February 26, 2021
By Ian Ross and Jorge Perez Santiago
(Originally featured by Law360 at: law360.com.)
Over the last two years, plaintiffs have increasingly looked to state courts when filing their consumer protection and privacy putative class actions.
Claims under the Telephone Consumer Protection Act, for example, were once filed almost exclusively in federal court. Now hundreds are brought in state court where plaintiffs can try to avoid the U.S. Court of Appeals for the Eleventh Circuit precedent that has narrowed the viability of those cases.
More recently, plaintiffs have tested their luck filing class claims based on alleged deceptive emails or data breaches under Florida's Electronic Mail Communications Act and Florida's Unfair and Deceptive Trade Practices Act.
And now, plaintiffs attorneys have turned to Florida's Security of Communications Act, or FSCA, filing putative class actions by the dozens throughout Florida.
These cases seek to take advantage of the same theory of liability plaintiffs have pursued under privacy statutes in other states in recent years.
For example, in the last two years there has been an increasing number of claims brought in California courts under the California's Invasion of Privacy Act. In these lawsuits, plaintiffs have argued that website operators and mobile application providers violate California's wiretapping statutes by purportedly intercepting and eavesdropping on their consumer's use and interactions with websites and mobile applications without their consent.
California, like Florida, requires consent from all parties when a communication is intercepted, recorded or monitored. It is little surprise, then, that following the recent rush of filings in California, plaintiffs attorneys are now turning to Florida and other states to file these lawsuits.
The new Florida-based putative class actions under the FSCA each allege a similar fact pattern. Plaintiffs are claiming that the national retailers and corporations named in these lawsuits use tracking and session replay software to intercept their consumer's interactions with their websites.
Each lawsuit alleges that the software or proprietary technology used by these companies to allegedly track mouse clicks and page scrolling is not disclosed to the consumer and that, as a result, consumer communications are being recorded or monitored without their knowledge or consent.
The statutory damages available under the FSCA are significant: Any person "whose wire, oral, or electronic communication is intercepted, disclosed, or used" in violation of the statute has a civil remedy and can seek damages "computed at the rate of $1000 a day for each day of violation or $1,000, whichever is higher." He or she may also seek reasonable attorney fees and an injunction.
Given the potential availability of liquidated damages and attorney fees under the FSCA, it is in some ways a surprise that these lawsuits are only appearing now. But these cases may now take centerstage as courts seek to resolve questions of consent, the adequacy of website disclosures and the enforceability of limitations of liability and arbitration agreements in website terms of use.
And, regardless of whether these claims are ultimately viable under Florida law, this wave of filings already offers some useful lessons to companies.
First, companies should make sure that the privacy policies and terms of use on their websites and mobile applications disclose the technology they are using and the information they are collecting. California courts in similar contexts have already held that a defendant can establish consent where existing website disclosures contain adequate disclosures and detail information-collecting efforts.
Second, companies should consider whether the placement and display of their disclosures is clear and conspicuous given the developing law in this area. Some courts in recent years have been hostile to website disclosures that are not reasonably communicated to consumers because they appear in small print or are available only through a hyperlink to another location or webpage. While it may have been enough in prior years simply to include a hyperlink to robust terms of use at the bottom of a webpage, some courts are now refusing to enforce these browsewrap disclosures where they contain arbitration agreements or class waivers.
In some jurisdictions, courts now prefer clickwrap-based assent, through which consumers are required to click "I agree" after they are presented with specific terms and conditions. Plaintiffs who bring claims under the FSCA will likely argue that disclosures about the information being collected from them are browsewrap disclosures that do not demonstrate consent.
Third, given the proliferation of new consumer protection and privacy statutes — and the class actions that quickly follow when a new statute is enacted — companies should routinely be updating their privacy policies and terms to follow best practices in the states in which they do business.
Florida has become one of the most popular venues for consumer protection class actions, and the landscape for these cases will continue to change with new legislation on the horizon. In February 2021, a robust consumer data privacy bill, mirroring California's Consumer Privacy Act, was filed in the Florida House of Representatives with support from Gov. Ron DeSantis.
The proposed law would provide a private right of action, with the potential for statutory damages, for consumers whose nonencrypted and nonredacted personal information or email addresses are subject to unauthorized access and exfiltration, theft or disclosure. Similar statutes in Illinois and California have already led to hundreds of new case filings in those states.
Time will tell whether the next wave of privacy class actions under the FSCA or, if enacted, Florida's proposed Consumer Data Privacy law, will drive the swell of litigation that has forced businesses big and small to learn the ins and outs of the TCPA.
But this new wave of lawsuits is a reminder that as businesses look for new and innovative ways to interact with their customers, they need to navigate carefully through the constantly evolving and ever-changing framework of consumer protection and privacy statutes.
