June 30, 2023
Online Chat Features and California's Two-Party Consent Rule for Recording Conversations
If you've been on the Web lately (and we all have), you've probably seen a site with a chat feature. Consumers in several cases have attempted to use those chat features as a basis for liability under a California privacy law. You may have heard of this law, the California Invasion of Privacy Act ("CIPA"), as a law that prohibits anyone from recording a call without the consent of all parties. In addition to imposing criminal penalties, the CIPA grants a private right of action to any victim of a violation of its provisions. Damages under the CIPA are steep, with treble damages available and a minimum damage award of $5,000 per violation. Private enforcement actions are frequent and becoming more frequent—as of June 22, 2023, Westlaw's database includes 315 cases, including 101 cases since July 27, 2017, that cite Cal. Pen. Code § 637.2, which grants the private right of action.
Three recent cases examine how the CIPA's anti-recording provisions operate in the age of the Internet and smartphones. Two of the cased examine whether recording of conversations that occur via a website's chat feature violates the anti-recording provisions—and reach opposite conclusions. The other case examines whether a consumer who seeks out potential violations has standing to sue when she thinks she's found a violation.
In Licea v. Old Navy, LLC, 2023 U.S. Dist. LEXIS 68724 (C.D. Cal. April 19, 2023), Old Navy, LLC, operated a website that included a chat feature. The chat feature allowed Old Navy to record and create a transcript of each chat. It also allowed a third-party company to intercept the chats and create transcripts. Miguel Licea, who used the chat feature through his smartphone, sued Old Navy in U.S. District Court for the Central District of California. Licea alleged that Old Navy had violated CIPA by recording his communications without his consent. Old Navy moved to dismiss for failure to state a claim.
The court denied Old Navy's motion to dismiss. The court found that the complaint sufficiently alleged that Old Navy recorded Licea's chats without Licea's permission. As the court explained, the CIPA prohibits the recording of certain communications without the consent of all parties. The prohibition applies where at least one party uses a cell phone or a cordless phone. Old Navy argued that Licea could not allege a violation of this prohibition by stating only that he had used a cell phone. The court disagreed. The court explained that federal courts had interpreted the CIPA's prohibition against recording communications without all parties' consent to apply wherever one party used a cell phone. Because Licea alleged that he had used his smartphone to chat on Old Navy's website, the court did not dismiss the claim.
By contrast, in Valenzuela v. Keurig Green Mt., Inc., 2023 U.S. Dist. LEXIS 95199 (N.D. Cal. May 24, 2023), Keurig Green Mountain, Inc., operated a website that included a chat feature. The chat feature allowed Keurig to record and create a transcript of each chat. It also allowed a third-party company to intercept the chats and create transcripts. Sonya Valenzuela, who used the chat feature through her smartphone, sued Keurig in U.S. District Court for the Northern District of California. Valenzuela alleged that Keurig had violated CIPA by allowing an unspecified third party to wiretap her telephone communications. Keurig moved to dismiss for failure to state a claim.
The court granted Keurig's motion to dismiss. The court found that the conversation between Valenzuela and Keurig did not involve telephone communications. As the court explained, the CIPA prohibits wiretapping only of telegraph or telephone communications. Valenzuela argued that the communications were telephone communications because she used a smartphone to access Keurig's website. The court disagreed. The court explained that Valenzuela accessed Keurig's website using her device's Internet capabilities, not its telephone capabilities. Valenzuela argued that the court should interpret the CIPA expansively to encompass new technologies. However, the California Legislature amended the CIPA many times, including in 2011 and 2022, when smartphones were already widespread. The Legislature could have expanded the anti-wiretapping provision to cover Internet technology but chose not to do so. As a result, the court did not apply the anti-wiretapping provision to the Internet functions of a smartphone.
