Author: Hayley Ryan

Read Hayley's bio.
Posted on by Gerald L. Maatman, Jr.

California Legislature Halts Class Actions Alleging That Common Website Advertising Technologies Are Pen Registers And Trap And Trace Devices

By Gerald L. Maatman, Jr., Justin R. Donoho, and Hayley Ryan

Duane Morris Takeaways:  On September 30, 2026, California Governor Newsome signed Senate Bill 690, which amends the California Invasion of Privacy Act (“CIPA”) to eliminate the private right of action under California Penal Code § 638.51 for pen register and trap-and-trace device claims arising from website, online application, and mobile application activity. Under the amended statute, only the California Attorney General may bring such claims against private actors. The law takes effect on January 1, 2027, and it applies retroactively to any pending claim in an action commenced within two years before that date. For the thousands of companies now facing CIPA § 638.51 class actions and demand letters over the use of pixels, cookies, and similar website advertising technologies (“adtech”), Senate Bill 690 offers significant and fast relief. It is not, however, the end of CIPA litigation. The wiretapping provision (§ 631) and the eavesdropping provision (§ 632), which plaintiffs have also used in adtech cases, are untouched.

The bill’s final form is much narrower than the version first introduced. As introduced, Senate Bill 690 would have exempted all processing of personal information for a “commercial business purpose” as defined by the California Consumer Privacy Act (“CCPA”) from civil and criminal liability under all three sections of the CIPA. See Assembly Committee On Privacy And Consumer Protection Committee Report (July 1 , 2026) (“Committee Report”) at 6-7. The analysis in our blog post covers the legal landscape that led to the bill, the scope and mechanics of the enacted statute, how the bill narrowed during the legislative process, and what corporate counsel and class action practitioners should do now.

Background

The CIPA was adopted in 1967 to criminalize wiretapping, eavesdropping, interception, and recording of telephone communications without court authorization. Section 637.2 confers a private right of action to any person injured by a violation of the CIPA. Available relief includes statutory damages of $5,000 per violation, three times the actual damages suffered by the plaintiff, if any, and injunctive relief. Section 637.2(c) specifically provides that plaintiffs do not need to show actual damages. The Assembly Committee on Privacy and Consumer Protection observed that, in the adtech context, these violations “can stack up rapidly, causing defendants to face potentially devastating liability.” See Committee Report at 7.

Recent adtech litigation has relied on three CIPA provisions: § 631 (wiretapping), § 632 (recording confidential communications), and § 638.51 (pen registers and trap-and-trace devices). Section 638.51 was added only in 2015, and according to the Assembly Committee on Privacy and Consumer Protection, the Legislature gave “little, if any, thought” to how it would apply online or interact with the CIPA’s private right of action. See Committee Report at 1. The Committee called the pen register and trap and trace device statute “a poster child for abusive lawsuits,” explaining that “[b]ecause the potential liability can be staggering, businesses generally settle this litigation hastily, encouraging vexatious litigants to continue blasting out demand letters.” See id. at 1.

The case law gave businesses little certainty.  For example, federal district courts in California are split as to whether third-party collection of website-user information may constitute a trap and trace device or pen register under § 638.51.  California state trial courts, by contrast, have mostly dismissed these claims, as in Licea v. Hickory Farms LLC, No. 23STCV26148, 2024 WL 1698147 (Cal. Super. Ct. Mar. 13, 2024), Casillas v. Transitions Optical, Inc., No. 23STCV30742, 2024 WL 4873370 (Cal. Super. Ct. Sep. 9, 2024), and Sanchez v. Cars.com Inc., No. 24STCV13201, 2025 WL 487194 (Cal. Super. Ct. Jan. 27, 2025). The Committee noted that there is no published California appellate authority applying § 638.51 to software. See Committee Report at 16. According to the bill’s sponsors, § 638.51 lawsuits rose from about 600 to nearly 4,000 after SB 690 was introduced, and tens of thousands of businesses received demand letters. See id. at 7.

What Does SB 690 Change?

SB 690 amends only § 637.2, the CIPA’s civil remedies provision. Its main features are as follows:

  • AG-Only Enforcement For Online Pen Register And Trap-And-Trace Claims. An action against a private actor for a violation of § 638.51 “alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.”
  • The Private Right Of Action Otherwise Remains. Subdivisions (a) and (b) of section 637.2 still authorize private suits for statutory damages, treble damages, and injunctive relief for all other CIPA violations, now subject only to the new subdivision (d) exception. The no-actual-damages provision in subdivision (c) also remains.
  • Retroactivity. The amendments “apply retroactively to any pending claim in an action commenced within two years before the operative date of that legislation.” The Committee explained that this provision is meant to relieve defendants in pen register lawsuits filed within the two-year period before January 1, 2027. It also stated that the amendments would not affect any case in which final judgment has been entered.
  • Severability. The Committee explained that a severability clause was added “in view of possible constitutional challenges to the retroactivity provisions.” See Committee Reportat 25.

Who And What Is Covered?

The carve-out is narrow and depends on four elements. First, it applies only to claims under § 638.51. Second, it applies only to actions against a “private actor.” Third, the claim must be “alleged to arise from conduct occurring on” a website, online application, or mobile application. Fourth, it removes only private standing. The underlying prohibition in § 638.51 remains, and the Attorney General may pursue violations using the remedies the CIPA already provides.

SB 690 does not define “private actor,” and it does not explain when conduct “arise[s] from conduct occurring on” a website or app. Defendants should expect plaintiffs to test those terms. Possible targets include back-end service providers to websites and apps, such as companies that provide payroll, shipping logistics, cybersecurity and antifraud technology, cloud storage, HR, and analytics and advertising tools, which the bill’s sponsors noted had also been sued.

How Did The Bill Change During The Legislative Process?

The introduced and enacted versions of SB 690 differ significantly. As introduced, the bill would have exempted any “commercial business purpose,” as defined by the CCPA, from both civil and criminal liability under the CIPA. The enacted version does much less: it removes private standing only for certain § 638.51 claims. The introduced bill would have changed CIPA §§ 631, 632, 632.7, and 638.51. The Committee’s amendments struck all changes to §§ 631, 632, 632.7, and 638.50, so the enacted law amends only § 637.2, the CIPA’s civil remedies provision. See Committee Report at 25-26.

The two versions also differ in reach. The original bill applied to all civil and criminal violations, was not limited to website activity, and could have covered any recording or interception of a confidential communication made for a commercial business purpose. Id. at 15. The enacted bill leaves criminal liability unchanged, focuses only on the civil private right of action against private actors, and is limited to conduct occurring on an internet website, online application, or mobile application. Further, the original bill did not provide for public enforcement, while the enacted version gives the California Attorney General standing to pursue these pen register and trap-and-trace violations using the remedies the CIPA already provides. The enacted version also adds two provisions the original bill did not have: retroactive application to pending claims in actions commenced within two years before the operative date, and a severability clause added in view of possible constitutional challenges to that retroactivity.

The Committee called the original bill “too blunt” and warned that the bill could “unintentionally shield wiretapping violations that involve highly offensive intrusions.” See Committee Report at 2, 25. The Committee also treated the trap and trace device and pen register statute differently from the other provisions, noting that trap and trace device and pen register cases usually involve “seemingly innocuous technical violations arising from ordinary operation of websites.” Id. at 2. By contrast, it found that §§ 631 and 632 cases often involve “highly offensive intrusions on users’ reasonable expectations of privacy, although they are not immune from abuse.” Id.  The narrowed bill passed the Legislature unanimously in late August 2026.

What SB 690 Does Not Do

Claims under Sections 631 (wiretapping) and 632 (eavesdropping), which carry the same $5,000 per-violation exposure, remain available to private plaintiffs in class action litigation. The Committee acknowledged that § 631 “continues to be challenging for courts to apply” to conduct occurring on websites. See Committee Report at 2. It concluded that targeted reform of § 631 “appears warranted, albeit not as urgent as reforms to the pen register statute.” Id. at 24. The Committee also noted that plaintiffs have moved toward other theories, including claims under California’s Comprehensive Computer Data Access and Fraud Act and the federal Electronic Communications Privacy Act. Id. at 25. In his signing message, Governor Newsom noted that “additional work in this area is needed, as CIPA contains other decades-old statutes that are also susceptible to abuse by overly aggressive litigants,” and “urge[d] the Legislature to take this on next year to ensure a fair balance between protecting private information and preventing rapacious litigation.”

Implications For Companies

SB 690 should sharply reduce the volume of § 638.51 class actions and demand letters. In the short term, however, the plaintiffs’ bar may shift its claims rather than abandon them. Companies with any online presence, including websites, mobile applications, and online forms and applications, should consider the following steps.

