California Invasion of Privacy Act Exploited to Sue Organizations Nationwide
Here’s the scenario: Plaintiffs’ attorneys are exploiting the California Invasion of Privacy Act (CIPA), originally drafted in the 1960s to address wiretapping.
Although this statute was never meant to regulate modern web data usage, attorneys are actively sending demand letters to ministries, organizations, and businesses alleging that their websites use tracking tools that violate CIPA. These letters often claim that the ministry’s website “secretly” collects and monetizes visitor data, such as IP addresses and search terms. Non-California based ministries become vulnerable if their website is visited by California residents.
Uncertainty Creates Immediate Risk for Lawsuits The application of CIPA to websites has created a complex and uncertain legal landscape. Courts have been divided on whether and how this decades-old law applies to modern internet activities. Some courts have interpreted CIPA broadly, allowing lawsuits against websites that use common tracking tools like cookies and analytics. Other courts have been more cautious, leading to inconsistent rulings and ongoing legal uncertainty.
Immediate Actions to Reduce Your Risk
To help safeguard your ministry from potential legal challenges, the following steps are recommended:
Review Tracking Tools. Conduct a thorough review of any tracking tools that may be used on your website. If your website content management system or your web manager uses these tools, evaluate whether they are needed and how the data is being utilized. Consider disabling these tools if they are not being used. Examples of tracking tools include analytics tracking, heatmaps, behavior analytics tools, tag managers, Google ads, third-party social media sharing, third-party marketing platforms, social media ads, chat feature, and more.
Disclosure. Disclosure. Disclosure. If a ministry is collecting, storing, or using the data from these tools, it is important to disclose the use to website visitors. Add specific language to your Privacy Policy webpage that discloses the tools used. In addition, supplement your Terms of Use webpage with language that implies the website visitor’s consent by accessing and using the website.
Add Pop-up Cookie Notification Banner. Does your website have a Cookie Notification banner? This notification is becoming the norm for websites and is important in protecting your ministry. Following are elements of a Cookie Notification banner:
It appears the first time someone visits your site and should reappear if users clear their cookies or if the cookie expires.
The Cookie Notification banner immediately informs visitors about how cookies and other technologies are used for functions like user analytics, advertising, chat, or to personalize the website experience.
The banner should also require users to click “Accept” to consent to the use of cookies as described in your ministry’s Privacy Policy and Terms of Use. Ideally, it should include links to both.
Consult Legal Counsel. Engage with legal counsel to review your website’s compliance with CIPA and other privacy laws. This can help identify any potential vulnerabilities and ensure your privacy practices are up to date.
Looking Ahead
The Growing Importance of Data Privacy As internet usage grows, so does the collection of personal data, raising significant concerns about data privacy. The U.S. currently lacks a comprehensive privacy law, resulting in a patchwork of state regulations. This trend is likely to drive further legal and regulatory developments. Ministries must stay informed and proactive to protect themselves and their communities.
Questions? Contact Brotherhood Mutual’s Legal Assist service if you have questions about your ministry’s website privacy practices.
The information provided in this article is intended to be helpful, but it does not constitute legal advice and is not a substitute for the advice from a licensed attorney in your area. We strongly encourage you to regularly consult with a local attorney as part of your risk management program.
