Companies that look to integrate communication and interactive functionalities into their websites have a new legal concern.
Many websites use chatbots to impersonate humans to provide routine answers to many consumer questions. They can also be designed to allow humans to follow-up as necessary to inquiries at a time convenient for the business (instead of having someone always available).
Recently, an attorney in California is weaponizing the California Invasion of Privacy Act (“CIPA”) to go after companies using chatbots on their websites.
What are the allegations against the chatbots?
A lot of household consumer product websites have been caught up in this recent wave of litigation, including Dollar Shave Club, Goodyear Tires, MAC Cosmetics, Michael Kors USA, and Tiffany & Company.
The complaints allege that the chatbots are illegally monitoring and recording the online communications using keystroke monitoring software.
The plaintiffs in these cases are alleging that the monitoring of users’ chats are a “wiretapping” that is violation of CIPA. The lawsuits also allege that the defendant websites failed to obtain consent prior to these actions.
The proposed named plaintiff in these cases says that she thought she was talking with a real human on the other end of the chat, when in reality it was an AI bot impersonating a human. Then the company stored these chats for later use, including use by their vendors.
Are Chatbots Legal?
Chatbots are not inherently illegal. However, how you use them may lead to potential liability.
There are ways though that you can use chatbots legally. That has to do with disclosure – particularly in the privacy policy. It may also be useful to have a “just in time” notice on the chatbot itself.
You may also need to look at the vendor providing your chatbot service. Do they collect the information from the users on your website? How do they use that information? Do you need to disclose it separately?
Also consider how you use the information after the chat ends. How is this information stored? Can you delete the chats if you are contacted by a user pursuant to various privacy laws including CCPA and GDPR?
Plaintiff Litigation Factories
These potential class action lawsuits come in waves.
You may have heard about recent waves against websites for compliance with ADA requirements or gift cards that should require Braille. California has also spawned a bunch of litigation over cash back requirements on gift cards.
There was also a recent series of potential class actions targeting websites for session-replay technology that collected data concerning on-website keystrokes and mouse movements (many of you may have used those heat maps that some plugins use to A/B test page).
These lawsuits are often about seemingly obscure laws and come from a handful of plaintiff firms mostly in California and Florida. Sometimes New York gets in on the action too.
There are typically defenses to these cases. These chatbot lawsuits will probably use many of the same defenses as the session-replay cases to have the cases dismissed. But you still have the lawsuits themselves to deal with. And that costs money.
That’s one reason that a good offense is a great strategy here. Be proactive about looking at your privacy policy and disclosing what you need to. Don’t be the easy prey for the plaintiff litigators to come after.
Feb 2023 Update: Goodyear Tires
Well, I’ve got a big dose of “Yikes” that are going to send website owners scrambling. Unless you’ve been following along and have already made changes to your website.
This month, Goodyear Tire lost its motion to transfer venue and its motion to dismiss this case.
Goodyear’s Motion to Transfer and Why Website Owners Literally Went Yikes
Goodyear’s website has a Terms of Use like many websites (this one included). By visiting the website, you are agreeing to the terms of the policy, including the forum selection clause.
In a forum selection clause, the parties to the contract agree that any disputes are going to be held in the place that is stated in the agreement. In Goodyear’s case, they want that to be in Ohio.
You consent and submit to the sole and exclusive jurisdiction by and venue in the courts located in the State of Ohio, one of the United States of America, in any legal proceeding directly or indirectly arising out of or relating to the Sites.
Goodyear’s Terms of Use
But Judge Sykes of the Central District of California found that the forum selection clause didn’t apply! YIKES!
The Court said that the Terms of Use were a “browserwrap agreement” – that the terms of use were available as a hyperlink at the bottom of a website. And that Goodyear needed to show that the user had actual or constructive knowledge of its existence. Goodyear didn’t provide such evidence, nor an argument that the user would have had reason to scroll to the bottom of the page to see it or read it.
As a lawyer, I’d like to see that every user has to click accept on the terms before they can visit your site. But I also know that THAT is completely impractical and not user friendly.
So what can a website owner do?
One thing that I recommended above is that you have your terms of use and privacy policy right there on the chatbot itself. Basically, make the user click accept before they interact with your chatbot would at least give you an argument (and evidence) that the user saw and knew about the terms before they give up any personal information.
It’s why when you buy a course from Springboard Legal, you have to click that you accept the Terms of Use for the website. When you click that button, I know and you know that there are Terms of Use that apply to your purchase.
What’s Next?
There are a lot of these chatbot cases pending, so we will continue to monitor the cases and let you know of any interesting developments.
In the meantime, it’s a good time to check out the policies on your own websites. And see how the user knows about them and accepts them, particularly when handing over any (potentially) personal information.
Want a website checkup? Contact Kimberly DeCarrera at DeCarrera Law to see about website legal checkups.