  • Assess Pending § 638.51 Matters Now. For cases filed within the two-year retroactivity window, defendants should consider motions for judgment on the pleadings or dismissal once the law becomes operative on January 1, 2027, and should consider seeking stays in the meantime. Defendants should also reconsider their settlement posture on pen register-only demands.
  • Expect The Retroactivity Provision To Be Challenged. The Legislature added the severability clause because it anticipated constitutional challenges. Defendants should be prepared to defend retroactive application.
  • Expect Claims To Be Repleaded Under §§ 631 and 632. Plaintiffs asserting trap and trace device and pen register claims under § 638.51 are likely to recast adtech, claims as wiretapping or eavesdropping claims, particularly where descriptive URLs, search terms, or health information are involved, as adtech plaintiffs typically argue that such items constitute “contents” of a communication under § 631 and that transmission of such items to adtech companies constitutes “eavesdropping” or aiding and abetting eavesdropping under § 632. These claims still carry $5,000 per-violation statutory damages and remain suitable for class treatment.  Of course, adtech plaintiffs will continue to face numerous significant legal challenges regarding the merits and certifiability of their §§ 631 and 632 claims, as we blogged about here, here, and here.
  • Continue Auditing Website Advertising Technologies. The relief provided by SB 690 fails to limit exposure not only under the CIPA §§ 631 and 632 but also under the Electronic Communications Privacy Act (ECPA), the Video Privacy Protection Act (VPPA), the Pennsylvania Wiretapping and Electronic Surveillance Control Act (WESCA), the Florida Security of Communications Act (FSCA), and other state and federal privacy statutes. Companies should continue to review and evaluate their adtech, data practices, consent mechanisms, and privacy notices, in light of rapidly evolving legal precedent regarding whether these old statutes apply to adtech, to ensure compliance with these other privacy laws.
  • Watch The 2027 Legislative Session. Given the Governor’s call for further reform, additional CIPA amendments are a realistic possibility.

Companies should consider Senate Bill 690 as a narrow solution providing limited relief to adtech defendants rather than a comprehensive reform. Companies that treat it that way will be better positioned for the next phase of CIPA class action litigation.

Posted on by Gerald L. Maatman, Jr.

California Federal Court Denies TikTok’s Motion To Dismiss Children’s Privacy Claims Based on Prior Class Action Settlements

By Gerald L. Maatman, Jr., Justin R. Donoho, and Hayley Ryan

Duane Morris Takeaways:  On September 23, 2026, in the case of In Re TikTok, Inc., Minor Privacy Litigation, No. MDL 25-3144, ECF No. 414 (C.D. Cal. Sept. 23, 2026), Judge George H. Wu of the U.S. District Court for the Central District of California issued a tentative ruling (adopted as final on September 24, 2026) denying TikTok’s motion to dismiss the Second Amended Consolidated Class Action Complaint in a multidistrict litigation brought by minors alleging that TikTok collected, shared, and exploited their personal information without parental consent in violation of the Children’s Online Privacy Protection Act (“COPPA”) and related state laws.

The ruling is significant because it rejected TikTok’s argument that two prior nationwide class action settlements – totaling over $93 million combined – barred the plaintiffs’ claims, holding that the record at the pleadings stage did not establish the named plaintiffs’ membership in those prior settlement classes.  For companies that have previously settled class actions, the decision underscores the risk that broad settlement releases may not foreclose subsequent litigation where class membership is not clearly established on the face of the pleadings.

Background

This case is one of a series of privacy class actions targeting TikTok and its parent companies, ByteDance Inc. and ByteDance Ltd.  The plaintiffs are minors who allege that while under the age of 13, their personal information was collected, shared, and exploited by TikTok without the parental notice and consent COPPA requires for children under 13. The plaintiffs seek to impose liability stretching back to March 28, 2019.

Two prior nationwide settlements form the backdrop of the dispute.  The first, T.K. v. Bytedance Technology Co., No. 1:19-CV-07915 (N.D. Ill.), followed the FTC’s 2019 enforcement action concerning COPPA violations by Musical.ly, TikTok’s predecessor, and settled for $1.1 million on behalf of approximately 6 million individuals who used Musical.ly or TikTok before August 22, 2022, while under the age of 13. The settlement included a broad release but no injunctive relief.  The second, In Re TikTok, Inc., Consumer Privacy Litigation, No. 1:20-CV-04699 (N.D. Ill.) (the “Privacy MDL”), consolidated lawsuits focused on TikTok’s use of algorithms, facial recognition, and other technologies to collect and transfer personally identifiable user data to servers in China, and settled for $92 million with broad injunctive relief.

In April 2025, the U.S. Judicial Panel on Multidistrict Litigation ordered the transfer of the present actions to the Central District of California.  After an initial partial dismissal of claims brought under laws of states without a domiciled plaintiff, the plaintiffs amended, and the defendants moved to dismiss the Second Amended Consolidated Class Action Complaint (“Complaint”), arguing that the T.K. and Privacy MDL settlements barred claims for conduct occurring before August 22, 2022, the cutoff date defining the later T.K. settlement class.  The dispositive question was therefore whether the pleadings themselves established that the named plaintiffs fell within those prior settlement classes.

The Court’s Decision

The Court denied TikTok’s motion to dismiss, finding that the defendants failed to establish, on the record available at the pleadings stage, that the named plaintiffs were members of the T.K. class. ECF No. 414 at 8-9.

At the heart of the ruling was a straightforward factual gap.  The T.K. settlement class included individuals who used TikTok or Musical.ly before August 22, 2022, while under the age of 13.  Id.  However, the Complaint did not allege the birth dates or first-use dates of any of the named plaintiffs – it alleged only that the plaintiffs were under 13 and used TikTok during the Class Period, defined as March 28, 2019, to the present.  Id. at 9.  The Court held that these allegations did not establish when within that period the plaintiffs used TikTok, and the judicially noticed materials likewise did not supply that information.  Id.

Even assuming none of the plaintiffs opted out of the prior settlements, the Court found that the defendants still had not shown the plaintiffs belonged to the prior classes in the first place.  Id.  As the Court stated, “[a] person need not opt out of a class to which that person never belonged.”  Id.

The Court also rejected TikTok’s argument that plaintiffs should not be allowed to avoid res judicata simply by “artfully pleading around” the relevant facts.  Id.  Because a plaintiff’s failure to anticipate and plead around an affirmative defense is not a pleading deficiency, as the Supreme Court explained in Jones v. Bock, 549 U.S. 199 (2007), the Court concluded that even plaintiffs who knew these defenses were coming, and knew their own ages and use histories, were not required to plead around TikTok’s affirmative defenses of release and preclusion, provided they otherwise sufficiently pleaded their causes of action. Id. at 10.

The Court further rejected TikTok’s alternative argument that, regardless of membership in the prior classes, plaintiffs either were precluded from, or lacked Article III standing to pursue, claims for the pre-August 2022 period.  Id.  TikTok reasoned that uncertainty about whether the named plaintiffs were under 13 and used TikTok before August 22, 2022, does not prevent dismissal because plaintiffs who meet those criteria are bound by the prior settlements, while plaintiffs who did not use TikTok during the relevant period cannot recover for that period and lack standing to represent those who did.  Id.  The Court disagreed.  The Court held that once a named plaintiff establishes individual standing, differences in injuries between the named plaintiffs and absent class members go to class certification rather than standing, the distinction drawn by the Ninth Circuit in Melendres v. Arpaio, 784 F.3d 1254 (9th Cir. 2015).  Id. at 11.  As the Court explained, “[w]hether Plaintiffs can represent class members who experienced that conduct earlier in the proposed Class Period concerns their representative capacity under Rule 23, and the possibility that Plaintiffs used TikTok only after August 22, 2022, does not defeat their standing to pursue the alleged claims.”  Id.  The Court likewise declined to redefine the class period at the pleading stage, holding that the issue is more appropriately addressed at class certification.  Id.

After oral argument on September 24, 2026, the Court adopted its tentative ruling as the final ruling.  See ECF No. 416.

Implications For Companies

This decision provides important guidance for any company facing follow-on privacy and/or adtech class action litigation after a prior settlement, by showing that broad settlement releases cannot be enforced at the motion-to-dismiss stage unless the defendant can demonstrate from the pleadings alone that the current plaintiffs were members of the prior class.  That is a high bar where the operative complaint does not specify individual plaintiffs’ ages or first-use dates, or other identifying information necessary to determine membership.

Of course, preclusion based on prior settlements is just one tool in a defendant’s kit for defeating class certification in privacy and adtech cases.  For example, in the related case of In Re TikTok, Inc., Consumer Privacy Litigation, 713 F. Supp. 3d 470 (N.D. Ill. 2024), the court declined to dismiss in-app browser claims on the basis of the prior $92 million settlement but left the door open to a different result upon further discovery.  Id. at 501-02.  There, the court observed that “the unusual and as-yet-undisclosed manner and method of the Original Plaintiffs’ post-settlement investigation leaves open the possibility that further information might alter this conclusion — for example, evidence that they recognized both the in-app browser’s risks and the potential to use them as the basis for a wiretapping theory of liability, but deliberately chose not to pursue this opportunity,” adding that “[s]uch evidence would be worth further attention, if not a different result.”  Id. at 501.  The court reinforced this point by noting that the original plaintiffs’ source code expert had been given “free rein to probe TikTok’s relevant technology” during confirmatory discovery.  Id. at 499.  Defendants facing successive adtech class actions should accordingly pursue targeted discovery into prior expert analyses and internal communications reflecting awareness of the privacy risks at issue — evidence that, under the court’s reasoning in In Re TikTok, Inc., Consumer Privacy Litigation, could compel preclusion of theories that were available but not pursued in the earlier proceeding.

