Doug Luftman

CIPA Litigation Lacks Clarity In California The California Invasion of Privacy Act (CIPA) is being used to challenge web tracking, and the results are mixed: ✅Preliminary Judgements in State and Federal Courts Some state courts have dismissed CIPA claims finding that pixels and cookies don’t meet the definition of “pen registers.” Some federal courts have allowed CIPA claims to proceed where they involve more invasive tech like session replay which records a website visititor’s screen while they interact with a website. ✅Recent Cases In November the Adidas case survived summary judgment in federal court because allegations of Adidas’ use of tracking pixels to collect website visitors’ personal information was strong enough to proceed under CIPA. The Ink America Int’l case was dismissed in state court in December. The decision cited, in part the legislative intent of CIPA to address surveillance and not to broadly regulate the normal operation of commercial websites. ✅Possible Clarification Through Legislation SB 690 proposes clarifying CIPA by exempting commercial business purposes, borrowing language from the CCPA. While widely supported, it stalled in Assembly last year and has been converted to a two-year bill. Perhaps we will see the bill pushed forward in 2026, but uncertainty remains. 🗝Takeaway CIPA litigation isn’t going anywhere anytime soon, and there is no business-size threshold for applicability like with CCPA. Consider your CIPA obligations, particularly where session replay, voice/video transcription, and sensitive data collection are involved. As it currently stands, CIPA relies on an “opt in” approach to tracking, so consider “opt-in” rather than CCPA “opt-out” style consent. 2025 California Privacy Review: https://bit.ly/4b62UhZ Adidas Class Action:https://lnkd.in/gXQs9QYD Photo by the Author

18

3 Comments

🚨 California's SB 53 “Transparency in Frontier Artificial Intelligence Act” was officially signed into law yesterday by Gov. Newsom Who does it apply to? ✅ Large frontier developers: companies with > $500M in annual revenue that train/initiate the training of frontier models. ✅Frontier models: foundation models trained using ≥ 10²⁶ floating-point or integer operations. *These thresholds are intentionally high, but the bill's preamble notes that additional legislation could target smaller companies in the future. 📋 What does the law require? ✅ Risk frameworks: Companies must publish (on their websites) a “frontier AI framework” detailing how they assess and mitigate catastrophic risk, the cybersecurity practices leveraged, and the governance practices they put in place. ✅Transparency reports: Must be issued when deploying or substantially modifying a frontier model. ✅Reporting to state regulators: Summaries of risk assessments must be filed with California’s Office of Emergency Services, and critical safety incidents must be reported within 15 days (24 hours for imminent risks). ✅Whistleblower protections: Companies cannot prevent employees from reporting violations of the law or concerns that a developer's actions pose a danger to public health or safety. Penalties: Noncompliance can result in civil penalties of up to $1 million per violation, enforced by the Attorney General.

46

2 Comments