Massachusetts’ highest court recently issued an opinion that delves into the complex intersection of privacy law and modern technology. The case centers around whether the collection and transmission of users’ web browsing activities to third parties without their consent constitutes a violation of the Massachusetts Wiretap Act.
However, the claim is not unique to Massachusetts. In recent years, plaintiffs in California, Pennsylvania, and Florida have filed claims under state-specific statutes and the Federal Wiretap Act alleging violations when data is collected and shared without consent of the individual website visitor.
The Massachusetts Court’s analysis hinged on the definitions of “communication” and “interception” under the state wiretap act. The term “communication” presented a particular challenge, as the Court found it ambiguous in the context of web browsing activities. The Court ultimately concluded that web browsing activities do not clearly fall under the statutory definition of “communication.”
In examining the legislative history of the wiretap act, the Court noted that it was primarily concerned with the secret interception of person-to-person conversations and messaging, rather than interactions with a website. This historical perspective further supported the Court’s decision to rule in favor of the website owners.
As a result, the Court reversed the lower court’s denial of defendants’ motions to dismiss the case, concluding that the alleged conduct did not fall under the wiretap act’s purview. While some states have begun to dismiss claims under wiretap laws similar to Massachusetts, it is likely not the end of attempts to bring claims for website tracking. This is especially true in states where attempts to dismiss claims under wiretap laws have been regularly denied. Similarly, as other privacy laws propagate plaintiffs’ counsel will have new rules to attempt to bring claims.
Notwithstanding the Massachusetts Court’s ruling, website owners should take steps to avoid potential risks of privacy claims related to the use of tracking technology. First, they should assess and understand the tracking or monitoring technologies in use on their website. Once the applicable technologies are understood, website owners should consider ways to ensure transparency – clearly informing users about the types of tracking technologies being used and their purposes. This may be achieved in a number of ways, including through a comprehensive privacy policy, website banner, and/or cookie notice. Further, website owners should analyze and, as applicable, implement a means to obtain consent from users before deploying tracking or monitoring technologies.
Implementing robust data security measures to protect the collected data from unauthorized access or breaches is also essential. Regularly reviewing and updating privacy practices to comply with evolving regulations, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), and the myriad of other state consumer data privacy laws, can further safeguard against potential claims.