Posted on by Gerald L. Maatman, Jr.

California Federal Court Denies Class Certification In Adtech Case Due To Lack Of Article III Standing

By Gerald L. Maatman, Jr., Justin R. Donoho, and Hayley Ryan

Duane Morris Takeaways:  On September 21, 2026, in Smith, et al. v. Rack Room Shoes, Inc., No. 24-CV-6709 (N.D. Cal. Sept. 21, 2026), Judge Rita F. Lin of the U.S. District Court for the Northern District of California denied class certification in a case brought by consumers against an online shoe store company alleging that the company’s use of website advertising technology (“adtech”) violated the California Invasion of Privacy Act (“CIPA”) and Electronic Communications Privacy Act (“ECPA”).  The ruling is significant as it shows that before any class can be certified in the hundreds of adtech class actions filed in federal courts across the nation alleging that adtech violates privacy laws, plaintiffs not only bear the burden to establish, by the preponderance of the evidence, that they have suffered an Article III injury, but also cannot meet this burden by showing merely that they visited the defendant’s website at a time when adtech was installed on the website.

Background

This case is one of a legion of class actions that plaintiffs have filed nationwide alleging that third-party technology captured plaintiffs’ information and used it to facilitate targeted advertising. 

This software, often called advertising technologies or “adtech,” is a common feature of millions of consumer products and websites in operation today.  In adtech class actions, the key issue is often a claim brought under a the CIPA, the ECPA, or a variety of other statutes providing for statutory damages regardless of whether any actual injury occurred, because plaintiffs often seek millions (and sometimes even billions) of dollars, even from midsize companies, on the theory that hundreds of thousands of consumers or website visitors, times $5,000 per claimant in statutory damages under the CIPA and $10,000 per claimant in statutory damages under the ECPA, for example, equals a huge amount of damages.  Plaintiffs have filed the bulk of these types of lawsuits to date against healthcare providers, but they have filed suits against companies that span nearly every industry including retailers, consumer products, universities, and the adtech companies themselves.  Several of these cases have resulted in multimillion-dollar settlements, several have been dismissed, and the vast majority remain undecided. 

In Smith, the plaintiffs brought suit against Rack Room Shoes, Inc., an online shoe store company, alleging that in 2024, during their online web visits to purchase shoes from the company, the company had embedded on its website adtech supplied by Meta and other adtech companies that covertly intercepted the plaintiffs’ identities and interactions with the website, including the items the plaintiffs viewed, added to the their cart, and purchased, in alleged violation of the CIPA and the ECPA. 

The company answered the complaint, and the parties engaged in discovery, including the depositions of the plaintiffs and plaintiffs’ subpoenas to the adtech companies. 

Based on this discovery, the record reflected that in 2021 to 2023, the Meta pixel installed on the company’s website captured activities from devices and browsers that were signed into the plaintiffs’ accounts.  However, the plaintiffs provided no evidence that these 2021-2023 incidents involved their own web activities as opposed to activities of their family members using the same devices and browsers, that Meta captured any activity from the plaintiffs’ devices and browsers during their own sole 2024 visits, or that the other adtech installed on the company’s website captured any activities at all.

The plaintiffs moved for class certification, arguing that they had standing to bring their claims and that they satisfied Rule 23.

The Court’s Decision

The Court disagreed that the plaintiffs established standing and denied class certification on that basis without addressing or needing to address any of the parties’ arguments under Rule 23.

In their motion for class certification, the plaintiffs proffered two theories of injury in support of their argument that they had standing to bring their claims: one based on the actual interception of their information, and one based on the attempt to intercept their information.  (Slip Op. at 5.)

On the plaintiffs’ interception injury theory, the Court found no evidence that the Meta pixel embedded on the company’s website collected any data from the plaintiffs’ 2024 website visits, and no evidence that the activity that was recorded by Meta 2021-2023 was the plaintiffs’ own browsing activity.  Further, the Court rejected the plaintiffs’ argument that the company’s general use of the Meta pixel during 2024 was circumstantial evidence of actual tracking.  As the Court explained, citing the company’s expert testimony, the ability of adtech to collect and transmit data in a manner that can be linked to the website user “is impacted by many factors, including the browser being used, whether the browser and device are signed in to a social media account, and what cookie blocking features are enabled.”  (Id. at 7.)  In sum, the Court found that plaintiffs failed to present evidence from which a reasonable jury could find that any adtech installed on the company’s website collected any data attributable to the plaintiffs.

On the plaintiffs’ attempt injury theory, the Court found that the mere presence of active adtech on a company’s website does not bear the requisite close relationship to the type of harm traditionally at issue in intrusion upon seclusion and which type of harm the plaintiffs argued was the historical analog to the type of injury they suffered and thus sufficient to confer Article III standing.  On this point, the Court’s opinion turned on its finding that the plaintiffs presented no evidence that the adtech on the company’s website attempted to collect any “embarrassing, invasive, or otherwise private information.”  (Id. at 8.)  Further the Court found that the plaintiffs had no reasonable expectation of privacy in their web-browsing data due to the company’s privacy policy because the plaintiffs did not read it and the policy also did not create an expectation of privacy from adtech transmissions, and that even if plaintiffs had had a reasonable expectation of privacy, the plaintiffs failed to show that the mere presence of adtech was highly offensive.  (Id. at 9.)  In short, the Court held that “[t]he mere presence of active tracking software … on a website involving objectively non-sensitive information” does not bear a close relationship to the type of harm traditionally at issue in intrusion upon seclusion and, therefore, was insufficient to confer Article III standing.

Implications For Companies

Smith provides powerful precedent for any company opposing adtech class action claims where plaintiffs lack evidence from which a reasonable jury could find that any adtech installed on the company’s website actually collected any data attributable to the plaintiffs, by showing that any number of issues could have prevented such collection, such as the browser being used, whether the browser and device are signed in to a social media account, and what cookie blocking features are enabled.

Of course, Smith is just one tool in a defendant’s kit for defeating class certification in adtech cases.  Another is that even when named plaintiffs can establish that adtech collected data attributable to themselves (unlike in Smith), the same factors identified in Smith — browser type, social media account login status, cookie blocking features — are individualized issues that prevent named plaintiffs from establishing the defendant’s liability to alleged class members under Rule 23, as we blogged about here.

Posted on by Gerald L. Maatman, Jr.

Colorado’s Proposed Rules Require Meaningful Human Review And Reconsideration Of Employment Decisions Materially Influenced by AI

By Gerald L. Maatman, Jr., Justin Donoho, and Hayley Ryan

Duane Morris Takeaways:  On August 11, 2026, the Colorado Department of Law released a set of proposed rules intended to govern the implementation of Colorado’s Automated Decision-Making Technology Act (“ADMT Act”) and Conversational Artificial Intelligence Service Operator Requirements (the “Chatbot Safety Act”). Both laws, and the proposed rules (to the extent they become final, following a notice and comment period), take effect January 1, 2027.

The proposed rules under the ADMT Act would add additional layers of regulatory burdens on companies using AI-based tools to make consequential automated decisions affecting a consumer’s access to, eligibility for, or terms of employment, education, housing, lending, financial services, insurance, health care, essential government services, and public benefits. 

Take AI employment tools, for example — if Colorado’s ADMT rules were to become final, they would require companies using AI employment tools to make available and readily accessible to job candidates and employees:

  1. the make, model, and version number of any AI tool whose outputs were used or will be used to materially influence a consequential employment decision such as in candidate screening, interviewing, hiring, firing, and other consequential employment decisions;
  2. the types and categories of personal data input to the model;
  3. the sources of these input data, including the identities of intermediary and original sources; and
  4. to the recipients of any adverse outcomes materially influenced by the AI tool:
    1. within 30 days, notifications of the adverse outcome setting forth the decision, purpose of the AI tool, the reasoning and primary factors relied upon by the AI tool to produce the output, and the relative roles of the AI tool and human reviewers in the decision — such as whether the employer followed the human best practices to mitigate the risk of AI hiring tool noncompliance with antidiscrimination statutes that we identified in our blog (here); and
    2. within 45 days after receipt of a request for review, complete a meaningful human review and reconsideration of any adverse outcome, to the extent commercially reasonable.

The proposed rules under the Chatbot Safety Act would add age-assurance, disclosure, privacy, minor-protection, crisis-response, and reporting requirements on companies using AI-based chatbots.

The analysis in our blog post focuses on the “meaningful human review and reconsideration” component of the ADMT Act and its corresponding proposed rules, in the context of adverse employment decisions (number 4(b), above), to assist companies in preparing for compliance by January 1, 2027, and in commenting on the proposed rules before the comment period closes on October 26, 2027, as may be appropriate for their businesses. 

Organizations evaluating and seeking to comply with the proposed rules should continue monitoring the rulemaking process, as key provisions, including those discussed below, may change before the rules become effective.

