Podcast Summary: Episode 11 – Elisa Hutnick on SEPA Lawsuits and the Implications for Privacy Law

The Monopoly Report, hosted by Ari Paparo, delves deep into the intricate world of antitrust issues affecting the global advertising economy. In Episode 11, released on December 18, 2024, Paparo engages in a comprehensive discussion with Elisa Hutnick, Partner and Chair of the Privacy Practice at Kelly, Dry & Warren. Elisa is renowned for her expertise in privacy within the ad tech sector and active involvement in industry associations such as the IAB and NAI. This episode centers on SEPA (the California Information Privacy Act) lawsuits and their broader implications for privacy law.

1. Historical Context of Wiretapping Laws

The conversation begins with a historical overview of wiretapping laws in the United States. Alan Chappell, the host, traces the origins of wiretapping back to the Civil War era, highlighting its evolution from intercepting telegraph messages to its use by the NYPD in the 1920s against bootleggers and organized crime. He further discusses the surveillance activities in the 1950s and 1960s, including the monitoring of Martin Luther King Jr., which led to increased scrutiny under the Fourth Amendment.

Notable Quote:
“The first examples of wiretapping go actually back to the Civil War... to eavesdrop on conversations.” – Alan Chappell [00:00]

2. Understanding SEPA and Its Impact on Ad Tech

Elisa Hutnick elucidates SEPA’s role in modern privacy law, emphasizing its stringent consent requirements. Unlike older wiretapping laws from the '60s to '80s, SEPA introduces significant monetary exposure for businesses that fail to comply. She explains how current ad targeting techniques, such as firing tags on websites (e.g., URL, IP addresses), can inadvertently violate SEPA, leading to hefty statutory damages.

Notable Quote:
“When I go to your website and those tags are firing on your site, you are intercepting... that is a wiretap violation under certain state laws.” – Elisa Hutnick [03:15]

3. The Rise of Private Right of Action in Privacy Lawsuits

Hutnick highlights the critical shift from government-only enforcement to the introduction of private rights of action. This change allows individuals to sue companies directly, leading to a surge in lawsuits. Over the past year, more than 200 lawsuits have been filed, with numbers rapidly approaching the thousands. This shift has been a game-changer, as businesses now face a flood of private litigations rather than relying solely on government oversight.

Notable Quote:
A private right of action means rap for business. And so what we've seen... approaching thousands.” – Elisa Hutnick [05:52]

4. Current Wave of SEPA and Wiretapping Lawsuits vs. Past Cases

Comparing the current lawsuits to historical cases like those against DoubleClick and PharmaTrack Atlas, Hutnick notes that past cases were primarily under federal laws such as the Wiretap Act and Stored Communications Act, which were interpreted narrowly by the courts. In contrast, the present wave leverages state-level SEPA claims, which vary significantly in their interpretations across different jurisdictions, notably within California.

Notable Quote:
“Those were brought primarily under the federal Wiretap act... today... we have state claims and we have particular states that are really hot button.” – Elisa Hutnick [07:23]

5. Geographic Focus: California and Beyond

While California remains the epicenter for SEPA-related litigation, other states with two-party consent laws are also seeing an uptick in lawsuits. States like Massachusetts, Arizona, and Florida are exploring various theories to find legal hooks, although success rates vary. The inconsistent rulings across different regions complicate the legal landscape for businesses operating nationally.

Notable Quote:
“California, I would say is by and large the hottest kind of part of where all the activity is happening.” – Elisa Hutnick [08:34]

6. Creativity of Class Action Litigants

Challenging the conventional, Hutnick remarks on the ingenuity and persistence of class action litigants. They have successfully repurposed existing laws, such as the Video Privacy Protection Act, to target ad tech companies by framing digital advertising practices as violations, showcasing their ability to adapt and exploit legal nuances.

Notable Quote:
“They were able to convince... that a video website is a videotape manufacturer under the video privacy Protection Act.” – Alan Chappell [09:49]

7. Implications for Ad Tech Practices

The discussion shifts to how wiretapping lawsuits affect ad tech operations. Hutnick explains that any website utilizing digital advertising or analytics tools—like retargeting pixels or Google Analytics—is at risk. She points out that flawed implementations, such as incorrect cookie banners that don’t comply with SEPA requirements, exacerbate legal vulnerabilities.

Notable Quote:
“It's really any website that has any kind of digital advertising or analytics...” – Elisa Hutnick [11:24]

8. Mitigation Strategies for Companies

To navigate the complex legal environment, Hutnick advises companies to adopt more intentional and precise consent mechanisms. This includes crafting clear privacy policies, ensuring affirmative user consent before activating tags, and fostering effective communication between legal, technical, and marketing teams. Such strategies are essential to mitigate the risk of costly litigation.

