Should websites pay to record mouse clicks and keystrokes?
It looks like Florida internet users won’t be getting paid for visiting commercial websites that track their mouse clicks and keystrokes.
Activity tracking software used by wholesale club Costco did not violate a state law barring wiretapping because it doesn’t intercept any “content,” a federal judge in Fort Lauderdale has ruled. Similar lawsuits against owners of other merchant websites have been slapped down as well in recent months.
The Sept. 9 ruling by U.S. District Judge Rodolfo A. Ruiz was the latest dismissal of what Ruiz called a “flurry of virtually identical cases” claiming that companies’ use of so-called session replay software was illegal because users did not first provide consent.
The suit, filed in February on behalf of Palm Beach County resident Jason Goldstein, accused Costco of using “tracking, recording and/or ‘session replay’ software to intercept” communications with Costco’s website, including their mouse movements and clicks, keystrokes, pages visited, search terms used and content viewed.
Users were injured, the suit claimed, because the software invaded their privacy and exposed their private information.
Florida’s Security of Communications Act prohibits interception of any electronic communication or intentional use of “the contents of any wire, oral or electronic communication,” the suit notes.
The suit, which sought class action status, sought a declaration from Costco that its software violated Florida wiretapping law and an injunction barring Costco from “intercepting the electronic communications” of its website visitors without their knowledge and consent.
It also sought $100 a day for each day of violation or $1,000, whichever was higher, for each member of the would-be class, along with attorney’s fees and other costs.
Costco responded with a motion to dismiss the suit, saying its session replay software was designed to help website operators understand how visitors interact with their site and to identify user-interface problems.
Costco’s motion seeking dismissal said the lawsuit was one of more than 30 “copy-and-paste” suits throughout Florida filed by the same attorneys. Because of the strategy, the complaint against Costco contained no actual details about Goldstein’s actual interactions with Costco’s site, Costco’s attorneys wrote.
Three South Florida firms represented Goldstein in the suit against Costco, court record show. They are Miami-based Shamis & Gentile, P.A.; Fort Lauderdale-based Hiraldo P.A.; and Edeslberg Law P.A., based in Aventura.
Attorneys for the two sides did not respond to emails seeking comment for this story.
In his ruling, Ruiz said the plaintiff sought to persuade the court to reinterpret the wiretapping law, which bars interception of the “contents” of any wire, electronic or oral communication through the use of any electronic, mechanical or other device. The law specifically excludes “any communication from an electronic or mechanical device which permits the tracking of the movement of a person or an object,” Ruiz wrote.
Mouse clicks, pages viewed, scroll movements and other actions do not convey contents or communication, Ruiz said, adding that software that tracks movements on websites is the cyber equivalent of a security camera at a brick and mortar store.
Similar claims have been filed over the past year against large commercial companies throughout the United States, particularly in California and Florida, according to a March blog entry by attorneys with Philadephia-based Ballard Spahr P.A., which specializes in business litigation, including cybersecurity claims.
Most of the cases have been dismissed based on similar reasoning that the tracking software does not record content, said Phil Yannella, one of the blog entry’s authors, in an email on Monday. Another reason mentioned in the blog entry is that website owners aren’t illegally intercepting information if they own the sites where the information is collected. Also, many sites disclose the use of website analytics in their privacy sections, the authors pointed out.
Yannella said he knows of no court that has allowed a similar suit to proceed. “Perhaps because of this I’ve noticed that other plaintiffs have begun to voluntarily dismiss claims as well, including in some of my cases,” he said.
The claims differ from a landmark case that the Supreme Court recently allowed to proceed against social media giant Facebook, the blog entry noted. In that case, Facebook is accused of collecting users search requests from third-party sites embedded with Facebook’s Like button and then selling that data to other companies.