Companies that look to integrate communication and interactive functionalities into their websites have a new legal concern.
Many websites use chatbots to impersonate humans to provide routine answers to many consumer questions. They can also be designed to allow humans to follow-up as necessary to inquiries at a time convenient for the business (instead of having someone always available).
Recently, an attorney in California is weaponizing the California Invasion of Privacy Act (“CIPA”) to go after companies using chatbots on their websites.
What are the allegations against the chatbots?
A lot of household consumer product websites have been caught up in this recent wave of litigation, including Dollar Shave Club, Goodyear Tires, MAC Cosmetics, Michael Kors USA, and Tiffany & Company.
The complaints allege that the chatbots are illegally monitoring and recording the online communications using keystroke monitoring software.
The plaintiffs in these cases are alleging that the monitoring of users’ chats are a “wiretapping” that is violation of CIPA. The lawsuits also allege that the defendant websites failed to obtain consent prior to these actions.
The proposed named plaintiff in these cases says that she thought she was talking with a real human on the other end of the chat, when in reality it was an AI bot impersonating a human. Then the company stored these chats for later use, including use by their vendors.
Are Chatbots Legal?
Chatbots are not inherently illegal. However, how you use them may lead to potential liability.
You may also need to look at the vendor providing your chatbot service. Do they collect the information from the users on your website? How do they use that information? Do you need to disclose it separately?
Also consider how you use the information after the chat ends. How is this information stored? Can you delete the chats if you are contacted by a user pursuant to various privacy laws including CCPA and GDPR?
Plaintiff Litigation Factories
These potential class action lawsuits come in waves.
You may have heard about recent waves against websites for compliance with ADA requirements or gift cards that should require Braille. California has also spawned a bunch of litigation over cash back requirements on gift cards.
There was also a recent series of potential class actions targeting websites for session-replay technology that collected data concerning on-website keystrokes and mouse movements (many of you may have used those heat maps that some plugins use to A/B test page).
These lawsuits are often about seemingly obscure laws and come from a handful of plaintiff firms mostly in California and Florida. Sometimes New York gets in on the action too.
There are typically defenses to these cases. These chatbot lawsuits will probably use many of the same defenses as the session-replay cases to have the cases dismissed. But you still have the lawsuits themselves to deal with. And that costs money.
Feb 2023 Update: Goodyear Tires
Well, I’ve got a big dose of “Yikes” that are going to send website owners scrambling. Unless you’ve been following along and have already made changes to your website.
This month, Goodyear Tire lost its motion to transfer venue and its motion to dismiss this case.
Goodyear’s Motion to Transfer and Why Website Owners Literally Went Yikes
In a forum selection clause, the parties to the contract agree that any disputes are going to be held in the place that is stated in the agreement. In Goodyear’s case, they want that to be in Ohio.
But Judge Sykes of the Central District of California found that the forum selection clause didn’t apply! YIKES!
As a lawyer, I’d like to see that every user has to click accept on the terms before they can visit your site. But I also know that THAT is completely impractical and not user friendly.
So what can a website owner do?
There are a lot of these chatbot cases pending, so we will continue to monitor the cases and let you know of any interesting developments.
In the meantime, it’s a good time to check out the policies on your own websites. And see how the user knows about them and accepts them, particularly when handing over any (potentially) personal information.
Want a website checkup? Contact Kimberly DeCarrera at DeCarrera Law to see about website legal checkups.