{"id":2287,"date":"2025-07-11T11:22:23","date_gmt":"2025-07-11T15:22:23","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=2287"},"modified":"2025-07-11T11:22:24","modified_gmt":"2025-07-11T15:22:24","slug":"ninth-circuit-affirms-summary-judgment-for-defendant-on-cipa-claim-for-aiding-and-abetting-third-party-software-provider","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2025\/07\/11\/ninth-circuit-affirms-summary-judgment-for-defendant-on-cipa-claim-for-aiding-and-abetting-third-party-software-provider\/","title":{"rendered":"Ninth Circuit Affirms Summary Judgment For Defendant On CIPA Claim For Aiding And Abetting Third-Party Software Provider"},"content":{"rendered":"
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

By Gerald L. Maatman, Jr., Justin Donoho, and Ryan Garippo<\/strong><\/p>\n\n\n\n

Duane Morris Takeaways:<\/em><\/strong>\u00a0 On July 9, 2025, in Gutierrez, et al. v. Converse, Inc., No. 24-4797, 2025 WL 1895315 (9th Cir. July 9, 2025), the Ninth Circuit\u00a0affirmed<\/u>\u00a0<\/a>that a plaintiff had no evidence from which a reasonable jury could conclude that an online retailer\u2019s use of third-party software to enable a chat feature on its website aided and abetted the third-party vendor in reading or attempting to read the contents of the plaintiff\u2019s chat messages real-time in alleged violation of the California Invasion of Privacy Act (CIPA).\u00a0 In rejecting this theory, the ruling is significant because it shows that CIPA claims involving alleged disclosures of website activities to third-party software providers cannot survive unless the plaintiff can show that the website owner enabled the third party to read unencrypted, real-time communications.\u00a0<\/em><\/p>\n\n\n\n

Background<\/strong><\/p>\n\n\n\n

This case is one of a legion of class actions that plaintiffs have filed nationwide alleging that third-party software embedded in defendants\u2019 websites secretly captured plaintiffs\u2019 web-browsing activity and sent it to the third-party provider of the software.  Third-party software is a common feature on many websites today and comes in many forms including website advertising technologies (\u201cadtech\u201d), customer relationship management (\u201cCRM\u201d) software, enterprise resource management (\u201cERP\u201d) software, and, as in this case, communications platforms.<\/p>\n\n\n\n

In Gutierrez<\/em>, Plaintiff brought suit against an online retailer.  According to Plaintiff, the retailer installed a chat feature on its public-facing website and thereby transmitted chat communications entered on the website to Salesforce, a third-party provider of the chat feature to the online retailer in the form of \u201csoftware as a service\u201d (\u201cSaaS\u201d).  2024 WL 3511648, at *2 (C.D. Cal. July 12, 2024). <\/p>\n\n\n\n

As usual since the Snowden disclosures in 2013, all of these transmissions between the web user, website, and third-party software provider were \u201cwere encrypted while in transit.\u201d  Id. <\/em>at *3.  Moreover, as is true for all internet communications, the chats were transmitted \u201cin different network packets.\u201d  Id.  <\/em>Thus, the uncontroverted expert evidence showed that \u201cit is \u2018virtually impossible\u2019 to learn the contents of an internet communication while it is in transit.\u201d  Id.<\/em><\/p>\n\n\n\n

The online retailer\u2019s chat data, including chat transcripts, were stored on Salesforce\u2019s servers.  Id.  <\/em>However, this information was accessible in unencrypted format only through the retailer\u2019s password-protected dashboard.  Id.  <\/em>Plaintiff offered no evidence to show that Salesforce had access to the retailer\u2019s dashboard or that the retailer ever provided Salesforce access to it.  Id.<\/em><\/p>\n\n\n\n

Based on these facts, Plaintiff argued that the retailer violated the CIPA by aiding and abetting Salesforce\u2019s wiretapping or attempts to learn her chat communications on the retailer\u2019s website. <\/p>\n\n\n\n

The District Court granted the retailer\u2019s motion for summary judgment for multiple reasons.  First, the District Court found as a matter of law that Salesforce did not violate CIPA\u2019s first clause prohibiting intentional wiretapping or making any unauthorized connection \u201cwith any telegraph or telephone wire, line, cable, or instrument\u201d because \u201cCourts have consistently interpreted this clause as applying only to communications over telephones and not through the internet.\u201d  Id. <\/em>at *6-7. <\/p>\n\n\n\n