Background

Colorado’s ADMT Act (Colo. Rev. Stat. § 6-1-1701, et seq.) was enacted May 14, 2026, and will become effective January 1, 2027.  It provides, among other things, that when an employee or job applicant experiences an adverse outcome resulting from a consequential decision that was materially influenced by AMDT such as an AI employment tool, then the employee or job applicant may request, and the employer must provide (i) instructions for requesting personal data and correcting factually  incorrect or materially inaccurate personal data used in the decision; and (ii) “an opportunity for meaningful review and reconsideration of the consequential decision, to the extent commercially reasonable.”  Id. § 6-1-1705. 

“Meaningful Human Review,” as defined under the ADMT Act, requires the employer to designate an individual who has authority to approve, modify, or override a consequential decision to perform the review.  Id. § 6-1-1701(15).  Further, in conducting the review, the designated individual must consider relevant, available primary evidence, must be trained to conduct the review, must not default to the system output, and must have access to sufficient information to understand (i) the output’s intended use, material limitations, and categories of inputs; and (i) the principal factors used to generate the output, without requiring disclosure of proprietary source code, model weights, or other trade secrets.  Id.

The ADMT Act also provides that, on or before January 1, 2027, Colorado’s Attorney General shall adopt rules to clarify and implement these requirements.  Id.

On August 11, 2026, the Colorado Department of Law released a set of proposed rules under the ADMT Act and Chatbot Safety Act that, among other things, would clarify and implement rules regarding reviewer standards, commercial reasonableness, response requirements, and documentation requirements, as discussed below.

Who Can Perform A Meaningful Human Review?

The proposed rules provide that an individual who conducts a meaningful human review must meet the following criteria:

  • Independence – The reviewer must be an independent reviewer who did not make the original decision and who is not a subordinate of the original decision-maker, whenever feasible.
  • Subject matter understanding – The reviewer must have a level of subject matter understanding that is commensurate with the nature of, and negative consequences resulting from, the adverse outcome of the consequential decision being reviewed.
  • Sufficient training – The reviewer must be trained regarding (a) accuracy and objectivity in decision-making; (b) information considered by the AI employment tool; (c) the output’s intended use, material limitations, and categories of inputs; and (d) the subject matter at issue at a level that would enable the reviewer to identify whether review of additional available primary evidence would be valuable, and to review and understand that evidence.
  • Sufficient authority – The reviewer must not be subject to steering by the upper management that would influence the reviewer’s decision, and they must be shielded from potential retaliation.
  • Unassisted by AI – The reviewer may not use any ADMT in conducting his or her review.

When Is Meaningful Human Review Commercially Reasonable?

Under the ADMT Act, employers receiving requests to review adverse outcomes materially influenced by an AI employment tool must conduct a meaningful human review and reconsideration of such outcome “to the extent commercially reasonable.” 

The proposed rules provide that an employer bears the burden of demonstrating that meaningful human review is not commercially reasonable.

To meet this burden, employers must use specific evidence, and consider the following factors, weighed together, with no single factor being dispositive:

  • type of review required — i.e., either (a) if the circumstances and request indicate that the AI tool may have malfunctioned, then correcting and re-performing the decision-making process; or (b) if additional evidence is submitted by the employee or job applicant, then considering whether that evidence changes the adverse outcome;
  • magnitude of harm resulting from the adverse outcome;
  • reversibility of the adverse outcome;
  • value provided by the review of available primary evidence;
  • employer size and capacity;
  • marginal cost and technical feasibility of the review; and
  • availability of qualified reviewers.

When the harm to an employee or job applicant resulting from an adverse outcome is a severe and irreversible denial of a basic human need, meaningful human review is presumed to be commercially reasonable.  This presumption of commercial reasonableness can be rebutted by evidence showing that the review is technically or financially impossible or could not change the adverse outcome of the consequential decision.

When And How Must An Employer Respond To A Request For Review?

Within 10 days after receiving a request for review of an adverse outcome of a consequential decision meaningfully influenced by an AI employment tool, the employer must confirm receipt of the request and provide information about how the employer will process the request.

Within 45 days of receiving the request, meaningful human review must be completed, and a response must be provided to the employee or job candidate.  The response must include the reviewer’s decision to confirm or override the consequential decision, the type of review conducted, the factors considered in making that decision, and the reasons the reviewer decided to confirm or override the consequential decision.  Reasons provided must be specific to the evidence provided, and not a recitation of the AI tool’s general logic. 

Where possible, an adverse outcome must be stayed pending meaningful human review.

What Documentation Of Meaningful Human Reviews Must Be Retained?

When a meaningful human review is conducted, the employer must retain a record showing:

  • the reviewer identity, authority, and relevant training;
  • review timestamps;
  • primary evidence available to the reviewer, including information provided by the employee or job candidate;
  • the reviewer’s access to the AI tool’s intended use, limitations, inputs and principal factors;
  • whether the reviewer approved, modified, or overrode the output; and
  • a written justification for the reviewer’s decision to approve, modify, or override the output.

Implications For Companies

Colorado’s ADMT Act and Chatbot Safety Act and their corresponding proposed rules add significant operational obligations and compliance burdens for companies using automated decision-making technology to meaningfully influence consequential decisions, and using chatbots, respectively. 

This blog post identified one component of these multifaceted burdens relating to one type of ADMT – meaningful human review and consideration of employment decisions materially influenced by AI employment tools.

Although the ADMT Act and Chatbot Safety Act do not provide a private right of action, violations may be prosecuted by the Colorado Attorney General and are treated as a deceptive trade practice under the Colorado Consumer Protection Act, carrying civil penalties of up to $20,000 per violation.

Companies using or considering using ADMT or chatbots should consider whether to comment on the proposed rules before the comment period closes on October 26, 2027, should continue to monitor the content of the rules as they may evolve during the notice and comment period, and should prepare for complying with the rules by the time they are scheduled to come into effect on January 1, 2027.

Posted on by Gerald L. Maatman, Jr.

Seventh Circuit Undoes Novel Privacy Class Settlement Due To Lack Of Separate Representatives For Nationwide Class And State Sub-Classes

By Gerald L. Maatman, Jr., Hayley Ryan, and Tyler Zmick

Duane Morris Takeaways:  On July 13, 2026, in the case captioned as In Re Clearview AI, Inc. Consumer Privacy Litigation, No. 25-1673, 2026 U.S. App. LEXIS 20406 (7th Cir. July 13, 2026), the U.S. Court of Appeals for the Seventh Circuit vacated a district court’s approval of a novel class action settlement between Clearview and individuals alleging that Clearview violated privacy laws by “scraping” their public photos from the internet to improve the company’s facial recognition technology. The Seventh Circuit held that the absence of separate class representatives for the nationwide class and the state-specific subclasses was a “key procedural problem” requiring vacatur of the settlement.

This decision is an important reminder that courts evaluating class settlements will closely scrutinize whether all classes and subclasses have adequate structural protections, including separate class representatives with separate counsel in cases where class members may have divergent interests.

Background

Clearview operates “a search engine for faces,” whereby the company scrapes photographs of individuals from public websites and analyzes them using artificial intelligence to generate “facial vectors” reflecting the geometry of a person’s facial features. Id. at *3. A search of Clearview’s database using a photograph of a person returns other photographs of that same person, together with links to the websites where the photographs were located.

The case arose from 11 putative class actions filed in federal district courts against Clearview and related defendants, which were ultimately transferred to the Northern District of Illinois for coordinated pretrial proceedings. 

After the appointment of interim lead class counsel, Plaintiffs filed a consolidated complaint asserting claims for declaratory judgment and unjust enrichment on behalf of a Nationwide Class comprised of all individuals in the United States whose biometric data was or is contained in Clearview’s database. Plaintiffs also asserted claims under the Illinois Biometric Information Privacy Act (“BIPA”) on behalf of an Illinois Subclass; claims under various California laws on behalf of a California Subclass; claims under New York’s civil rights code on behalf of a New York Subclass; and claims under the Virginia Computer Crimes Act and for statutory commercial misappropriation of identity on behalf of a Virginia Sub-class.

The parties first engaged in settlement discussions in 2022, which failed because Clearview lacked the financial ability to make the substantial immediate payments sought by Plaintiffs. But after mediating the case in 2023, the parties agreed to a settlement structure under which class members would acquire equity stake in Clearview. Specifically, the settlement provided that upon an initial public offering or a merger, consolidation, or sale of Clearview, the Class would receive a payment equivalent to a 23% equity stake in Clearview as of September 6, 2023. Alternatively, in lieu of that payment, the court-appointed settlement master could either (i) sell the settlement stake to a third party for a “commercially reasonable price” or (ii) make a cash demand equal to 17% of Clearview’s revenue from the date of final approval of the settlement until the date of such demand. Id. at *7.

The settlement stake itself would be divided unevenly among Class members based on the specific forms of relief available under the relevant state laws: ten shares to each member of the Illinois Subclass; five shares to each member of the California, New York, and Virginia Subclasses; and just one share to each member of the Nationwide Class. Notably, none of the eight original class representatives agreed to the settlement, so lead class counsel replaced them with four new representatives, each of whom belonged to one of the “favored” state-specific sub-classes.

