Examples:

• • A website using third-party code that captures visitors’ IP addresses and device info to identify them would likely be using a “trap and trace device” under CIPA.
  • An online retailer allowing a marketing company to track all of a consumer’s clicks and searches on their site to profile them, without consent, may violate CIPA’s ban on unauthorized eavesdropping.
  • Even if a terms of service vaguely references potential tracking somewhere, a company still needs express consent and a court order to capture data that could ID a user under CIPA.
  • If a company used trap and trace methods that harmed you, you could potentially sue them under CIPA for $5K or three times your damages per violation, whichever is more.
  • CIPA was enacted in 1967 but still very much applies to modern digital tracking tech and methods – websites aren’t exempt from its privacy protections and restrictions.

Key Takeaways:

• • CIPA is a key California privacy law that restricts the secret recording/tracing of electronic communications, including on websites.
  • Companies need consent and court approval to deploy “trap and trace devices” that can identify/track the sources of digital communications.
  • CIPA allows individuals to sue violators for unauthorized eavesdropping or trap and trace activities, with minimum statutory damages of $5,000 per violation.
  • The core claim in the Puma class action is that the company illegally used TikTok tracking software on its website amounting to an unlawful “trap and trace device.”
  • Understanding CIPA is crucial to grasping the basis and stakes of the Puma lawsuit and how it fits into broader debates around online privacy and corporate surveillance.

FAQs:

• • Does CIPA apply to all websites or just those of California companies? CIPA can apply to any website accessible to California residents, even if the company is based elsewhere.
  • If I agreed to terms of service, can I still sue under CIPA? Likely yes, as CIPA requires specific consent to eavesdropping/tracing and TOS agreements often don’t meet this standard.
  • What if a website only collected my IP address – does that violate CIPA? Possibly, if the IP address was captured without consent in a way likely to identify you as the source of communications.
  • Are companies allowed to track my online activity at all under CIPA? Yes, but only with your express consent and proper court oversight – secret, unauthorized tracing is prohibited.
  • How do I know if a website used an illegal trap and trace device on me? Look out for signs like your data being captured/sent without affirmative consent or sites knowing more about you than their privacy policy discloses.

Analogies:

• • TikTok tracking code on Puma’s site is like a salesperson following you around a store, recording everything you look at, and radioing that info back to HQ to add to your customer file.
  • “Fingerprinting” visitors is like a store using your credit card, phone, address or other available details to ID you as you walk in, even if you don’t announce yourself.
  • The TikTok software instantly capturing data as soon as you land on Puma’s site is like a store scanning your license plate and running your profile the moment you pull into the parking lot.
  • AutoAdvanced Matching definitively linking your Puma browsing to your identity is like a store scanning your driver’s license to make sure they know exactly who you are.
  • TikTok code following you across Puma’s site is like a store’s security camera tracking your every move up and down the aisles, compiling a dossier on your behavior.

Key Concerns:

• • The TikTok-Puma tracking allegedly happens without the visitor’s knowledge or consent, depriving them of choice over their data.
  • “Fingerprinting” raises extra privacy issues, as it can ID users even if they try to browse anonymously without logging in or volunteering info.
  • Immediate tracking means visitors have no chance to opt out before their data is captured, subverting the purpose of privacy notices/terms.
  • Definitively linking browsing to identity is intrusive, destroying any illusion of anonymity and tying online activity to offline identity.
  • Ongoing surveillance across pages creates an alarmingly detailed record of an individual’s interests, concerns, and habits for TikTok to exploit.

FAQs:

• • What kind of data does the TikTok code collect? Could include IP address, device details, location, pages visited, links clicked, items viewed, and more.
  • Does Puma’s site disclose the TikTok tracking? Allegedly not sufficiently or at all – that’s part of the basis of the illegal “trap and trace” claim.
  • Can I avoid being tracked by not clicking or entering info? No, the mere act of loading Puma pages with the code likely allows some tracking.
  • Does this tracking only affect Puma customers? No, any visitor to the Puma site could be tracked, even if they don’t make a purchase or have an account.
  • What does TikTok do with the collected data? Unclear, but likely uses it to build detailed user profiles for advertising, research, and strategic purposes.

Potential Implications:

• • If certified, the class action could include thousands of California Puma site visitors, amplifying pressure on the company and potential penalties.
  • A plaintiff win could force Puma to reform its tracking practices and disgorge significant sums, signaling risks to other companies using similar tools.
  • Applying CIPA to third-party tracking tools like the TikTok code could expand the law’s reach and rein in a common but controversial online data practice.
  • Puma may argue the TikTok tool doesn’t constitute a “trap and trace device” or that site terms/user consent preclude CIPA liability, raising novel legal Qs.
  • The case could influence evolving legal/industry standards around the responsibility of companies for the privacy impacts of embedded third-party site code.

