions:
- Review and update privacy policies: Regularly review your privacy policy to ensure it reflects current practices and complies with relevant laws. This includes detailing what data is collected, how it is used, and who it is shared with.
- Provide notice: Before deploying analytics, online marketing, or social media tools, consider informing users about these practices and where required, seek their consent.
- Chat bot data usage notice: Clearly communicate how data collected through chat features will be used.
The litigious risks for companies have stemmed from lawsuits filed under the California Invasion of Privacy Act (CIPA), targeting businesses that use AdTech. These cases often involve claims that third-party cookies and IP tracking beacons act as pen registers or trap-and-trace devices, violating privacy laws. Businesses should be cognizant about the use of such technologies and take the steps outlined above to help mitigate such a risk.
