Avoiding and Defending Class Action Claims Under the Florida Security of Communications Act

A new class action trend aimed at large companies has emerged in the United States. New York, California, and Florida have been the breeding grounds for these class action claims brought under each state’s “wiretapping” laws. More specifically, classes bringing these claims have accused companies of violating wiretapping laws by tracking user data on their websites using “session replay software.” Classes have filed complaints in Florida alleging that companies have violated the Florida Security of Communications Act (“FSCA”). This article will provide an overview of FSCA, the issues likely to arise in these class action lawsuits, and how companies can avoid and defend against this new class action trend.

What Is the Florida Security of Communications Act?

The Florida Security of Communications Act is codified in Chapter 934, Florida Statutes. The Florida Legislature’s intent in adopting FSCA is to protect the privacy of innocent people. Fla. Stat. § 934.01(4). The statute also places an emphasis on avoiding the use of illegally intercepted wire and oral communications in legal and administrative proceedings, but it acknowledges the importance of capturing wire communications for use as evidence against organized criminals. Fla. Stat. § 934.01(2)-(3).

The relevant statute in this new class action trend is Section 934.03, Florida Statutes, which prohibits the interception, attempt to intercept, or procurement of another to intercept or attempt to intercept any wire, oral, or electronic communication. Fla. Stat. § 934.03. FSCA also prohibits the use of any electronic, mechanical, or other device for the purpose of intercepting an oral communication. Id.

Under FSCA, “electronic communication” is defined as “any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photoelectronic, or photooptical system that affects intrastate, interstate, or foreign commerce.” Fla. Stat. § 934.02(12).

The classes in the emerging trend claim that companies have violated FSCA by using “session replay” software to track user activity on their websites. Session replay software allows companies to keep track of certain user interactions including mouse clicks, typing, scrolling, swiping, and time spent on different parts of a webpage. The classes argue that this type of information fits the definition of “electronic communication” as set forth by Section 394.02(12), Florida Statutes. FSCA’s definition of electronic communication is rather broad. However, whether or not information tracked by session replay software does constitute electronic communication under Florida law will likely be a hotly debated issue.

What Are the Big Issues in These FSCA Class Action Lawsuits?

The nature of FSCA makes claims arising out of it ripe with factual questions.  In addition to the preliminary issue of whether the act of recording website user data falls under the scope of FSCA, more complex issues arising out of FSCA’s consent and reasonable expectation of privacy standards will be the focus of these FSCA class action lawsuits.

Did the Class Members Consent?

Perhaps the biggest issue that will be disputed in these FSCA class action lawsuits is whether the class members consented to being recorded.  The issue of consent will unfold differently across different states, as each state has its own laws regarding whether the consent of both parties or just one party is enough to prevent liability under wiretapping statutes.  In one-party consent states, such as New York and North Carolina, only one party’s consent is required for a recorded communication to avoid liability.  Florida, on the other hand, is a two-party consent state, meaning that both parties to a communication must consent to it being recorded to avoid liability under FSCA. Fla. Stat. § 934.03(2)(d).  Naturally, this raises the question of whether both parties have consented in the factual scenarios leading to these class action claims.  Any of the entities who own a website and use session replay software quite obviously consent to tracking user activity.  The trickier question is whether the class members have consented to being tracked.

There are two popular ways for businesses to request that visitors on their sites agree to the business’ terms and conditions—clickwrap and browsewrap.  Clickwrap terms are less troublesome, because they require website users to affirmatively and actively give consent to terms and conditions by clicking a pop-up box that states, “I agree to the terms & conditions,” or the like, before using the website or a specific feature of the site.  Businesses who use clickwrap terms and conditions generally have an easier time establishing that a user consented to the terms, because users are always presented with the terms and conditions and the user must give consent before using the website.

Unlike clickwrap terms which present themselves to each user, browsewrap terms are posted on a webpage, usually near the bottom.  While browsewrap terms are available to read for any user who clicks on the relevant link, users are not automatically presented with browsewrap terms, and users are not required to affirmatively accept the terms.   The passive nature of browsewrap terms makes them vulnerable to factual issues such as whether or not the user saw the terms or whether or not the terms were conspicuous enough that the user should have seen them. See Vitacost.com, Inc. v. McCants, 210 So. 3d 761 (Fla. 4th DCA 2017) (holding that browsewrap terms are only enforceable when a user has knowledge of the terms and that the company’s terms were not presented conspicuously enough to confer knowledge on the user).

The issue of consent in Florida FSCA class action cases will likely turn both on whether the defendants used clickwrap or browsewrap terms on their websites and, more importantly, whether the terms included a provision whereby the class members consented to having their online activity tracked.

Did the Class Members Have a Reasonable Expectation of Privacy?