Stakes for Consumers:

• • The case highlights the pervasive but often opaque data tracking that occurs when you browse mainstream commercial websites.
  • Consumers are frequently in the dark about which 3rd parties a site may allow to surveil them and how to meaningfully consent or opt out.
  • Ubiquitous tracking makes it hard for consumers to understand let alone control how their data is captured and used across the web.
  • Cases applying CIPA to online tracking put meat on the bones of consumer privacy rights and create consequences for violators.
  • The lawsuit could bring more clarity to when/how companies can be liable for the privacy sins of third-party code they use.

FAQs:

• • What are the criteria to be part of the class? Likely any California resident who visited the Puma website while the TikTok code was active and had their data collected.
  • Can I opt out of the class action? Yes, if the class is certified, members will have a chance to opt out and preserve their right to sue individually.
  • If Puma loses, will impacted consumers get paid? Potentially, the lawsuit seeks monetary damages that could be distributed to class members.
  • Does the lawsuit allege Puma broke other laws besides CIPA? No, the single claim is for violating CIPA’s “trap and trace device” restrictions.
  • Will this case impact Puma’s use of tracking tools going forward? Quite possibly, in terms of reforms, deterrence, and precedent-setting – that’s a key goal of the suit.

Quiz – Puma/TikTok Lawsuit Basics

• • 1. What California law is at the heart of the class action against Puma?
    • A) Consumer Privacy Act
    • B) Online Privacy Protection Act
    • C) Invasion of Privacy Act
    • D) Consumer Credit Reporting Agencies Act
  • 2. What Puma practice does the lawsuit allege violated the law?
    • A) Failure to have a privacy policy
    • B) Misuse of personal info collected at checkout
    • C) Use of TikTok tracking code on its website
    • D) Sharing data with 3rd party advertisers
  • 3. On whose behalf was the class action filed?
    • A) All US Puma customers
    • B) All Puma website visitors
    • C) CA residents who visited Puma’s site and had data tracked
    • D) All California Puma customers
  • 4. What key thing does the suit claim the TikTok code constituted under the law?
    • A) Hacking tool
    • B) Trap and trace device
    • C) Spyware
    • D) Wiretapping mechanism
  • 5. According to the complaint, what key thing was allegedly missing for the tracking?
    • A) User consent and court order
    • B) Adequate disclosure in privacy policy
    • C) Opt-out mechanism
    • D) Data security safeguards

Answers – Puma/TikTok Lawsuit Basics

• • 1. C) The California Invasion of Privacy Act (CIPA) is the law the class action claim is based on.
  • 2. C) The lawsuit alleges Puma’s use of TikTok tracking software on its website violated CIPA.
  • 3. C) The class action was filed on behalf of California residents who visited Puma’s site and had their data tracked.
  • 4. B) The complaint claims Puma’s TikTok tracking code amounted to an illegal “trap and trace device” under CIPA.
  • 5. A) A key issue was the alleged lack of user consent and a court order authorizing the tracking as CIPA requires.

Quiz – Puma/TikTok Tracking Details

• • 1. What Puma web pages was the TikTok tracking code allegedly embedded on?
    • A) Just the checkout page
    • B) Only product detail pages
    • C) Primarily the homepage
    • D) Throughout most of the site
  • 2. When does the TikTok tracking of a visitor allegedly begin?
    • A) When they click on an item
    • B) The moment they land on the site
    • C) After they accept cookies
    • D) When they create an account
  • 3. What does the lawsuit say the TikTok tracking aimed to do to site visitors?
    • A) Collect their banking details
    • B) Identify them individually
    • C) Gather their social media data
    • D) Surveil their physical location
  • 4. How does the TikTok code allegedly match tracked data to TikTok user profiles?
    • A) By capturing user logins
    • B) Via “fingerprinting” data points
    • C) By reading TikTok cookies
    • D) Through facial recognition
  • 5. What specific TikTok tool does the complaint call out for definitively IDing users?
    • A) AutoAdvanced Matching
    • B) Pixel Helper
    • C) Identity Mapper
    • D) Data Sync

Answers – Puma/TikTok Tracking Details

• • 1. D) The suit alleges the TikTok code was embedded across most pages of Puma’s website.
  • 2. B) According to the complaint, TikTok tracking starts the instant a user lands on Puma’s site, before they can even see or accept any terms.
  • 3. B) The class action asserts the TikTok tracking aimed to individually identify site visitors, not just anonymously track them.
  • 4. B) The lawsuit claims TikTok uses a “fingerprinting” process to match data collected on Puma’s site to its existing user database.
  • 5. A) The complaint specifically calls out TikTok’s “AutoAdvanced Matching” tool as scanning pages to definitively link browsing to user identity.