The surge of privacy claims under the California Invasion of Privacy Act (CIPA) concerning the use of website cookies, pixels, and web beacons continues to impact organizations of all sizes and sectors. Until recently, a significant number of these cases are settled out-of-court and there have been a relatively small number of judicial rulings on these matters. However, on July 2, the Los Angeles Superior Court issued two separate and opposing rulings in Palacios v. Lolliprops Inc. and Palacios v. Wilson Sporting Goods Company regarding whether CIPA-related claims should be dismissed based on the court’s lack of personal jurisdiction over the Defendants.
These two cases involve CIPA provisions governing pen registers and trap and trace devices (PR/TTs) and may reflect the beginning of a trend in which organizations are more willing to litigate these cases in anticipation of having courts dismiss them, either on the ground that they are meritless under CIPA, procedural grounds, or both, to establish a line of positive precedent.
Palacios v. Lolliprops Inc.: Motion to Quash Granted
On January 23, 2024, Plaintiff Marielita Palacios filed a complaint against Lolliprops, Inc., alleging that a website owned and operated by the Defendant employed third-party web beacons in violation of CIPA’s provisions governing PR/TTs. The Defendant filed a Motion to Quash Service of the Complaint and Summons, citing, among other issues, that the Plaintiff could not establish personal jurisdiction over the defendant solely through its operation of its website which was available to users nationwide.
The Defendant’s motion highlighted that (i) it is a family-owned company based and operated in New Jersey that designs and sells peel-and-stick wallpaper, (ii) it has no physical presence in California and employs no California residents, and (iii) the Plaintiff has never purchased or considered purchasing any product from the Defendant.
In analyzing the personal jurisdiction issue, Judge Upinder S. Kalra focused on whether the Defendant “purposefully avail[ed] itself” to California through its website. He repeatedly addressed the “sliding scale” analysis previously used by the courts to determine whether a website is sufficient to establish purposeful availment for purposes of personal jurisdiction:
- At one end of the spectrum are situations where a Defendant clearly does business over the Internet. If the Defendant enters into contracts with residents of a foreign jurisdiction that involve the knowing and repeated transmission of computer files over the Internet, personal jurisdiction is likely proper.
- At the opposite end are situations where a Defendant has simply posted information on a website that is accessible to users in foreign jurisdictions. A passive website that does little more than make information available to those who are interested in it is not grounds for the exercise of personal jurisdiction.
- The middle ground is occupied by an interactive website where a user can exchange information with the host computer. In these cases, the exercise of jurisdiction is determined by examining the level of interactivity and commercial nature of the exchange of information that occurs on the website.
According to this case law quoted by Judge Kalra:
Some courts have held that sufficient minimum contacts are established, and the Defendant is ‘doing business’ over the Internet, where the Defendant's website is capable of accepting and does accept purchase orders from residents of the forum state. Other courts have suggested that ‘something more’ is necessary, such as ‘deliberate action within the forum state in the form of transactions between the Defendant and residents of the forum or conduct of the Defendant purposefully directed at residents of the forum state.’ [Yet,] [o]ther courts ‘have criticized ... emphasis on website interactivity’ and focus instead on ‘traditional due process principles’, asking whether the site expressly targets ‘residents of the forum state’ According to these courts, ‘Website interactivity is important only insofar as it reflects commercial activity, and then only insofar as that commercial activity demonstrates purposeful targeting of residents of the forum state or purposeful availment of the benefits or privileges of the forum state.’
Judge Kalra emphasized California precedent holding that “making a substantial number of sales of goods or services to California residents via one’s own website constitutes purposeful availment,” but that the “[s]ales must be substantial” and “they are not enough if they are ‘random, isolated, or fortuitous.’”