No liability exists in an FSCA claim where the plaintiff did not have a reasonable expectation of privacy.  Jatar v. Lamaletto, 758 So. 2d 1167 (Fla. 3d DCA 2000). Thus, defendants in FSCA class action lawsuits will likely seek to avoid liability on the basis that class members had no reasonable expectation to privacy when using the defendant’s website. However, it is well settled that the issue of reasonableness is fact specific.  In terms of oral communications, individuals cannot claim to have a reasonable expectation to privacy when speaking loudly in a crowded public space, but not every question of reasonableness is as clear cut.  In State v. Inciarrano, a 1985 Florida Supreme Court case, the majority and concurring opinions drew distinctions between the expectations of privacy individuals may reasonably claim in their own homes as compared to their own business offices or even then offices of another. 473 So. 2d 1272 (Fla. 1985).

The internet is a notoriously public place, and everyone knows that they should never post anything on the internet that they do not want others to see.  In O’Brien v. O’Brien, the applied FSCA to a woman’s interception of her ex-husband emails holding that such an interception was a violation of FSCA. 899 So. 2d 1133 Fla. 5th DCA).  The court’s holding implies that individuals have a reasonable expectation to privacy when communicating through email.  However, simply browsing the web seems inherently different from sending email communications to a specific person.  Therefore, the progression of FSCA class action lawsuits through the Florida court system will likely involve Florida courts deciding whether browsing and clicking on the internet merits an expectation of privacy more akin to speaking in one’s home, out in public, or somewhere in between.

Avoiding and Defending Class Action Claims Under FSCA

These Florida class action cases are still in the early stages of litigation, so courts have yet to provide guidance as to the merits of the classes’ claims. The cases leading the trend in California and New York have come to varying results. The New York cases have been dismissed, but at least one of the California cases has survived the initial stages of litigation. Once Florida class action cases brought under FSCA have the opportunity to develop through the Florida courts, companies will have a better understanding of how courts apply FSCA to session replay and other tracking software. Until then, here are two ways in which companies can avoid and defend against class action claims brought under FSCA.

1. Obtain User Consent

Another way to avoid liability is to ask for user consent. Cohen v. Casper Sleep, Inc., a New York case that helped to kick off this trend, was dismissed the U.S. District Court for the Southern District of New York. No. 17CV9325, 2018 WL 3392877 (S.D.N.Y. July 12, 2018). One reason for the court’s dismissal of the Cohen class’ claim was that the federal statute, 18 U.S.C. § 2511, under which the class brought its claim is a “one-party consent statute.” Like § 2511, FSCA provides a consent exception to its normal prohibition on the interception of electronic communications. As discussed above, FSCA requires that all parties to the communication have given prior consent to being recorded. Fla. Stat. § 934.03(2)(d). Providing users notice of your company’s “session replay” software and asking for affirmative permission to track user data will help you avoid liability under FSCA.  To effectively prevent and defend future FSCA class action lawsuits, Florida companies should present their website terms and conditions in clickwrap form, rather than browsewrap, and be sure to include terms whereby users consent to having their website activity recorded.

By obtaining user consent to your website’s terms, you can also enforce other provisions of the terms that may help in defending against a class action suit such as a forum selection clause or an arbitration provision that includes a class action waiver.  Arbitration clauses containing class action waivers, which are enforceable under the Federal Arbitration Act, require potential plaintiffs to arbitrate FSCA claims individually rather than as a class.  See McKenzie Check Advance of Florida, LLC v. Betts, 112 So. 3d 1176 (Fla. 2013). Plaintiffs will be less likely to individually arbitrate their own FSCA claims, thereby reducing the number of claims and decreasing the liability that potential defendants in an FSCA class action would incur.

2. Pay attention to the type of information your company collects

FSCA is specifically aimed at electronic communications. Certain actions on a website, such as typing information into forms or answering prompted questions, can more easily be considered communications under FSCA. Scrolling, time spent on certain portions of a page, and intra-site travel seem less likely to fall under the definition of electronic communication. In addition, such actions can be legitimately useful to companies for evaluating and improving the performance of their websites. Unfortunately, as stated above, FSCA’s definition is broad and Florida courts have yet to say whether FSCA’s definition of electronic communication encompasses the activities tracked by session replay software.

The types information your company tracks may impact whether the user has a reasonable expectation to privacy or not.  Users who input personal information or financial information into websites may be entitled to a greater expectation of privacy than those who simply watch or read web content.  This is similar to the difference in reasonable expectations of privacy when speaking at home versus in a crowded supermarket.  Choosing to avoid tracking personal information may decrease the level of privacy that can be reasonably expected by users, therefore reducing potential liability for your business.

Conclusion

Companies tracking user data on their websites should be aware of the class action litigation trend arising under FSCA. However, there are still questions that remain with respect to the merits of the Florida class action claims. More specifically, Florida court still must determine whether the information tracked by session replay software constitutes electronic communications and whether these claims fall under the scope of FSCA in general. Until these questions are answered by the Florida judiciary, minimizing the user data your company tracks and asking for user permission are ways to avoid and defend against class action litigation under FSCA.