Consent to Website’s Terms of Use Defeats Website Pixel Tracking Class Action Claims under Federal Wiretap Act, VPPA, and CIPA
In Lakes v. Ubisoft, Inc., the District Court for the Northern District of California dismissed with prejudice a class action lawsuit claiming that Ubisoft, Inc., a video game distribution company, violated the Federal Wiretap Act, Video Privacy Protection Act (VPPA), and California Invasion of Privacy Act (CIPA) by placing a Meta Pixel tracking tool on its website that allegedly intercepted users’ communications and transmitted their information, including video request data, to Meta (Facebook). The complaint sought a nationwide class and California subclass of users of the website that had their personally identifiable information (PII), search terms, and detailed webpage information improperly intercepted by and disclosed to Facebook through the use of the Pixel.
Ubisoft moved to dismiss all claims on the ground, among others, that all of the plaintiffs’ claims failed because an essential element of each claim is lack of consent, despite the fact that the plaintiffs repeatedly consented to, and were informed of, the use of cookies and pixels on the website. First, the plaintiffs had to consent to the use of cookies prior to using the website. Users were presented with a cookie banner when they first arrived at the website, which notified them that cookies would be used and gave them the option to change cookie consent preferences. Second, users had to create an account prior to making any purchase; doing so required them to check the box next to “I accept Ubisoft’s Terms of Use, Terms of Sale, and Privacy Policy,” which hyperlinked to the policies mentioned on the website. Third, “every time Plaintiffs made a purchase, they were again presented with the Privacy Policy during the Ubisoft Website store checkout process.”
The plaintiffs claimed that the website terms and notices did not demonstrate consent because they did not “‘explicitly notif[y]’ Plaintiffs of Defendant’s specific practice of exposing Plaintiffs’ PII—consisting of video game titles combined with unique Facebook identifiers—to interception by Meta,” nor did the terms and notices state “that Meta itself,” not Ubisoft, will collect the data through the Pixel. The court disagreed, finding that the website’s “disclosures clearly disclose that it allows partners to use cookies on the Website, that specific analytics and personalization cookies would be used, and that cookie identifiers and other similar data connected to the use of the site could be collected and shared.” As such, the court rejected the plaintiffs’ argument that consent required “a highly granular disclosure that notifies the user that Meta will collect plaintiffs’ ‘video game titles combined with unique Facebook identifiers’” and held that Ubisoft carried its burden in establishing consent. This doomed the plaintiffs’ claims.
The court also rejected the plaintiffs’ fallback argument that even if they consented, the Wiretap Act’s crime-tort exception applied, which eliminated the consent defense. Again, the court disagreed. For the crime-tort exception to apply, the court explained, the complaint must allege that “‘the primary motivation or a determining factor in the interceptor’s actions [was] to injure plaintiffs tortiously.’” Thus, the inquiry is not simply whether the interception itself violated another law, but “whether the purpose for the interception—its intended use—was criminal or tortious.” The complaint failed to meet this threshold because it alleged that the motivation underlying the Pixel installation was economic benefit, “specifically ‘to improve the effectiveness of its and Meta’s advertising and marketing’ and to ‘monetiz[e] the information via targeted advertising.’”
Finally, because the plaintiffs “[could not] amend their complaint to overcome the issue of consent,” leave to amend was denied.
Robust disclosures of the use of tracking technologies, like those present in the Ubisoft case, should properly defeat similar class actions challenging website tracking technologies.