In UMG Case, Court Sees CCPA as Shaping User Expectations, Say Lawyers
A December court order on a privacy class action against Universal Music Group (UMG) shows how critical it is for businesses to align data practices with what users are promised in cookie banners, privacy attorneys said in blog posts this week.
Sign up for a free preview to unlock the rest of this article
Communications Daily is required reading for senior executives at top telecom corporations, law firms, lobbying organizations, associations and government agencies (including the FCC). Join them today!
In a Dec. 17 decision in Wiley v. UMG, the U.S. District Court for Northern California dismissed wiretapping and pen register claims under the California Invasion of Privacy Act. But the court allowed other claims to proceed, including unjust enrichment, invasion of privacy and intrusion upon seclusion.
On the latter two claims, “the court agreed that plaintiffs plausibly alleged a reasonable expectation of privacy (reinforced by the cookie banner’s promises and the structure of the California Consumer Privacy Act (CCPA)) … which supports consumers’ opt-out rights,” Robinson+Cole attorney Roma Patel blogged Wednesday. “Further, the court found that this was a highly offensive intrusion, especially since UMG allegedly deceived users and collected broad categories of personal and behavioral data after users explicitly opted out.”
“The court’s analysis underscores how CCPA-related practices and representations can transform user expectations,” said Patel. “Where a website assures consumers that cookies and associated tracking can be declined, courts may treat any undisclosed override as an egregious privacy violation.”
In another blog post Wednesday, Troutman Amin attorney Blake Landis similarly highlighted how the court pointed to CCPA cookie banner requirements “as shaping users’ reasonable expectations.”
“When cookie banners promise control, courts are increasingly willing to treat that promise as legally meaningful,” said Landis.
Patel said a big takeaway with the UMG decision is that a website’s representations matter. “If your website offers visitors control, such as a ‘Decline All’ button or other opt-out for cookies or tracking, your data practices must align with those promises,” she said. “Plaintiffs and regulators are testing banners for both accuracy and technical enforcement. Any dark pattern or technical override of consent can support privacy and unjust enrichment claims.”
“Affirmative representations matter,” Landis agreed. “If a website tells users they can opt out of tracking and then allegedly ignores that choice, it may create a reasonable expectation of privacy that would not otherwise exist, particularly in a post-CCPA landscape.”