ECPA Demand Letters on the Rise

Companies across industries are increasingly receiving demand letters from plaintiffs' firms alleging that routine advertising technology embedded in websites violates the federal Electronic Communications Privacy Act (ECPA), also known as the Wiretap Act, and similar state laws (e.g., California’s wiretap act). The letters threaten statutory damages, punitive damages, disgorgement of profits, and injunctive relief.

Companies that lack current data mapping, as well as those that outsource their web design processes, face a heightened risk. In this legal alert, we briefly explain the anatomy of a typical ECPA demand letter as well as our firm’s capabilities to assist.

Structure and Economics of the Demand Letter Campaign

The typical demand letter identifies a named plaintiff, states that the plaintiff visited the recipient's website, and asserts that the website has "secretly embedded software from registered data brokers for the purpose of interception, commoditization, storage, and use" in violation of the ECPA.

The letter then enumerates the damages available under 18 U.S.C. § 2520—statutory damages of $100 per day per violation or $10,000, punitive damages, attorney's fees, and equitable relief—and offers a window for pre-litigation resolution. Many plaintiffs’ firms have adopted a high-volume pre-litigation model that relies on defendants settling rather than engaging on the merits.

Common Allegations and Case Law

The demand letters tend to characterize advertising technology integrations as illegal wiretapping. A representative letter will identify specific vendors that appear on the California Data Broker Registry, such as AppNexus/Xandr, Bombora, LiveRamp, Lotame, OpenX, PubMatic, and The Trade Desk, and assert that these integrations are in violation of the ECPA.
The letters also invoke recent district court decisions holding that websites subjecting visitors to certain types of software without consent may violate the ECPA's "crime-tort exception." Whether or not these cases are applicable requires detailed analysis, and plaintiffs' firms hope their targets will opt for a quick settlement rather than conduct a review.

We Can Help

We routinely help clients evaluate their exposure, close gaps between data practices and privacy disclosures, and develop a defensible posture before a demand letter arrives. We also have experience evaluating and responding to ECPA demand letters when they do arrive, including a strong record of resolving such matters pre-litigation. Bear in mind, the cost of proactive engagement is modest relative to the cost of responding to litigation after a complaint is filed.

Please reach out to Eran Kahana or Katie Eisler if you have any questions or want to learn more about how to lower your company's risk of ECPA non-compliance.