Old Navy cannot escape a lawsuit accusing it of running afoul of the California Invasion of Privacy Act (“CIPA”) by way of its use of a sophisticated chatbot feature on its e-commerce site. Despite Old Navy’s bid to get the case that Miguel Licea lodged against it in August 2022 dismissed in its entirety, Judge Sunshine Sykes of the U.S. District Court for the Central District of California sided with the plaintiff, in part, finding that his CIPA Section 632.7 claim against Old Navy for eavesdropping can move ahead. Not a total loss for the San Francisco-based retailer, Judge Sykes dismissed Licea’s Section 631(a) – which prohibits “intentional wiretapping,” including in the context of internet communications – albeit with leave to amend.
Taking on Licea’s Section 631(a) claim first, which generally makes it illegal to intercept communications without the consent of all parties to the communication, Judge Sykes stated that Licea sufficiently pled facts to allege that his communications with Old Navy’s Salesforce-enabled chatbot “were intercepted in transit” without his knowledge and without his consent. In particular, the court determined that Licea alleged that Old Navy “uses a third-party service to ‘covertly embed code into its chat feature that automatically records and creates transcripts of all such private conversations,’ and ‘allows at least one third party … to secretly intercept in real time, eavesdrop upon, and retain transcripts of [the Old Navy] chat communications with unsuspecting website visitors.’”
(Old Navy had argued that it did not “intercept” the communications in transit as required by Section 631(a), and more than that, the communications were not “intercepted” because “the third parties [that] access the messages [do so] after they are electronically stored rather than while they are in transmission.” On the latter point, the court stated that “factual disputes regarding whether third parties access the messages before they are stored are not proper for resolution at the motion to dismiss stage.”)
Licea’s allegations regarding interception “are sufficient to survive a motion to dismiss,” but the court, nonetheless, dismissed the Section 631(a) direct liability claim on the basis that CIPA exempts from liability any individual or entity who is a “party” to the “communication.” This means that one participant in a conversation “cannot be held to have wiretapped another.” Since Old Navy “was a party to the customer chats at issue in [the] complaint,” Licea’s claim that it is directly liable for wiretapping fails, according to the court.
Licea fared a bit better on his derivative liability argument, in furtherance of which he argued that Old Navy has, alternatively, violated CIPA’s wiretap provision by “aid[ing] and abett[ing] . . . at least one third party [Salesforce] to eavesdrop upon conversations.” (Salesforce is not named as a defendant in the suit.) Here, Licea’s “sole relevant allegation” is that Old Navy “allows a third party to eavesdrop on such communications … to harvest data for financial gain.” This allegation is “too vague and conclusory to survive a motion to dismiss,” but the court has granted him leave to amend.
The court then turned to Licea’s Section 632.7 claim, which imposes liability on any person who “without the consent of all parties to a communication, intercepts or receives and intentionally records … a communication transmitted between two … telephones.” Old Navy pushed back here on the grounds that Licea “cannot allege that both parties were using a qualifying telephone device to conduct the customer chats,” as the communication at issue involved Old Navy’s chat feature on its website, which Licea accessed using his smartphone.
Unpersuaded, Judge Sykes noted the federal courts “have generally characterized Section 632.7 as prohibiting ‘the intentional recording of any communication without the consent of all parties where one of the parties is using a cellular or cordless telephone.’” (The court also stated that “smartphones are cellular phones with web capabilities and fall within the cellular phone category,” and courts have applied Section 632.7 to “internet-based communications and written communications.”) Still yet, the court also rejected Old Navy’s argument that Licea consented to any alleged recording, as he “explicitly pleads that he and the purported class members did not consent to the recording of their conversations with [Old Navy],” finding that, he “sufficiently state[d] a claim pursuant to Section 632.7” as a result.
THE BIGGER PICTURE: The partial dismissal for Old Navy follows from a string of new cases, including one filed against Lacoste, and recent decisions, in which courts are pushing back on chatbot cases and similar claims, dismissing them at the pleadings stage. Examples include: Williams v. What If Holdings, LLC, 3:22-cv-03780 (N.D. Cal.); Byars v. Hot Topic, Inc. et al., 5:22-cv-01652 (C.D. Cal.); Licea v. Cinmar, 2:22-cv-06454 (C.D. Cal.); and Licea v. America Eagle Outfitters, Inc., 5:22-cv-01702 (C.D. Cal.), among others.
As a general matter, courts – including the one here – “are finding that a party to a conversation cannot ‘eavesdrop’ on that conversation,” Sheppard Mullin’s Jay Ramsey, Craig Cardon, Alyssa Sones, and Gian Ryan stated in a recent note. “As a result, a website operator can use a chat feature to enable and store a conversation with one of its users without ‘eavesdropping’ on that conversation, [and] the fact that the chatbot technology is provided by a third-party software developer is irrelevant when the software is being used solely for the website’s operation and benefit.”
While these decisions “may cause the recent wave of litigation to recede,” they note that such cases, nonetheless, “underscore the importance of understanding the legal implications of using chatbots and similar technology in a business context. While technology can be a powerful tool for improving customer engagement and support, businesses are wise to tread carefully and deliberatively when introducing new technologies that interact with consumers to ensure that they remain in compliance with applicable privacy laws and regulations, since few will have been written with these new technologies in mind.”
The case is Licea v. Old Navy, LLC, 5:22-cv-01413 (C.D. Cal.).
Share
