In recent years an increasing number of lawsuits have been filed alleging that certain website tracking and analytic technologies, such as tracking pixels, violate state and federal privacy laws. These lawsuits often seek thousands of dollars in damages and can be costly to defend against even if no legal liability is ultimately found.
Organizations using tracking or analytic technologies on their website would be well served to familiarize themselves with these lawsuits as they review the use of these technologies on their website and consider actions to reduce the chances of litigation.
What is Pixel Tracking?
Pixel tracking is a marketing tool that can be used to track website user activity and tendencies. The pixel is a small transparent image embedded in a web page that allows the collection of user data that can be used to analyze user behavior or personalize advertising. Some pixel trackers are developed by third parties which then provide the data collected by the pixel tracker to the third party.
Concerns regarding the privacy implications of pixel tracking have increased in recent years. Website users may be unaware their activities are being tracked or that their activity is being shared with a third party. These concerns have led to litigation regarding the privacy implications of pixel tracking.
Pixel Tracking Lawsuits
With the expansion of pixel tracking, so too have lawsuits alleging trackers violate various privacy statutes. While the lawsuits allege violations of various federal and state laws, current litigation specifically focuses on violations of the federal Video Privacy Protection Act (VPPA) and at the state level, the California Invasion of Privacy Act (CIPA). Penalties under both laws can be steep with VPPA permitting damages of $2,500 per violation and CIPA permitting damages of $5,000 per violation.
With CIPA and VPPA damages assessed on a per violation basis, the damages sought can quickly balloon in size. Many of these lawsuits have been filed as class actions, only increasing the exposure to damages. While not every lawsuit is successful and results in damages, merely having to defend against these lawsuits can lead to substantial legal costs.
In addition to lawsuits, pixel tracking has attracted the attention of government regulators. In 2022, the Department of Health and Human Services issued guidance warning that pixel tracking could lead to violations of the Health Insurance Accountability and Portability Act (HIPAA). This guidance has since been vacated but it demonstrates that regulators are aware of pixel tracking and may take action to regulate its use in the future.
How Can You Protect Yourself?
Review Current Tracking Technologies
- It is important to know what tracking technologies you utilize and how they fit into your marketing strategy. This review needs to involve the marketing department as they drive the use of tracking technologies and the strategy behind it.
- Performing an audit of your current tracking technologies can help ensure awareness of all the potential tracking technologies that could be targeted in a lawsuit. Before risk can be addressed, an understanding of where those risks come from is crucial.
- The review should be ongoing. Changes in the marketing department’s strategy or personnel can impact what tracking technologies are used and how. An ongoing review process helps ensure that you are aware of all risks and that you are addressing any new risks that arise from new or different tracking technologies.
- It may make sense to involve legal counsel in this process to help understand the potential legal claims that could be made as a result of your current tracking technologies and any mitigating steps that could be taken to address those potential claims.
Review Website Tracking Technology Privacy Policy
- Review your privacy policy for website tracking technology to ensure it accurately reflects the technologies being used, what information is collected, and with whom that information is shared. Informing website users about what is being collected can counter the claim that an individual was unaware that a certain piece of information was collected, used, or shared.
- You would be well served to have your privacy policy reviewed by legal counsel to ensure it meets all legal requirements.
Obtain Consent to be Tracked
- Require visitors to your website to consent to have their information collected by various tracking technologies including pixel trackers. Obtaining consent can help defend against a claim that an individual was unaware their information was being collected or shared.
- Consent must be properly obtained. In some cases, tracking technologies begin to collect data prior to consent is received which creates litigation risk. In addition to a legal review of your privacy policy, you may want to have any consent language and processes reviewed by legal counsel as well.
Contact M3’s Alex O’Connor or your Client Executive to learn more about how you can protect your organization from pixel tracking lawsuits and litigation.
Notice: This information should not be construed as legal advice. In all cases, employers should consult with their own legal counsel.