The Licea court's denial of the motion to dismiss is notable because the decision depends on a broad reading of the term "cellular radio telephone" in Cal. Pen. Code § 632.7(a). Section 632.7(a) prohibits recording of a communication without the consent of all parties where at least one of the parties uses a cellular radio telephone or a cordless telephone. Licea used his smartphone to access the chat feature on Old Navy's website. The court could have found that when he did so, he was using the smartphone as a Web browser rather than as a phone. Instead, the court left open to future plaintiffs the argument that the term "cellular radio telephone" meant any device that could function as a cell phone, whether or not the party to the communication used it as one. This ruling could bolster plaintiffs' arguments in similar cases that Internet-based chats are within the scope of § 632.7 when the parties use smartphones to access the Internet. Since just about everyone has a smartphone these days, anyone who operates a website with a chat feature should consider whether and how they obtain users' consent to record chats.
On the other hand, the Valenzuela court took a narrower view of what counts as a cell phone. The court focused on Cal. Pen. Code § 631(a)(1), which applies to a communication by "any telegraph or telephone wire, line, cable, or instrument." This language differs from the language of Cal. Pen. Code § 632.7(a), which mentions cell phones specifically. Therefore, it might seem possible that the judges in these two cases reached different results simply because they were interpreting different statutory provisions. However, the Licea court also had to interpret § 631(a)(1) because Licea had also sued under that provision. The court dismissed Licea's claim under § 631(a)(1), but because of insufficiently specific factual pleading, not because it found § 631(a)(1) inapplicable. Likewise, the Valenzuela court addressed a claim under § 632.7(a). That court suggested that § 632.7(a) did not apply to smartphones using Internet capabilities by finding that Keurig's Internet connection was not a phone line. Thus, it appears that the holdings of Licea and Valenzuela are incompatible with each other, and it may take a ruling from a higher court to resolve the conflict.
A third recent CIPA case explored whether repeat plaintiffs may sue under the statute. In Byars v. Sterling Jewelers, Inc., 2023 U.S. Dist. LEXIS 61276 (C.D. Cal. April 5, 2023), Zale Delaware, Inc., operated the website Banter.com, which included a chat feature. Arisha Byars, a self-described "tester" who has regularly sued for violations of the CIPA, visited Banter.com and used the chat feature. Byars sued Zale in U.S. District Court for the Central District of California. Byars alleged that Zale had wiretapped her chat and allowed at least one third party to eavesdrop on the chat in violation of the CIPA. Zale produced records indicating the lack of any chat containing Byars's name or email address. Byars did not produce contrary evidence. Zale moved to dismiss for lack of subject matter jurisdiction.
The court granted Zale's motion to dismiss. The court found that Byars had not alleged an injury. As the court explained, a plaintiff in federal court must allege either an actual injury or a substantial threat of future injury to demonstrate standing and thereby give the court subject matter jurisdiction. Zale argued that because it had no record of a chat with Byars, it could not have gathered her information or allowed a third party to do so. The court agreed. Byars argued that a violation of the CIPA gave rise to standing, even if she could not demonstrate that Zale had gathered information about her. However, the case that Byars cited for that proposition assumed that the plaintiff had a reasonable expectation of privacy. Byars, on the other hand, had sued under the CIPA many times and had used Banter.com's chat feature so that she could sue. As a result, Byars had no reasonable expectation of privacy.
It is unclear which factor motivated the court's decision more: the lack of evidence on Byars's part or the fact that Byars had sued under the CIPA many times. The fact that Zale showed evidence that it had no record of a chat involving Byars—and Byars did not contradict that evidence—undoubtedly influenced the court's ruling. The court asserted in a footnote that Byars's status as a "tester" did not govern the court's analysis. On the other hand, the court also explained that it was (at least in part) Byars's expectation of having her chat recorded that defeated her assertion of standing. Because Byars expected, indeed hoped, that Zale would record her chat, she could not have expected privacy. It is difficult to predict how a court would rule if, for example, a plaintiff had evidence that a website operator had recorded conversations but expected that the operator would record the conversations.
What can we learn from these three cases? The most important lesson is that if you're going to record chats on your website and you want to reach anyone in California (or another state with a law like § 632.7), you need to get users' consent to do so. Before you record a chat on your website, make sure that you have a record of consumer consent that the CIPA requires. Consult an attorney to determine what form this record should take and how to build the record into your website.