After the District Court granted final approval, Objectors Robert Weissman and Rick Claypool, both members of the Nationwide Class, appealed. They argued that the settlement was not “fair, reasonable, and adequate” because (i) it did not provide injunctive relief, (ii) the future equity-stake and cash-demand fallback made the settlement’s value too uncertain, and (iii) the Nationwide Class lacked separate representation during the settlement negotiations.

The Seventh Circuit’s Decision

The Seventh Circuit vacated the District Court’s approval of the settlement and remanded the case for further proceedings. 

The Seventh Circuit rejected the Objectors’ two substantive challenges to the settlement, concluding that a fair settlement did not necessarily require injunctive relief and that the uncertainty associated with the equity-based structure was not disqualifying because “uncertainty is inherent” in such settlements. Id. at *11, 16.

The Seventh Circuit, however, agreed with the Objectors’ third argument regarding the settlement being deficient due to the absence of a separate Nationwide class representative with separate counsel. The Seventh Circuit explained that class action litigation relies on “structural assurance of fair and adequate representation for the diverse groups and individuals affected.” Id. at *23 (quoting Amchem Products, Inc. v. Windsor, 521 U.S. 591, 627 (1997)). One such “important structural feature” is the requirement that class representatives, who owe a fiduciary duty to absent class members, approve any proposed settlement. Id.

The Seventh Circuit emphasized that “[n]ot just any representative will do” and that the critical question is whether “the court can be confident that absent class members have been represented fairly.” Id. at *24-25. The Seventh Circuit concluded that the Nationwide Class lacked adequate representation because “none of the named class representatives was in a position to represent solely the interests of the Nationwide Class in allocating the settlement.” Id. at *29; see id. at *31 (“Appointment of separately counseled class representatives for identifiable, significantly different groups of claimants with fundamentally conflicting interests is Rule 23’s primary mechanism for such protection.”).

On this basis, the Seventh Circuit vacated the District Court’s approval of the settlement and remanded the case.

Implications For Companies

The Seventh Circuit’s decision in In Re Clearview AI, Inc. Consumer Privacy Litigation is a cautionary tale for companies structuring, or defending, class action settlements involving multiple classes or subclasses with potentially divergent interests. Where claimants fall into distinct groups with conflicting stakes in how settlement proceeds are allocated, courts will expect each group to have its own class representative with its own counsel at the negotiating table. A settlement that may be fair and reasonable on its face can be vacated if it lacks these structural safeguards, as without such protections a reviewing court cannot confirm that each class’s interests was independently considered during negotiations. Companies should keep this principle in mind at the outset of class settlement negotiations to avoid the possibility of a proposed class settlement failing on appeal due to the lack of necessary structural safeguards.

Posted on by Gerald L. Maatman, Jr.

Third Circuit Affirms Dismissal Of Session Replay Code Class Action Because The Collection Of Anonymized Information Does Not Constitute A Concrete Injury Necessary To Confer Article III Standing

By Gerald L. Maatman, Jr., Justin Donoho, and Hayley Ryan

Duane Morris Takeaways:  On May 26, 2026, in Smidga, et al. v. Spirit Airlines, Inc., No. 24-1757, 2026 WL 1470137 (3d Cir. May 26, 2026), the U.S. Court of Appeals for the Third Circuit affirmed a federal district court’s dismissal of a class action alleging that the defendant’s use of session replay code, a form of website analytics technology, violated federal and state privacy laws.  Relying on its prior decision in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), the Third Circuit held that the three named plaintiffs lacked standing because there were no allegations of embarrassment or humiliation, plaintiffs voluntarily provided the information on the defendant’s website, the information allegedly collected was anonymized, and, in any event, most people “understand that what we do on the Internet is not completely private.” Id. at *2. Accordingly, the Third Circuit concluded that plaintiffs failed to allege a concrete injury to their privacy interests sufficient to confer Article III standing. Id. at *1.

This ruling reinforces the growing trend among federal courts requiring plaintiffs to plausibly allege that the collected data was personally identifiable and obtained without authorization in order to establish a concrete privacy injury.

Background

Many companies embed session replay code and other similar software, such as Google Analytics and the Meta Pixel, into their websites to conduct website analytics and/or targeted advertising.  All of these various technologies capture users’ browsing behaviors and cryptographically transmit this data to algorithms residing on the software providers’ servers.  Upon entry into the algorithm, this data is typically anonymized, aggregated, and not alleged to have been viewed or accessible by any human.  Plaintiffs across the country have filed multitudes of class actions challenging these various website analytics and advertising practices under federal and state privacy laws, targeting companies in virtually every industry, including healthcare, retail, education, and consumer products.  Some cases have resulted in multimillion-dollar settlements, others have been dismissed, and the vast majority remain undecided.  In these session replay and other data privacy class actions, the central question is often whether the specific data captured is sufficiently sensitive or personally identifying to establish a cognizable legal injury.

In Smidga, three named plaintiffs sued the defendant airline, alleging that session replay code embedded on its website recorded users’ interactions with the website in real time, including “text entries, mouse clicks, and geolocation.” Id. at *1.  Plaintiffs asserted claims under the Pennsylvania and Maryland Wiretap Acts, the California Invasion of Privacy Act, California’s Unfair Competition Law, and several other state and common law causes of action. Id. at *1 n.2.

All three plaintiffs visited defendant’s website to browse flights. Only one plaintiff ultimately purchased tickets and entered the names, addresses, and ages of herself and her children while doing so.  Id. at *1.

The defendant moved to dismiss for lack of Article III standing under Federal Rule of Civil Procedure 12(b)(1) or, alternatively, for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6).  In support of its Rule 12(b)(1) arguments, the defendant submitted a declaration from its Senior Vice President and Chief Information Officer disputing plaintiffs’ allegations that the session replay code collected personal information and explaining that any data collected was “not traceable to any specific [w]ebsite user.”  Id. at *1.

The District Court granted the motion to dismiss for lack of standing, finding that the plaintiffs failed to establish an injury-in-fact sufficient to confer Article III standing, while also granting plaintiffs leave to seek jurisdictional discovery and amend the complaint again. Id. When plaintiffs took no further action, the District Court dismissed the complaint with prejudice, and plaintiffs appealed.

The Third Circuit’s Decision

The Third Circuit affirmed dismissal of the complaint but modified the District Court’s order so that the dismissal would be without prejudice. Id.

After observing that its recent decision in Cook v. GameStop, Inc., 148 F.4th 153 (3d Cir. 2025), “plainly resolve[d]” plaintiffs’ standing challenge, the Third Circuit “briefly explain[ed]” why plaintiffs failed to establish a concrete injury sufficient to confer Article III standing. Id. at *2.

First, the Third Circuit held that the alleged harm did not share a “close relationship” to the comparator torts of disclosure of private information or intrusion upon seclusion. Id.  With respect to public disclosure of private information, the Third Circuit explained that the two non-purchasing plaintiffsdid not allege that the defendant collected any personal information. Although the purchasing plaintiff entered personal information while using the website, the Third Circuit noted that the tort of public disclosure of private facts requires allegations of resulting embarrassment or humiliation, which were absent from the complaint.  Id. 

The Third Circuit similarly concluded that plaintiffs failed to state an analogous intrusion upon seclusion injury. Such a claim requires allegations that the defendant intentionally intruded upon plaintiffs’ “private affairs or concerns.” Id. The Third Circuit determined that standard was not satisfied because plaintiffs voluntarily provided the information, the allegedly collected information was anonymized, and, in any event, most people “understand that what we do on the Internet is not completely private.” Id.

Second, the Third Circuit rejected plaintiffs’ argument that bare violations alone confer standing, concluding that the argument misconstrued Third Circuit precedent and the U.S. Supreme Court’s holding in TransUnion LLC v. Ramirez, 594 U.S. 413, 426–27 (2021). Id. at *2.

Third, the Third Circuit reasoned that it was “hard-pressed to find that a de facto invasion of privacy exists where a website makes no express promise to refrain from collecting site visitors’ information.” Id. at *3. As explained in Cook, “there is a material difference between an allegation that a website merely failed to ask for visitors’ consent to data collection and an allegation that a website expressly promised it would not collect information but secretly did so anyway.” Id. The complaint contained no allegations that the defendant made such a promise.

The Third Circuit also rejected plaintiffs’ challenge to the District Court’s consideration of the declaration submitted in support of the defendant’s Rule 12(b)(1) motion to dismiss. The Third Circuit emphasized that plaintiffs failed to request discovery to respond to the defendant’s factual challenge despite being given the opportunity to do so, and it agreed that plaintiffs’ “boilerplate averments” alone could not rebut the defendant’s external evidence. Id. at *3.

Accordingly, the Third Circuit affirmed the District Court’s dismissal order for lack of Article III standing but modified the dismissal to be without prejudice.

