|
Neubauer Artists LLC
Getting your Trinity Audio player ready...
|
The cookie banner most US companies deploy was built to answer a European question. It notifies users before information is stored on their devices and sorts trackers into a familiar set of European categories. But no US law requires that notice, and those categories carry no legal weight here. Meanwhile, a fast-moving wave of private litigation is targeting exactly this mismatch, punishing banners that promise more than they deliver and overlooking the opt-out rights that US law actually confers. A consent management platform (“CMP”) tuned for Europe can, paradoxically, increase a company’s US exposure. US Companies should re-tailor their banners and CMP configurations to US statutory concepts and confirm that what the banner does matches what it says.
How We Got Here: The European Origins of the Cookie Banner
Cookies were initially created in response to European law. Article 5(3) of the EU ePrivacy Directive (Directive 2002/58/EC), as amended by Directive 2009/136/EC, requires consent before a website stores information on, or accesses information already stored on, a user’s equipment unless the storage or access is “strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by” the user. Over time, industry converged on four general categories for informing users about trackers: Strictly Necessary, Performance, Functional, and Targeting/Advertising. This taxonomy is generally approved by European regulators and are now commonplace in banners that greet visitors across the web.
Because most CMPs were engineered first and foremost for ePrivacy compliance, those four categories became the default presentation everywhere, including in the United States.
The US Framework
However, the United States has no domestic analog to Article 5(3). Just as importantly, the four European categories have no operative legal significance in the US They are a compliance vocabulary borrowed from a regime that does not govern here.
US privacy law does regulate the data flows a cookie banner touches, but not the way the European framework contemplates. The comprehensive consumer privacy laws now on the books in 23 states generally grant consumers the right to opt out of three processing activities:
- the sale of personal information;
- the sharing or processing of personal information for targeted advertising; and
- the processing of personal information for profiling that produces legal or similarly significant effects.
These often occur in part through third-party trackers managed by a CMP.
Organizations that are focused only on data written to or read from a device miss the compliance requirements in the US. Often, organizations correctly identify the data transfers US regulators are concerned with, but use language for European compliance risk litigation. Additionally, a growing list of states also require businesses to honor browser-level opt-out preference signals such as Global Privacy Control as an opt-out request that applies to the user’s activities across the business.
A CMP may be necessary to effectuate these opt-outs but it is not sufficient. To do the legal work required of it, the platform must be configured to actually suppress the relevant sale, share, and targeted-advertising tags when a consumer opts out; to consume and respect the GPC as an opt-out; and to present disclosures that map to US requirements.
The practical consequence is a banner that answers a question US law never asks, while remaining silent on the questions US law does ask. A visitor who selects “Strictly Necessary only” or clicks “Reject All” is making a choice framed entirely in European terms and may reasonably, but incorrectly, believe that choice has stopped all tracking. It often has not.
Risks of Misconfigured CMPs
Private litigation over cookie banners is rising sharply, and the theory of liability has shifted in a way that should concern any company relying on an off-the-shelf, EU-configured CMP.
The past few years have seen a sharp increase in private litigation under federal and state wiretapping statutes, unfair and deceptive acts, fraud theories, and novel arguments combining violations of the Department of Justice’s Data Security Program (DSP) with Electronic Communications Privacy Act (ECPA) claims. Common allegations include a user selecting “Reject All” or “Essential Only” yet third-party analytics and advertising technologies continue to fire on the back end.
For example, since 2023, claims under the California Invasion of Privacy Act’s (CIPA) pen register and trap-and-trace provisions have proliferated following a series of rulings favorable to plaintiffs. And in is other states such as Pennsylvania, claims under the Wiretapping and Electronic Surveillance Control Act (WESCA) have successfully targeted businesses deploying tracking technologies, and plaintiffs are increasingly testing various states’ interpretation of California law.
The absence of a cookie banner significantly increases exposure to these claims. CIPA claims are frequently predicated on tracking technologies used without consent, and WESCA claims similarly target inadequate notice. Without a cookie banner, there is little defense to claims that users could not have known their communications were being shared with third parties.
Like CIPA, the federal ECPA prohibits intercepting electronic communications but, unlike CIPA, contains a party exception. A website operator, as a party to a communication, may implement third-party technologies without ECPA concern unless the interception is “for the purpose of committing any criminal or tortious act.” This “crime-tort exception” is being used against companies for alleged violations of laws without private rights of action.
Plaintiffs frame gaps between the banner’s promise and the site’s actual behavior as unlawful interception. A parallel line of cases attacks misleading language, for example, claiming only “Strictly Necessary” cookies are deployed when many broader trackers are included. To avoid these claims, CMPs, banners, and notices must be carefully reviewed and implemented.
Our team is available to discuss your specific operations and compliance posture to help you mitigate these litigation risks.
Source: Dentons
NewsID: AFPLAY755
