Why are we still talking about wiretapping?

Companies across industries are being hit with wiretapping demand letters, arbitration claims involving boxes of individual claimants, and lawsuits alleging that standard analytics tags and advertising pixels constitute illegal interception under state wiretapping statutes. An Oregon case at the Ninth Circuit has escalated this further: the full circuit has been asked to weigh in on whether two-party consent is required for digital ad and analytics tags — the same tools that Oregon’s own new comprehensive privacy law, effective July 2024, explicitly permits under an opt-out framework. The collision is not hypothetical. It is happening now, in the same state, at the same time, between two bodies of law that require opposite results. The structural tension is sharp. Comprehensive state privacy laws have generally been written with an opt-out standard for targeted advertising and analytics, reflecting a deliberate legislative choice about the trade-offs between privacy, the digital economy, and small businesses. Wiretapping statutes from the 1970s, designed for telephone calls, require affirmative two-party consent. Plaintiffs’ lawyers are applying them to pixels and tags, and the argument has more traction in court than many expected. A similar circularity surfaced in APRA debates: browsing data was classified as sensitive, sensitive data requires opt-in, and browsing data is the core input for targeted advertising — effectively creating opt-in for the entire ad ecosystem without expressly saying so. The practical problem is that the digital advertising ecosystem cannot pivot to opt-in without a universal standard. Wiretapping demands are concentrated in a handful of two-party consent states, but publishers, advertisers, demand-side platforms, and ad networks operate across all jurisdictions simultaneously. The system is a supertanker — it cannot change course in isolated pockets. Until courts or legislatures resolve the conflict between opt-out privacy laws and opt-in wiretapping statutes, companies are left building infrastructure against a moving and contradictory legal target.

**Jonathan:** So tell us about Oregon and then just generally what's happening with these wiretapping suits. **Alysa:** Sure. So I have been talking about wiretapping for quite some time because this is such a huge pain point that so many companies are dealing with in the way of demand letters, arbitration demands with many, many claimants — sometimes boxes of claimants — that can really add up just to engage in arbitration in the millions of dollars, and lawsuits being filed alleging that their use of digital technology on their site — tags and pixels for analytics, for advertising purposes — are illegal wiretapping mechanisms. They're either intercepting a private communication. They're a pen register. These are all old terms from the seventies, but essentially, under the wiretap in some of the states, you need both parties — the company and then the person, the consumer who's engaging — need both parties to consent. So this was in the context way back when with telephone calls. They are applying this in a digital context. We've certainly heard a lot of this in California. CIPA lawsuits is the common terminology for that. But this is an Oregon case, same wiretapping type allegations, went up to the Ninth Circuit, which is the appellate court, federal appellate court for Oregon. And the Ninth Circuit with three judges, different appointees from different presidents, they had a ruling. And essentially the ruling was asked — for the entire Ninth Circuit to take another look at the ruling to determine whether wiretapping with two party consent in the context of this digital ad and analytics tags, is that going too far to say that, yes, you need two party consent in that context? **Jonathan:** And they — these wiretapping laws — I mean, I think I heard you. It's not just chatbots online where it's maybe something that resembles a call. It's tracking pixels and tags, and it's all the way there. Interesting. **Alysa:** Right. It's all the way there. These are old statutes. So just juxtapose those statutes with the actual comprehensive privacy laws in these states. Oregon has a new privacy law effective in July. Those have an opt out for those digital ad and analytics tags. This is essentially flipping that thing. It doesn't matter what your privacy law is. We've got this other wiretap law, and the wiretap law has a tougher standard. And so are we seeing this general move towards opt in even though the laws are opt out? I mean, the other example I think we heard recently was — if you label it sensitive data, like, for example, if browsing data is sensitive, well, all that needs an opt in even though anywhere else you opt out. Like, the latest version of the federal privacy law — I think somebody was saying that, hey, there's some kind of circular argument here that, hey. It's opt out except when it's sensitive data, which is opt in, targeted advertising. Oh, by the way, browsing data, which is mostly used for advertising, is sensitive, so it's opt in. Okay. **Jonathan:** So why don't you — yeah. Is that is that generally what's happening? I think the FTC cases or even the deceptive conduct cases — they have sensitive data. They're poor. Like, is that where we're going? Or is it — **Alysa:** I think there's much more alignment on the use of sensitive data and needing a true consent for that. I think at least what we've seen in the laws where legislatures have been really intentional about digital advertising — and I'll put APRA to the side for now — have really focused on an opt-out approach to that. There are consequences of whether it's opt in or opt out for economies, for businesses, for small businesses. It's an open question. Right? But I think at least from a policy standpoint, we've leaned on the side of opt out, and it's really hard to suddenly flip the switch and do it to an opt in where there's not a clear standard that it's an opt in. Right? These are demands in a few states under state laws in a few states. How can you have the entire ecosystem suddenly reach agreement that it's opt in, when there's not a clear law that says that? And so just thinking of digital advertising and all the different players involved from the publishers to the advertisers — you gotta get everybody on the same page. You can't do it in some pockets here, some pockets there. It just doesn't work. **Jonathan:** And I mean, the ad tech ecosystem is a supertanker. We're not ready to turn around. It's not just a one day thing. Right? Like — no. Yeah. At least thanks. It's also — you know, I actually woke up this morning thinking, I wonder what we're gonna talk about. I don't wanna talk about the federal law again. And then I saw your post, and I go, okay. Stop talking. Thanks. Good to see you. **Alysa:** Good to see you.