As CIPAWorld readers know, the Baroness continues to emphasize the heat during this hot CIPA summer and the Czar has been repeatedly advising you California has been at the forefront of privacy litigation.

“2023 is going to be the biggest year yet in terms of privacy litigation, and there’s going to be more of these cases than ever before…” So sayteh, the Czar.

So here is yet another U-Haul CIPA case to remind you folks of the risk around chat box usage.

In Brittney Ramirez v. U-Haul International, Case No. CVRI2303768 venued in the Superior Court of the State of California, County of Riverside, Plaintiff Ramirez filed a complaint for violations of CIPA Section 632 and Violations of the California Unauthorized Access to Computer Data Act (Cal. Penal Code Section 502(2)) (“CUCA”) for U-Haul’s alleged use of a chat box feature and of third party GlassBox.com without Plaintiff’s consent. (Interestingly, this matter follows a privacy class action CIPA case filed against U-Haul earlier this year where U-Haul was accused of recording consumer phone conversations without consent in violation of CIPA Section 632.7).

Plaintiff alleges that a code embeds content from GlassBox.com within uHaul.com and intercepts the inquiries that consumers believe are being sent directly to U-Haul and diverts them to GlassBox.com. Further plaintiff alleges, glassbox.com stores the consumer’s information for its own purposes while U-Haul fails to inform its users that their communications are being monitored and stored using an “event listener.”

The plaintiff states, according to Uhaul’s disclosures, it “collects a wide range of personal information from website users and consumers, including personal identifies, unique device information, browsing history and may deduce additional demographic details like gender; transaction details; location details, including IP addresses and GPS address; various details about website usage, such as links clicked, date and time of page views, searches; inferences and other information.” And UHaul “should not be permitted to acquire such extensive personal information from unsuspecting consumers” who just want to rent a U-Haul truck.

Further the Plaintiff alleges U-Haul does not disclose its relationship at all to GlassBox or that it is paying third parties which record and commoditize their communications using the seemingly harmless chat box feature.

As a result, Plaintiff alleges U-Haul violated CIPA Section 631(a) and the CUCA.

And for those of you heard my CIPA compliance breakdown know, privacy compliance IS doable but companies do need to conduct a thorough assessment of consumer data being collected and being shared with third parties, the use of third party chat box or “live chat” platforms, and of web session recording and analytics software being used — and companies must craft non-generic clear, detailed and accessible privacy policies and disclosures specific to their operations.