Implications For Companies

Smidga reinforces that plaintiffs challenging the use of common website analytics and advertising technology must, at a minimum, plausibly allege that the technology collected and disclosed personally identifying information, rather than anonymized, aggregated web-browsing data cryptographically transmitted to software providers’ servers and not viewable or accessible by any human.  Moreover, alleging the collection and disclosure of PII via functionally internal session replay technology may or may not confer standing, depending on the jurisdiction one is in, as we blogged about earlier this month (here).

For companies facing session replay and other data privacy class actions in federal court, Article III standing remains a significant threshold defense that should be evaluated throughout the litigation, while balancing the possibility that claims may continue in state court.

Posted on by Gerald L. Maatman, Jr.

Third Circuit Holds That Unauthorized Collection Of Credit Card Information Via Session Replay Code Confers Article III Standing, Creating Split Of Authority

By Gerald L. Maatman, Jr., Justin Donoho, and Hayley Ryan

Duane Morris Takeaways: On May 11, 2026, in In Re BPS Direct, LLC; Cabela’s, LLC Wiretapping Litigation, No. 23-3235, 2026 WL 1280969 (3d Cir. May 11, 2026), the U.S. Court of Appeals for the Third Circuit reversed a federal district court’s dismissal of a class action alleging that defendants’ use of session replay code, a form of website analytics technology, violated federal and state privacy laws. The Third Circuit held that two plaintiffs who made purchases on the defendants’ websites had standing to sue because the session replay code collected their credit card information without consent, an alleged injury the Third Circuit deemed analogous to the common law tort intrusion upon seclusion. Id. at *6-7.

This ruling is significant in that it shows that in class actions seeking millions (or billions) in dollars in statutory damages under federal and state data privacy laws for alleged use of session replay code, the Third Circuit has distinguished itself from California District Courts, which have held that there is no reasonable expectation of privacy in credit card information collected by session replay code.  Companies operating in the Third Circuit should take note as the legal risk of session replay code has meaningfully shifted in that jurisdiction. 

Background

Many companies embed their websites with session replay code and other similar software such as Google Analytics and the Meta Pixel in order to perform website analytics and/or targeted advertising. All of these various technologies capture users’ browsing behaviors and cryptographically transmit this data to algorithms residing on the software providers’ servers.  Upon entry into the algorithm, this data is typically anonymized, aggregated, and not alleged to have been viewed or accessible by any human.  In addition, session replay code (unlike other website analytics and advertising technologies) is typically alleged to record and store “videos” of “all mouse movements, clicks, scrolls, zooms, window resizes, keystrokes, [and] text entries,” so that the session replay provider can provide that information back to the company “in a format that [the company] can use for its business purposes.” Id. at *1, 5. Plaintiffs across the country have filed multitudes of class actions challenging these various website analytics and advertising practices under federal and state privacy laws, targeting companies in virtually every industry, including healthcare, retail, education, and consumer products.  Some cases have resulted in multimillion-dollar settlements, others have been dismissed, and the vast majority remain undecided.  In these session replay and other data privacy class actions, the central question is often whether the specific data captured is sufficiently sensitive or personally identifying to establish a cognizable legal injury.

In In re BPS Direct, LLC, eight named plaintiffs sued the defendant retailers, alleging that session replay code embedded on their websites captured users’ interactions, including “mouse clicks and movements, keystrokes, search terms, substantive information inputted …, pages and content viewed …, scroll movement[s], and copy and paste actions.” Id. at *2.  Plaintiffs asserted claims under the federal Wiretap Act, 18 U.S.C. § 2510 et seq., and the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 et seq., along with several state and common law causes of action. Id.

The plaintiffs fell into two groups. Two plaintiffs made purchases on the defendants’ websites and entered his or her “name, address, and payment and billing information” into text fields. Id. The remaining six plaintiffs browsed the websites without making purchases and did not enter any personally identifying information while browsing the websites.  Id.

Defendants moved to dismiss for lack of Article III standing under Federal Rule of Civil Procedure 12(b)(1) and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6).  The District Court granted the motion, dismissing the non-purchasing plaintiffs’ claims with prejudice, finding that, after two attempts, they could not establish concrete harm “because they did not make purchases on the Websites or engage in any activity prompting their browsers to send highly sensitive personal information such as medical diagnosis information or financial data from banks or credit cards.” 705 F. Supp. 3d 333, 367 (E.D. Pa. 2023).  The claims of the two purchasing plaintiffs were dismissed without prejudice. Id. Rather than amend, those two plaintiffs filed a notice of intent to stand on their allegations, and all eight plaintiffs appealed.  2026 WL 1280969, at *2-3.

The Third Circuit’s Decision

The Third Circuit reversed the dismissal of the purchasing plaintiffs’ claims and modified the dismissal of the non-purchasing plaintiffs’ claims from with prejudice to without prejudice.  Id. at *1. 

The Third Circuit analyzed standing under two analogous common law torts: (1) public disclosure of private facts, and (2) intrusion upon seclusion. It held that none of the plaintiffs had standing under the first theory.  As to the non-purchasing plaintiffs, their browsing data was neither sensitive nor personally identifiable. As to the purchasing plaintiffs, their information was not publicly disclosed.  Id. at *4-5.

The Third Circuit held that only the two purchasing plaintiffs had standing under the intrusion upon seclusion theory. Id. at *3.  Under that common law tort, “[o]ne who intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns, is subject to liability to the other for invasion of his privacy, if the intrusion would be highly offensive to a reasonable person.” Id. at *5 (citing Restatement (Second) of Torts § 652B (1977)). The Third Circuit concluded that the two purchasing plaintiffs had entered “personal or sensitive” information – specifically their “complete credit card or debit card numbers” – when making purchases on the defendants’ websites. Id. at *7. The Third Circuit reasoned that “[j]ust as media consumption is sensitive and historically private, so is a person’s complete credit card or debit card number.” Id.

Accordingly, the Third Circuit held that these two plaintiffs had standing based on their allegations that defendants embedded session replay code in their websites, allowing third-party adtech providers to “surreptitiously record their billing and payment information absent consent.” Id.

Implications For Companies

This ruling puts the Third Circuit at odds with California District Courts, which have reached the opposite conclusion in two session replay cases. See Thomas v. Papa Johns Int’l, Inc., 2024 WL 2060140, at *5 (S.D. Cal. May 8, 2024) (plaintiff’s “name, address, credit card number(s), and billing information” collected via session replay is “not information over which society is prepared to recognize a reasonable expectation of privacy”); Saleh v. Nike, Inc., 562 F. Supp. 3d 503, 525 (C.D. Cal. 2021) (collection via session replay of a website user’s “payment card information, including card number, expiration date, and CCV code” without consent was insufficient to constitute an invasion of privacy).

In the Third Circuit, session replay is no longer just an analytics tool – it carries significant legal risk for website operators.  Companies facing session replay class actions in the Third Circuit should shift their litigation strategy accordingly and consider moving beyond standing arguments, including demonstrating that plaintiffs cannot meet their burden of proof on the elements of the claims asserted.

Given the volume of session replay and similar litigation pending nationwide and the significant statutory damages at stake, this decision warrants close attention from any company whose website uses session replay code or similar technologies.

Posted on by Gerald L. Maatman, Jr.

Seventh Circuit Holds That Refusing To Register An Arbitration Agreement With The AAA Is Not A “Refusal To Arbitrate” Under The FAA

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Hayley Ryan

Duane Morris Takeaways: On May 1, 2026, in Bernal et al. v. Kohl’s Corporation et al., No. 24-2806, 2026 WL 1193991 (7th Cir. May 1, 2026), the U.S. Court of Appeals for the Seventh Circuit affirmed a federal district court’s denial of a petition to compel arbitration, holding that the defendant’s refusal to register its arbitration agreement with the American Arbitration Association (“AAA”), which caused the AAA to close the arbitration proceedings, did not constitute a “refusal to arbitrate” under the Federal Arbitration Act (“FAA”). The Seventh Circuit reasoned that because the parties had delegated that procedural question to the AAA, the district court had no authority to compel arbitration.

This decision is a significant win for businesses facing mass arbitration campaigns, particularly where arbitration agreements incorporate the AAA’s Consumer Arbitration Rules. The decision offers a concrete mechanism to avoid the steep filing fees such campaigns generate.

Background

Plaintiffs purchased products through Kohl’s website in 2020 and 2022 and agreed to arbitration provisions that required all disputes to be resolved through binding arbitration before the AAA under its rules, including the AAA’s Consumer Arbitration Rules. Id. at * 1.  The arbitration agreement also delegated to the arbitrator exclusive authority “to resolve any dispute related to the interpretation, applicability, enforceability or formation of” the arbitration agreement. Id.

In December 2022, Plaintiffs’ counsel initiated the pre-arbitration process by serving Kohnl’s with approximately 10,000 notices of dispute, followed by an additional 44,656 notices in April 2023. These claims alleged that Kohl’s marketing practices violated California’s consumer protection laws. Id. at *2. This is a classic mass arbitration strategy in which plaintiffs’ firms file thousands of individual demands to exploit mandatory per-claim filing fees paid by corporate defendants.