Notable Quote:
“If you're going to use a banner, be really intentional about what the language says and what the choices are.” – Elisa Hutnick [23:50]

9. The Oracle Case and Its Significance

Elisa discusses the Oracle case as a pivotal moment in the application of SEPA claims against data brokers. Oracle's extensive use of sensitive personal information, coupled with wiretap claims, led to a substantial settlement. This case underscores the heightened risks for companies dealing with sensitive data and the importance of robust privacy practices.

Notable Quote:
“There were pages and pages and pages in that complaint that really honed in on using just very sensitive personal information...” – Elisa Hutnick [14:29]

10. US vs. EU Consent Regimes

While comparing the US and EU approaches to consent, Hutnick opines that the US is unlikely to adopt an EU-style comprehensive consent framework. Instead, the US will continue with its patchwork of state laws, leading to varied and region-specific compliance requirements. This fragmented approach poses challenges for nationwide businesses striving for uniform compliance.

Notable Quote:
“I don't think we're going to see that because we have patchwork.” – Elisa Hutnick [18:24]

11. Future Outlook: Post-Third-Party Cookies

Discussing the future beyond third-party cookies, Hutnick anticipates that litigation will persist, adapting to new tracking technologies such as AI-based tools and APIs. Although removing cookies might complicate some legal claims, the continuous evolution of tracking methods will ensure that lawsuits remain a significant concern for ad tech companies.

Notable Quote:
“There's going to be another flavor. We are seeing it with chatbots, we see it with AI based technology on site.” – Elisa Hutnick [20:58]

12. Private Right of Action and CCPA Nuances

The conversation delves into the complexities of the California Consumer Privacy Act (CCPA) in relation to private rights of action. While CCPA provides some protections, inconsistent court rulings create uncertainty. Hutnick notes that companies often face conflicting interpretations of whether they qualify as service providers, further complicating legal defenses.

Notable Quote:
“We are not in the run stage to have clear lines.” – Elisa Hutnick [25:10]

13. Recent FTC Enforcement and Its Implications

Hutnick addresses recent enforcement actions by the Federal Trade Commission (FTC) against data brokers like Mobilewalla, focusing on the misuse of sensitive geolocation data. She emphasizes the FTC’s increasing focus on accountability and supply chain trust, highlighting that technical standards and diligent oversight will be crucial in meeting regulatory expectations.

Notable Quote:
“There is an emphasis on what is, what is reasonable diligence and then reasonable oversight and monitoring.” – Elisa Hutnick [27:08]

14. Tips for Avoiding SEPA and Wiretap Entanglements

To conclude, Hutnick offers practical advice for businesses aiming to steer clear of SEPA and wiretap-related lawsuits:

• Clear Consent Language: Use precise and unambiguous language in consent banners.
• Affirmative Consent: Ensure that user consent is obtained before activating any tracking tags.
• Comprehensive Privacy Policies: Clearly outline data usage and sharing practices.
• Legal-Arts-Tech Communication: Foster robust communication channels between legal, technical, and marketing departments to ensure compliance.
• Arbitration Agreements: Incorporate arbitration agreements to mitigate the risk of mass class action lawsuits.

Notable Quote:
“There are ways to mitigate the risk of being an oracle in terms of facing those that really massive liability.” – Elisa Hutnick [24:57]

15. Conclusion

The episode wraps up with Hutnick expressing optimism about the industry's shift towards better privacy practices, albeit acknowledging the challenges ahead. She underscores the necessity for businesses to adapt proactively to the evolving legal landscape to protect themselves from significant financial and reputational damages.

16. Personal Insights: Elisa’s Hobbies

In a lighter moment, Elisa shares her passion for yoga, highlighting its role in maintaining her well-being amidst a demanding legal career. This personal touch underscores the importance of work-life balance, especially in high-stress professions.

Notable Quote:
“I'm a devoted yogi. I've been doing it... when I'm upside down, I can do a 10 minute head stand and that's my happy place.” – Elisa Hutnick [31:38]

Closing Thoughts

Episode 11 of The Monopoly Report offers an invaluable deep dive into the intersection of wiretapping laws and the ad tech industry, featuring expert insights from Elisa Hutnick. For businesses navigating the complex terrain of privacy laws, this episode serves as a crucial resource, highlighting the importance of proactive compliance and strategic mitigation to safeguard against burgeoning legal threats.

For more in-depth analyses and future discussions, subscribe to The Monopoly Report podcast on Spotify, Apple Podcasts, YouTube, or visit Monopoly Market tv.