Second, the District Court found no genuine dispute of material fact existed as to whether Salesforce had violated the second clause of CIPA, Section 631(a), \u201cbecause Plaintiff has presented no evidence from which a reasonable jury could conclude Salesforce intercepts messages sent through [the retailer]\u2019s chat feature \u2018while … in transit\u2019 or reads or attempts to read or learn the contents of such messages.\u201d  Id. <\/em>at *7.  As the District Court explained, \u201cuncontroverted evidence establishes messages sent through [the retailer]\u2019s chat feature are encrypted while in transit and, moreover, it is \u2018virtually impossible\u2019 to learn the contents of an internet communication while it is in transit because internet communications are transmitted \u2018in different network packets[.]\u2019\u201d  Further, the District Court stated that \u201cthe fact that a user is redirected to a Salesforce-owned URL upon opening the chat feature on [the retailer]\u2019s website does not establish the user\u2019s messages are sent to Salesforce or Salesforce reads or attempts to read or learn the contents of such messages. Rather, this fact simply establishes . . . the user\u2019s messages are transmitted to [the retailer]\u2019s Service Cloud application.\u201d  Id.  <\/em>In addition, the District Court explained that \u201cthe existence of UUID [Universally Unique Identifier] values attached to chat messages and the mere possibility Salesforce \u2018can\u2019 use these values to \u2018connect the dots\u2019 between data are insufficient to establish a genuine issue of material fact as to whether Salesforce reads or attempts to read users\u2019 messages while they are in transit.\u201d  Id.<\/em><\/p>\n\n\n\n

Finally, the District Court found that \u201cbecause Plaintiff has not established an underlying violation of Section 631(a)’s first or second clause by Salesforce, [the retailer] cannot be liable for aiding and abetting Salesforce.\u201d<\/p>\n\n\n\n

The Ninth Circuit\u2019s Opinion<\/strong><\/p>\n\n\n\n

The Ninth Circuit agreed with the retailer. It found that summary judgment for the retailer was warranted and affirmed the order below. <\/p>\n\n\n\n

In a short opinion, the Ninth Circuit affirmed the District Court\u2019s opinion by finding that \u201cno evidence exists from which a reasonable jury could conclude\u201d that Salesforce engaged in wiretapping or attempted to learn Plaintiff\u2019s chat communications on the retailer\u2019s website and, therefore, absent an underlying violation by Salesforce, no aiding and abetting liability by the retailer.  Id.<\/em>, at *1.<\/p>\n\n\n\n

Circuit Judge Jay Bybee agreed, filing a separate concurring opinion stating that the wiretapping claim should be affirmed because \u201cthe statute, as passed in 1967, focuses on the wiretapping of telegraph or telephone wires\u2014it criminalizes, as relevant here, the wiretapping of a telephone call\u201d and, thus, CIPA\u2019s clause prohibiting wiretapping \u201cdoes not apply to the internet.\u201d  Id. <\/em>at *2-3.  Further, Judge Bybee opined: \u201cUntil and unless the California appellate courts tell us otherwise, or the California legislature amends \u00a7 631(a), I refuse to apply \u00a7 631(a)\u2019s first clause to the internet.\u201d  Id. <\/em>at *3. <\/p>\n\n\n\n

Implications For Companies<\/strong><\/p>\n\n\n\n

The District Court\u2019s holding and Ninth Circuit\u2019s affirmance in Gutierrez<\/em> are a win for CIPA class action defendants and should be instructive for courts around the country.  In the hundreds of CIPA class actions alleging a defendant\u2019s disclosure of web-browsing activities to an adtech provider, for example, the plaintiff typically does not allege that the adtech provider has any ability to read any unencrypted version of the information disclosed.  This is not surprising, since the largest adtech providers often alleged in CIPA adtech class actions typically encrypt, anonymize, aggregate, and otherwise prevent their own ability to access web users\u2019 browsing activities in any unencrypted format. <\/p>\n\n\n\n

Gutierrez <\/em>shows that adtech plaintiffs will need to show, however, that the owner of the website they visited enabled the third party adtech provider to read unencrypted, real-time communications, in order to prove their CIPA claims.<\/p>\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Justin Donoho, and Ryan Garippo Duane Morris Takeaways:\u00a0 On July 9, 2025, in Gutierrez, et al. v. Converse, Inc., No. 24-4797, 2025 WL 1895315 (9th Cir. July 9, 2025), the Ninth Circuit\u00a0affirmed\u00a0that a plaintiff had no evidence from which a reasonable jury could conclude that an online retailer\u2019s use of … <\/p>\n

Continue reading “Ninth Circuit Affirms Summary Judgment For Defendant On CIPA Claim For Aiding And Abetting Third-Party Software Provider”<\/span><\/a><\/p>\n","protected":false},"author":575,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"ppma_author":[7,122,127],"class_list":["post-2287","post","type-post","status-publish","format-standard","hentry","category-privacy-class-actions"],"authors":[{"term_id":7,"user_id":575,"is_guest":0,"slug":"gmaatman","display_name":"Gerald L. Maatman, Jr.","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2022\/09\/maatmangerald-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":122,"user_id":686,"is_guest":0,"slug":"jrdonoho","display_name":"Justin Donoho","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2025\/02\/donohojustin-1-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""},{"term_id":127,"user_id":692,"is_guest":0,"slug":"rgarippo","display_name":"Ryan Garippo","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2024\/09\/garipporyan-100x100.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/575"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=2287"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/2287\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=2287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=2287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=2287"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=2287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}