On May 22, 2023, while settlement discussions were ongoing, Kohl’s modified its terms and conditions to designate the National Arbitration and Mediation tribunal (rather than the AAA) as the arbitration forum for all claims. That same day, Plaintiffs filed formal individual demands with the AAA and paid all applicable filing fees. Id. Under AAA Consumer Arbitration Rule R-12, however, a business must register its arbitration clause and pay administrative fees for the AAA to administer consumer arbitrations. Kohl’s declined to do so. As a result,  the AAA exercised its discretion to decline administration, closed the cases, and refunded Plaintiffs’ filing fees. Id. at *3.

Plaintiffs then filed suit in the U.S. District Court for the Central District of California, which was later transferred to the U.S. District Court for the Eastern District of Wisconsin pursuant to the forum selection clause,  petitioning the court to compel Kohl’s to register its arbitration agreement with the AAA, pay all necessary filing fees, and proceed to arbitration. Id.

The District Court’s Ruling

The U.S. District Court for the Eastern District of Wisconsin denied the petition. Relying on Wallrich v. Samsung Elecs. Am., Inc., 106 F.4th 609 (7th Cir. 2024), the district court found that the parties had bargained for the AAA to apply and interpret its own Consumer Arbitration Rules. Id. at *3. When the AAA exercised that discretion by closing Plaintiffs’ cases upon Kohl’s non-registration, the court concluded it lacked authority to override that decision. Id.

Plaintiffs filed an interlocutory appeal, arguing that Kohl’s refusal to register its agreement constitutes a refusal to arbitration in violation of the Federal Arbitration Act (“FAA”). Id.

The Seventh Circuit’s Decision

The Seventh Circuit affirmed. Id. at *7. It held that the AAA’s exercise of discretion in closing Plaintiffs’ cases “flowed directly from the parties’ agreement granting AAA that power, leaving nothing for the district court to compel under the Federal Arbitration Act.” Id.

Under the FAA, a party seeking to compel arbitration must establish: (1) an enforceable written arbitration agreement; (2) a dispute falling within the scope of the agreement; and (3) a refusal to arbitrate. Id. at *4 (citing Wallrich, Inc., 106 F.4th at 617-18).  The Seventh Circuit’s analysis centered on the third element, i.e. whether Kohl’s non-registration constituted a refusal to arbitrate. Id. 

The Seventh Circuit characterized the AAA’s registration requirement as a “forum-specific procedural gateway” matter – the kind of matter parties implicitly delegate to the arbitration provider when they agree to arbitrate under its rules. Id. at *6 (citing Howsam v. Dean Witter Reynolds, Inc., 537 U.S. 79, 85–86 (2002)).  Citing Howsam, 537 U.S. at 85, the Seventh Circuit reasoned that, absent contrary language in the arbitration agreement, parties who agree to AAA arbitration intend to withhold registration disputes from judicial review. Id. Because the AAA exercised its own discretion (consistent with the parties’ agreement) in closing the cases, there was “nothing for the district court to compel” under the FAA.  Id. at *7.

The Seventh Circuit also relied on its prior decision in Wallrich, which held that a defendant’s failure to pay AAA fees, which resulted in termination of the arbitration, did not constitute a refusal to arbitrate where the outcome flowed from the parties’ agreed-upon procedures.

The Dissent

Judge Joshua P. Kolar dissented.  In his view, Kohl’s non-registration “was a conscious step to depart from its agreement to arbitrate,” not a procedural question delegated to the AAA. Id. at *8.  Judge Kolar warned that the majority’s reasoning stretches Wallrich’s holding too far and effectively converts “any bilateral agreement to arbitrate under AAA’s Consumer Rules into something of a unilateral option-to-arbitrate for business.” Id. at *9.  Judge Kolar would have compelled Kohl’s to register so that the AAA could initiate proceedings. Id.

Implications for Companies

Bernal has immediate practical significance for companies facing mass arbitration exposure under AAA arbitration agreements. By simply declining to register its arbitration agreement with the AAA, a company can cause the AAA to close the proceedings without judicial recourse, at least in the Seventh Circuit. Businesses with AAA arbitration clauses in their consumer-facing agreements should assess whether this strategy is available and appropriate given their specific contractual language and forum.

That said, the dissent’s warning deserves attention. If other circuits adopt Judge Kolar’s reasoning, or if the AAA amends its rules in response, the window this decision opens may narrow. Companies should monitor developments carefully and consult counsel before relying on non-registration as a mass arbitration defense.

Posted on by Gerald L. Maatman, Jr.

Seventh Circuit Holds BIPA Amendment Applies Retroactively, Reversing Three Illinois Federal Court Decisions

By Gerald L. Maatman, Jr., Hayley Ryan, and Tyler Zmick

Duane Morris Takeaways: On April 1, 2026, in Clay et al. v. Union Pacific Railroad Co. et al., Nos. 25-2185 et al., 2026 WL 891902 (7th Cir. Apr. 1, 2026),  a three-judge panel of the U.S. Court of Appeals for the Seventh Circuit reversed three federal district court decisions and held that the August 2, 2024, amendment to Section 20 of the Illinois Biometric Information Privacy Act (“BIPA”) applies retroactively to cases pending at the time of enactment. The Seventh Circuit concluded that the amendment is remedial because it governs damages rather than liability and, therefore, applies retroactively under Illinois law.

This decision is a watershed win for BIPA defendants in the class action space. It significantly curtails potential exposure by confirming that plaintiffs may recover, at most, $5,000 in statutory damages for intentional violations or $1,000 for negligent violations per person, rather than on a per-scan basis that previously threatened astronomical liability.

Background

As the Seventh Circuit observed, “BIPA has become a font of high-stakes litigation.” Id. at *1.  In response to the Illinois Supreme Court’s decision in Cothron v. White Castle Sys., Inc., 216 N.E.3d 918, 926 (Ill. 2023), which held that BIPA claims accrue “with every scan or transmission” of biometric information, the Illinois General Assembly amended Section 20 of the BIPA in August 2024 to clarify the scope of recoverable damages. The amendment provides, in relevant part, that a private entity that collects or discloses “the same biometric identifier or biometric information from the same person using the same method of collection…has committed a single violation…for which the aggrieved person is entitled to, at most, one recovery under this Section.” 740 ILCS 14/20(b) (emphasis added).

The consolidated appeals arose from three cases asserting typical BIPA theories. Plaintiff Reginald Clay alleged that Union Pacific violated Section 15(b) by requiring repeated fingerprint scans to access the company’s facilities. Plaintiffs John Gregg and Brandon Willis alleged that their employers used biometric timekeeping systems in violation of Sections 15(a), (b), and (d).

The Seventh Circuit emphasized the extraordinary financial stakes. Plaintiff Clay alleged approximately 1,500 fingerprint scans – translating to $7.5 million in potential damages for a single plaintiff if damages were calculated on a per-scan basis.  2026 WL 891902 at *2.  In contrast, the putative class claims in Plaintiff Willis’ case exposed the defendant to billions of dollars in potential liability. Id.  The three interlocutory appeals posed the same legal question: whether the 2024 amendment to BIPA Section 20 applies retroactively to limit such exposure.

The Seventh Circuit’s Decision

The Seventh Circuit answered that question with a definitive “yes.” It held that the amendment to Section 20 applies retroactively to pending cases. Id. at *3. 

Applying Illinois retroactivity principles, the Seventh Circuit explained that where the legislature is silent on the temporal reach of the amendment, as here, courts look to Section 4 of the Illinois Statute on Statutes, which, in turn, directs the court to determine whether the amendment is substantive or procedural. Id. (citing Perry v. Dep’t of Fin. & Pro. Regul., 106 N.E.3d 1016, 1026-27 (Ill. 2018)). 

The Seventh Circuit concluded that the amendment is remedial and, therefore, procedural, because it governs damages rather than underlying liability. Id. at *4.  Central to this determination was the statutory text and structure. The legislature amended Section 20, which addresses liquidated damages, rather than Section 15, which sets forth the substantive requirements governing the collection and disclosure of biometric data.  The Seventh Circuit emphasized that the amendment does not alter “the rights, duties, and obligations of persons to one another,” which are the defining characteristics of substantive changes. Id. (citing Perry, 106 N.E.3d at 1034). Instead, the amendment focuses exclusively on the remedies available once a violation has been established.

The appellees argued that the Illinois Supreme Court’s decision in Cothron established that each biometric scan constitutes a separate “violation,” and that the amendment therefore effected a substantive change by transforming thousands of violations into a single recoverable event, thus “terminating millions of dollars of liability.” Id. at *4. The Seventh Circuit rejected this position, reasoning that it both misinterprets the statute and overstates Cothron’s holding. Id. at *5. The Court clarified that Cothron addressed only when claims accrue under Section 15 and did not consider the meaning of “violation” for purposes of damages under Section 20. Id.  According to the Seventh Circuit, that distinction was dispositive. Id.

