Home service contractors are getting sued over their websites

Paul Fowler, who founded Westshore Roofing in San Jose, California, 34 years ago, told Homepros he was confused when a thick lawsuit landed in his mailbox a few months ago. 

• The plaintiff, a man named Juan Carlos, alleged he had clicked on Westshore’s website from Orange County, hundreds of miles away from Fowler’s service area. 
• The lawsuit, filled with technical jargon, alleged that code embedded in the site caused Carlos’s web activity to be shared with Meta without his consent, amounting to “wiretapping.” 
• “Plaintiff suffered an invasion of statutory privacy interests,” the suit claimed. 
• Fowler settled the case for $2,500 — and paid $5,000 in attorney fees.

What’s happening: A wave of similar lawsuits is plaguing small businesses across the U.S., including HVAC, plumbing, and electrical contractors. 

• Serial plaintiffs describing themselves as “privacy advocates” are claiming that common website tools such as cookies, chatbots, and analytics software violate decades-old privacy laws. 
• In California, about 4,000 such suits have been filed by four law firms in just two years. 
• Nationwide, more than 5,800 have been filed since February 2022, according to a tracker from law firm Fisher Phillips. 

The backdrop: Most of the lawsuits are based on the California Invasion of Privacy Act (CIPA), a state law enacted in 1967, when legislators were concerned about the interception of landline telephone calls. 

• The law stated that “new devices and techniques for the purpose of eavesdropping upon private communications” had “created a serious threat to the free exercise of personal liberties and cannot be tolerated in a free and civilized society.” 

Zoom in: Nowadays, some website tools automatically share data with third-party tech companies, which plaintiffs argue amounts to wiretapping and eavesdropping under CIPA. 

• Web tools can also collect IP addresses or phone numbers; plaintiffs allege that those function as “pen registers,” which record outgoing data, or “trap-and-trace devices,” which record incoming data — both of which under CIPA require either a court order or consent. 
• Federal law and statutes in other states are also being used as the basis for digital wiretapping litigation, but CIPA lets plaintiffs seek $5,000 for each violation without proving they suffered financial harm, making California an especially attractive place to file suit. 

What they’re saying: “A company gets sued under the theory that, ‘You have cookies on your website, so that’s a violation of CIPA. We visited 10 times or 20 times, so at $5,000 per click, that’s $100,000,’” Andrew Kingman, general counsel for the Alliance for Legal Fairness, told Homepros.

• “There are plaintiffs that have been used in 100 different cases by the same law firm,” he said. “So this is not a good-faith, ‘My privacy is being invaded, and I’ve suffered some sort of harm.’ This is just a clear money grab.”
• He added, “There’s also no prohibition on companies being sued more than once. So a company can settle one day and then be sued by another law firm the next day.”

Yes, and: For every court case that gets filed, more businesses are receiving demand letters urging them to pay up or be sued. Lawyers in California have threatened to sue businesses as far away as Pennsylvania and Texas. 

• Some affected contractors, like Folsom Lake Heating & Air, are settling, while others, including Element Electric, are fighting. 
• Yao Mou, the lawyer who brought the suit against Fowler, has filed at least 200 suits across 34 California counties. (Mou didn’t return Homepros’ call for comment.) 
• “It takes so much time away from running your business because you’ve always got to be looking over your shoulder,” Fowler told Homepros, adding that he was frustrated that his marketing company didn’t prevent this by putting the right protections in place. 

What we’re watching: Business coalitions have called the lawsuits “predatory” and demanded a legal solution to stop the “shakedown.”

• California Gov. Gavin Newsom on Wednesday signed SB 690 into law. It will require “pen register” and “trap-and-trace” cases to be brought only by the attorney general; however, it’s not expected to stop wiretapping claims. 
• At the federal level, Idaho Rep. Russ Fulcher introduced the Halt Abusive Internet Lawsuits Act in early September, which would exclude ordinary commercial website technology from wiretap and eavesdropping laws.

In the meantime: To minimize risk, Fisher Phillips recommends that businesses implement clear, prominent consent pop-ups on their websites and review any privacy policies and tracking mechanisms. 

— With reporting from Maggie Fipps