Based on this legal framework, Judge Kalra stated that the Plaintiff (i) has not satisfied her burden demonstrating that “Defendant purposefully availed itself of California as a forum by merely operating its website” and (i) did not furnish any “evidence demonstrating that Defendant targeted or made a substantial number of its sales to California residents.” According to Judge Kalra: “Indeed, Plaintiff claims she interacted with Defendant’s website – not any intentional interaction by Defendant…The only claim is that Defendant’s website violates a California law …This, however, is insufficient to exercise personal jurisdiction.”
Importantly, the judge indicated in a footnote that even if it is mistaken with respect to its purpose available analysis, “it would still be unwise to exercise personal jurisdiction because it violates the notion of fair play and substantial justice.” According to the court, “Plaintiff seeks to enforce a California privacy law on a New Jersey corporation’s website because she was able to access it from California. There is no evidence that Defendant—who sells wallpaper— anticipated being haled into court here because of Plaintiff’s internet browsing.”
Palacios v. Wilson Sporting Goods Company: Motion to Quash Denied
On February 8, 2024, Plaintiff Marielita Palacios filed a complaint against Wilson Sporting Goods Co., alleging that the Defendant’s website employed third-party web beacons in violation of CIPA’s PR/TT provisions, mirroring (essentially verbatim) the claims in the Lolliprops complaint. The Defendant responded with a Motion to Quash Service of the Complaint and Summons, denying both the presence of unlawful web beacons on its website and liability, arguing that CIPA regulates telephone wiretapping, and courts have ruled that CIPA does not apply to websites.
In its Motion to Quash, the Defendant argued that the court “need not reach the merits of Plaintiff’s cookie-cutter complaint, because it lacks jurisdiction to adjudicate Plaintiff’s allegations.” Specifically, the Defendant argued that “Wilson is not subject to general jurisdiction in California because it is not incorporated in California, nor does it have a principal place of business there.” In addition, Defendant argued that it is not subject to specific jurisdiction because it “did not purposefully direct or target Plaintiff in California” through its website and the Plaintiff’s encounter with the Defendant’s website “would be nothing more than the type of ‘random, isolated, or fortuitous’ occurrence that fails to meet the ‘expressly targeted’ requirement for specific jurisdiction.”
On July 2, 2024, Judge Tony L. Richardson denied Defendant’s Motion to Quash. Judge Richardson noted that while the Defendant furnished “evidence that it is a Delaware corporation, with its principal place of business in Illinois,” it did not provide any information regarding its “operations in California.” Consequently, the Defendant failed to demonstrate that “it lacks sufficient minimum contacts with California for California to exercise general jurisdiction over Defendant.”
Judge Richardson further emphasized that Plaintiff’s complaint “is based on accessing Defendant’s website from California” and “[a] nonresident Defendant who engages with California residents through the Internet may be subject to local personal jurisdiction. Here, the judge pointed to the following:
- The Defendant operates retail stores in California.
- The Defendant’s website enables users to locate nearby retail stores in California.
- The Defendant’s website includes a privacy policy, which specifically addresses the privacy rights of Californians who visit its website, as well as information on Defendant’s efforts to comply with the California Transparency in Supply Chains Act of 2010.
Based on this information, Judge Richardson held that the Defendant “expected Californians to access and interact with its website.”
Conclusion
It is a common practice for organizations to embed third-party cookies, pixels, and other web beacons on their websites and online applications. They do this for several reasons, including enhancing an end-user’s browsing experience, for safety and security purposes, and better ensuring that their marketing activities are relevant to their targeted audience. However, Plaintiff lawyers see these activities as a cause for litigation, and organizations that use such technologies should be prepared to receive (sometimes frivolous) CIPA-related complaints because of it. Unfortunately, the California courts have issued inconsistent rulings and standards for when, and if so, how organizations could be liable for CIPA violations based on how their websites track and monitor end-user activity through the use of third-party cookies and pixels. Accordingly, organizations must understand and exhaust all possible defenses, including those involving personal jurisdictional defenses, when responding to CIPA-related lawsuits.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.
This document may be considered attorney advertising in some jurisdictions.
© 2024 THOMPSON HINE LLP. ALL RIGHTS RESERVED.
