There has been a recent uptick of consumers sending pre-litigation demand letters to dealerships across the country alleging violations of California's Invasion of Privacy Act ("CIPA"), Cal. Penal Code 631(a). Recently, Ohio dealers have been targets of these demand letters. The consumers sending the demand letters are alleging that the dealerships have violated their rights under CIPA by allegedly transmitting their data to third parties or advertising services without the user's prior consent. Unfortunately, these demands are not scams and should not be ignored.

Many of these claims stem from website tracking technologies, such as analytics, advertising pixels, chat tools, and other third-party services that collect or transmit user data. In many instances, individuals making these claims visit dealership websites and use their browser's Developer Tools ("DevTools") to monitor network traffic in real time. They capture screenshots showing data or search terms being transmitted to third-party domains while they are browsing the website. The allegations typically focus on the claim that these data transmissions occurred before the user had an opportunity to consent to, or decline, the collection and sharing of their information.

Some of these consumers have obtained counsel to draft demand letters. Others are simply drafting the demand letters themselves. In either case, the dealership should not ignore the demand letter. The consumers may eventually file a lawsuit if you do not properly respond.

How Can I Violate California Law While in Ohio?

CIPA was enacted to "protect the right of privacy of the people" in California, by focusing on eavesdropping upon private communications (wiretapping). Among other things, CIPA bans wiretapping, eavesdropping, or recording private communications, and the use of pen register or tap and trace devices. CIPA also allows a private right of action for statutory damages of $5,000 per violation (or three times actual damages, whichever is greater), plus injunctive relief.

More recently, plaintiffs have alleged CIPA violations regarding modern websites. It is fairly new for California courts to apply CIPA to modern websites. These cases remain unsettled and contested by those who have decided to fight the matters. While defendants have raised defenses, many lawsuits survive the initial motion to dismiss stage, requiring businesses to incur significant litigation costs before the merits of the claims are ultimately decided.

Importantly, a dealership does not have to be located in California to receive a CIPA demand letter. The claims generally arise when an individual accesses the dealership's website while located in California and alleges that information was transmitted to third parties without the required consent.

Although California is at the heart of the recent demand letter surge, they are not the only state with wiretapping statutes that plaintiffs' are utilizing.

What the Demand Looks Like

Demand letters vary depending on the individual or attorney sending them, but Ohio dealerships have commonly reported receiving letters that include:

1. One paragraph demand letter describing how the dealership's website purportedly violated CIPA;
2. Screenshots that allegedly support the claims;
3. A draft complaint that the consumer asserts will be filed in a California court if the matter is not resolved.

Many demands seek a settlement payment of approximately $15,000, although the amount can vary.

What to Do

If you have received a demand letter:

• Don't ignore it. Your dealership may ultimately face litigation. If you engage immediately, you will likely be at the top of the list of businesses the consumer is targeting. Instead, promptly notify counsel and discuss with them the best steps going forward. Remember, if a lawsuit is filed in California for CIPA violations, you will need to engage with California counsel at that time.
• Preserve evidence. Retain copies of your website, privacy policy, consent banner, and any relevant website information as they existed when the demand letter was received. Avoid making significant changes to the website until you have discussed the matter with counsel.

For those dealers that have not received a demand letter, OADA recommends the following:

• Review your website's privacy compliance. Work with your website provider and legal counsel to evaluate whether your website appropriately obtains user consent before transmitting data to third-party vendors or advertising platforms. Users should have the ability to opt in or opt out before their data is being collected. 
• Make sure your website displays appropriate privacy disclosures. It is important your disclosures explain exactly what information is being collected. Your cookies banners shall also state that data is being disclosed to third parties for targeted ad purposes, if that is the case.

For more information about consumer data sharing requirements and online tracking, you can download and review ComplyAuto's "A Dealer Guide to Online Tracking & Cookie Consent Management."

NADA members can also learn more about website privacy litigation by clicking HERE to view their recent presentation by Fisher Phillips' Privacy, Security, and AI counsel discuss recent litigation and pre-litigation trends in more depth.

If you have additional questions or concerns regarding the recent surge in CIPA demand letters, please contact OADA Vice President of Legal Affairs, Sara Bruce at (614) 923-2243 or sbruce@oada.com, or OADA Staff Counsel, Matthew Smallwood at (614) 923-2232 or msmallwood@oada.com.