Hi CIPAWorld! The Baroness here with some BIG news in the privacy space today.

The facts you need to know:

Defendant Build.com is “an online home improvement retailer” that operates an e-commerce website. It operates a chat feature on its website which allows customers to ask questions about Build.com’s products and services.

Silvia Garcia alleges she visited the Build.com website on her phone and initiated a chat conversation on the website. (As our team has reiterated many times before, chat boxes are maybe the MOST dangerous CIPA claims out there right now).

Silvia Garcia sued Build.com, Inc. for violations of California Penal Code §§ 631 and 632.7 because Garcia alleged her conversation on the Build.com website was “secretly recorded” and “allowed a third party to eavesdrop upon it…”

Build.com moved to dismiss both of Garcia’s claims arguing that Garcia has not alleged an injury sufficient to assert a claim for violation of CIPA.

To satisfy Article III standing, “a plaintiff must show … that he suffered an injury in fact that is concrete, particularized, and actual or imminent.” TransUnion, 141 S. Ct. at 2203.

Build.com primarily argued that Garcia has not alleged an injury because she did not allege that she shared highly sensitive personal data through the chat feature.

Ultimately, the Court concluded held that “a CIPA violation is a violation of privacy rights and is a sufficiently concrete injury-in-fact.” Therefore, the Court held Garcia had standing.

Importantly, the Court stated “[f]ederal courts within California, including this Court, have held that ‘violations of Plaintiffs’ statutory rights under CIPA, without more, constitute injury in fact’ because unlike a bare procedural violation, a CIPA violation is ‘a violation of privacy rights’ which is a more ‘concrete and particularized harm.’”

Well, that’s BIG!

BUT, the Court ends up dismissing the Complaint. Why?

Garcia’s claims under section 631 and 632.7 were insufficiently pled.

Section 631 Claim

As an initial matter, the Court found Build.com could not be liable for eavesdropping because “parties to a conversation cannot eavesdrop on their own conversations.” So, Build.com can only be held liable under an aiding and abetting theory. Specifically, Garcia alleges Build.com “allow[ed] at least one independent third-party vendor … to use a software device or contrivance to secretly intercept …, eavesdrop upon, and store transcripts of Defendant’s chat communications with unsuspecting website visitors.”

The Court held this claim fails because the Complaint does not allege the existence of a third-party eavesdropper. Indeed, “[Garcia] speculates that the eavesdropper may be WhosOn or SalesForce, but such a speculative, naked assertion, devoid of further factual enhancement cannot plausible allege the existence of a third-party eavesdropper.”

And it gets better.

“In addition, Plaintiff’s allegation that Defendant ‘has covertly embedded software code … into its website that automatically intercepts, records, and creates transcripts of all conversation using the website chat feature,’, does not assist Plaintiff because it points to Defendant’s own conduct, not the conduct of a third-party. At best, this allegation suggests that Defendant employs a third-party software service as a tool to record its own data.”

Therefore, the Court dismissed Garcia’s Section 631 claim.

Section 632.7 Claim

As you folks know, section 632.7 imposes liability upon anyone who intercepts and intentionally records telephone communications without the consent of all participants in the communication.

Plaintiff argued that the term “landline telephone” in the statute should be construed broadly “as encompassing [Build.com’s] computer equipment, which connected with Plaintiff’s smart phone to transmit and receive Plaintiff’s chat communications,” and argues that “[t]he Internet works through a series of networks that connect devices around the world through telephone lines.”

But the Court held Section 632.7 “unambiguously limits its reach to communications between various types of telephones,” which are specifically identified in the statute.

Therefore, the Court dismissed Garcia’s Section 632 claim.

In the end, this was a big ruling in CIPAWORLD today.

Silvia Garcia v. Build.com, Inc., No. 22-cv-01985-DMS-KSC, 2023 WL 4535531 (S.D. Cal. 2023)