Ultimately, the Seventh Circuit determined that the amendment does not alter the number of violations or the injuries alleged by plaintiffs but instead limits the damages that may be awarded for those violations.  As the Seventh Circuit explained, the amendment “simply changed the statutory award of damages available to plaintiffs, cabining the discretion of trial court judges when they fashion the remedy.” Id. at *6.  Accordingly, the Court held that the amendment is remedial in nature and applies retroactively. Id. at *7. It therefore reversed the district court decisions that had concluded otherwise. Id.

Implications for Companies

Clay is one of the most consequential BIPA defense rulings in years. It materially reshapes the litigation landscape in several key respects:

  • Caps on exposure: The decision eliminates the “per-scan” damages theory asserted by plaintiffs that drove outsized settlement pressure and bet-the-company risk.
  • Immediate impact on pending cases: Defendants in ongoing litigation now have strong grounds to limit damages and revisit class certification, settlement posture, and jurisdictional arguments.
  • Strategic leverage: The ruling provides powerful leverage in motion practice and settlement negotiations, particularly where plaintiffs previously relied on inflated damages models.
  • Deterrence of new filings: By significantly reducing potential recoveries, Clay may dampen the volume of new BIPA filings and recalibrate plaintiffs’ bar incentives.

In sum, Clay delivers a decisive, defense-friendly interpretation of BIPA’s damages framework. Companies facing biometric privacy claims should promptly assess how this ruling affects their litigation strategy and potential exposure.

Posted on by Gerald L. Maatman, Jr.

AbbVie Defeats Genetic Privacy Class Action Because Request For Plaintiff’s Family Medical History Was Not A “Condition Of Employment”

By Gerald L. Maatman, Jr., Tyler Zmick, and Hayley Ryan

Duane Morris Takeaways:  In Henry v. AbbVie, Inc., No. 23-CV-16830 (N.D. Ill. Mar. 20, 2026), Judge Manish S. Shah of the U.S. District Court for the Northern District of Illinois granted defendant’s motion for summary judgment and dismissed a claim brought under the Illinois Genetic Information Privacy Act (“GIPA”). In his ruling, Judge Shah determined that the alleged request for plaintiff’s family medical history (which history Plaintiff did not provide) during his pre-employment medical screening was not a “condition of employment.” The decision is welcome news for employers that ask employees to undergo medical exams. The ruling indicates that an employer does not necessarily request genetic information “as a condition of employment” by requiring an employee to undergo a medical exam (even if an employee is asked to disclose genetic information during the exam).

Background

Plaintiff Daniel Henry was assigned to work for Defendant AbbVie, Inc., a biopharmaceutical company. During the onboarding process, Plaintiff was required to undergo a “medical surveillance,” which included “questionnaires, blood work, and a brief physical exam.” Henry v. AbbVie, Inc., 2026 WL 788630, at *2 (N.D. Ill. Mar. 20, 2026).

AbbVie used Premise Health, a third-party healthcare provider, to conduct Plaintiff’s medical screening. During the screening, Premise Health nurses asked Plaintiff to complete a written questionnaire and to undergo a physical examination. “Section U” of the questionnaire asked for Plaintiff’s genetic information (specifically, his family medical history), though Plaintiff did not complete that part of the form. Plaintiff claimed that nurses also verbally asked for his family medical history during the physical exam. After the exam, Plaintiff worked at an AbbVie facility in Illinois for four months.

Plaintiff subsequently sued AbbVie under the GIPA, alleging that the company violated Section 25(c)(1) of the statute by “solicit[ing], request[ing], [or] requir[ing] . . . genetic information of a person or a family member of the person . . . as a condition of employment [or] preemployment application.”  410 ILCS 513/25(c)(1).

AbbVie first responded to Plaintiff’s Complaint by moving to dismiss under Federal Rule of Civil Procedure 12(b)(6). Judge Shah denied AbbVie’s motion to dismiss after determining that the family medical history information sought during the medical screening constituted “genetic information” under the GIPA. See Henry v. AbbVie, Inc., 2024 WL 4278070, at *5-6 (N.D. Ill. Sept. 24, 2024).

AbbVie later moved for summary judgment, arguing that: (1) AbbVie did not request Plaintiff’s genetic information because third-party Premise Health (not AbbVie) conducted the screening; (2) even if AbbVie requested Plaintiff’s genetic information, the request was inadvertent because the medical questionnaire instructed Plaintiff to not disclose genetic information; and (3) AbbVie did not condition Plaintiff’s work status or assignment on any request for his genetic information.

The Court’s Decision

The Court granted AbbVie’s motion for summary judgment. While the Court was not persuaded by AbbVie’s first two arguments, it concluded that AbbVie’s third argument warranted dismissal of Plaintiff’s GIPA claim.

Request for Genetic Information

The Court first considered whether AbbVie can be characterized as having requested Plaintiff’s family medical history despite third-party Premise Health having conducted the medical screening. In answering in the affirmative, the Court relied on the GIPA’s incorporation of certain protections found in the federal Genetic Information Nondiscrimination Act (“GINA”). See 410 ILCS 513/25(a) (“An employer … shall treat genetic testing and genetic information in such a manner that is consistent with the requirements of federal law, including but not limited to [GINA].”). The Court cited a regulation promulgated under GINA providing that an employer that requires employees or applicants to undergo medical examinations “must tell health care providers not to collect genetic information, including family medical history, as part of a medical examination intended to determine the ability to perform a job.” 29 C.F.R. § 1635.8(d). Based on this federal regulation, the Court concluded that AbbVie “[n]ot telling Premise Health to elicit genetic information is not enough; the [GIPA] requires an affirmative instruction not to elicit it.” Henry, 2026 WL 788630, at *5.

Inadvertent Disclosure

AbbVie’s second argument turned on the GIPA’s “inadvertent exception,” which states that “inadvertently requesting family medical history by an employer … does not violate this Act.” 410 ILCS 513/25(g). The Court observed that AbbVie’s health questionnaire advised Plaintiff to “not provide any genetic information, including family medical history.” Henry, 2026 WL 788630, at *6 (citation omitted). Thus, the Court held that the inadvertent exception barred Plaintiff’s claim to the extent it was premised on the written questionnaire. See id. (“The disclaimer on AbbVie’s form was enough to make any disclosure on the form inadvertent.”). But the Court determined that the exception did not necessarily bar Plaintiff’s claim to the extent it was premised on nurses orally asking for his family medical history. See id. (“[T]he written disclaimer in the form does not necessarily mean that [Plaintiff] knew that he should not disclose genetic information in response to verbal questions during his physical exam.”) (emphasis added).

Request as a Condition of Employment

Finally, the Court turned to AbbVie’s argument that Plaintiff’s claim failed because any request for his family medical history was not a condition of his employment. See 410 ILCS 513/25(c)(1) (an employer may not “solicit, request, [or] require … genetic information of a person or a family member of the person … as a condition of employment [or] preemployment application”) (emphasis added). The Court agreed with AbbVie and granted the company’s motion for summary judgment on this basis, holding that no genuine issue of material fact existed regarding AbbVie’s request for Plaintiff’s family medical history not having been a condition of his employment. The Court further noted that “the request for genetic information on the written questionnaire was not a condition of [Plaintiff’s] employment, for the simple fact that [Plaintiff] did not fill out that section and it did not affect his employment with AbbVie.” Henry, 2026 WL 788630, at *6.

Moreover, the Court concluded that even if Plaintiff was required to undergo a medical exam to be eligible to work at AbbVie, that did not mean that the verbal request for his family medical history (made during the exam) was a condition of his employment. See id. at *7. The Court thus recognized an important distinction between (i) AbbVie requiring Plaintiff to undergo a medical screening as a condition of employment and (ii) AbbVie specifically requesting Plaintiff’s family medical history as a condition of employment. See id. (“[T]hat [Plaintiff] could not decline to complete his medical surveillance does not create a genuine dispute over whether the verbal request during his exam was a condition of his employment. The undisputed evidence is that a contractor could decline parts of the surveillance and still have the surveillance considered completed.”). Accordingly, because AbbVie did not condition Plaintiff’s employment on a request for his genetic information, the Court granted summary judgment in the company’s favor.

Takeaways For Companies

As noted in a prior blog post, recent decisions suggest that courts may be hesitant to dismiss GIPA claims (especially at the pleading stage). Given the GIPA statute’s strict penalty provision – under which statutory damages can quickly become significant ($2,500 per negligent violation and $15,000 per intentional or reckless violation, see 410 ILCS 513/40(a)(1)-(2)) – we have advised employers to ensure they comply with the statute regarding any health screenings they ask applicants or employees to complete (including by explicitly advising applicants and employees not to disclose their family medical histories during the screenings).

In this plaintiff-friendly litigation landscape, the Henry decision comes as welcome news for GIPA defendants and companies that have employees undergo medical screenings. Importantly, Henry suggests that an employer does not necessarily violate the GIPA by requesting an employee’s genetic information “as a condition of employment” by merely directing her to undergo a medical exam (during which the employee may or may not be asked to provide her family medical history).

© 2009- Duane Morris LLP. Duane Morris is a registered service mark of Duane Morris LLP.

The opinions expressed on this blog are those of the author and are not to be construed as legal advice.

Proudly powered by WordPress