**Jonathan:** Hey. You've been talking about wiretapping for a while, and the Shopify case or the sub-Shopify ruling is super interesting. Can you tell us about it?
**Alysa:** Sure. So it's not yet a ruling, but we have this issue. We've been talking about wiretapping ad nauseam, some might say. And just to maybe refresh — that is the allegation that, let's say, company A, you go to company A's site, that company A is integrated in some way with a third party, whether it's AdTech here, whether it's a payment processor. And the information you give to company A is being intercepted or illegally recorded by this other party, whether it's an ad tech provider, whether it's a payment processor. So in this Shopify matter, that is the issue. We've talked a lot about California wiretapping claims, CIPA. And in that case — and this is all the way up to the Ninth Circuit — private right of action — was whether that's illegal wiretapping. And it's up before the Ninth Circuit. And so what the new development is is you had thirty state attorneys general and DC and a number of California's city-based lawyers, district attorneys, argue — put in what's called the amicus brief to support — hey, Ninth Circuit. You should revive this class action. And it's fascinating. They're focusing on jurisdiction, which is a legal nexus argument, but nobody's talking about the comprehensive privacy laws. These are wiretapping laws about requiring consent and permitting a private right of action. And I just think given what is on the board — if those laws continue to get support, go forward — it in some ways just really makes all of these comprehensive privacy laws on major issues irrelevant.
**Jonathan:** Why is that happening, Alysa? Is it — are the wiretapping laws — is there an easier path for them in the courts? Like, why is this happening?
**Alysa:** Yeah. There's a clear private right of action. So that means that they get to fight this issue at the district level. You have lots of different district courts. You get to fight it at the appellate level, but we don't have really a ton of appellate decisions on these issues. And there's no — these are states, so we've got our state patchwork. It's not like at the federal level where maybe one agency has power to interpret certain things that can really narrow things, or broaden things. And so there's not an end in sight, which is the issue.
**Jonathan:** And is the assumption that the wiretapping laws are that broad that they can capture sensitive and personal data — capture some of these, like, targeted advertising use cases that privacy laws seem to be addressing?
**Alysa:** Well, that that is the concern because what companies are facing is these either lawsuits or demand letters asking for payments, or really big arbitration claims saying that, yes, your use of — or your engagement with XYZ third party — you did share my information with them unlawfully. You didn't have my specific consent to do so. And their choices: fight it out — as we've talked about in the past — and have a pretty hefty legal budget to do so, with not certainty as to how those cases are going to evolve. That's a pretty expensive legal budget to take it to the end without a clear answer on your chance of success.
**Jonathan:** Gotcha. So what are the pathways now? Like, how could this unfold? Does a court come back and say, well, no — the wiretapping law wasn't meant to cover this. We have privacy laws. Like, does that happen? Does an agency do that? I mean, in light of Chevron, probably not so much more.
**Alysa:** It's states, so we don't have one agency, and I think that's the pain point here. It's incremental. This could be ten years. This could be fifteen years, unless there really is a compromise struck. And so federal law — if there was a federal privacy law that preempted specifically these wiretaps — but that was never on the docket. Like, even APRA wasn't contemplating preempting wiretapping laws. And so I just think it's ironic. We've been fighting so much about federal legislation. Should there be a private right of action? What should it cover? Should it be — what is opt-in reserved for sensitive information? Is interest-based advertising part of it — when this is happening already. It's already — there is a private right of action to these wiretaps, and they are pursuing all ranges of data that's being shared in ways that I think some of us had thought was fairly innocuous and clear to the consumer.
**Jonathan:** Fascinating. Has there been any precedent for something like this where there's been new laws starting to come online and then, hey, here's this old one that everybody's all of a sudden excited about, and then somebody comes in and just rationalizes it. Has this ever happened? It must have.
**Alysa:** Oh, it it does in different ways. I mean, I think but with some distinctions. Right? And so the last example — which is different in an important way — but the last example that comes to mind is TCPA. The TCPA wave that was more than a decade of a whole lot of litigation, and it was because there was this definition of what is an autodialer. And it was so broad that using any kind of technology was considered using an autodialer, and you needed this bells and whistles type of consent, or else it was per se not lawful to call a cell phone or to text a cell phone. So so many — kind of the volume that we're seeing of these wiretap lawsuits. But finally, there is a federal law. You had the FCC interpret that, and there was litigation over it, and it went all the way to the Supreme Court. So this is a long journey to get to the point where that term was narrower than what it had been litigated over. That was a long journey to get there. And so the question is, on all of these different state wiretapping laws, which require two parties' consent — that's the hook — where is the end — you know, does this get to a Supreme Court? Does this get to a state? That's — we're not even remotely close there. And so that is the frustrating part of, like, how do you build privacy infrastructure? What are your defaults? And if you don't have that in very clear black and white, I think it's really hard to persuade a company to say, you'd be the first one to raise your hand and go to a consent model. Right? And I just — you don't see that happening.
**Jonathan:** Wow. It's fascinating. I've been talking about it for a while, but it seems like it's finally here. I think it's bubbling up, and — yeah, yeah — the fact that all these state AGs who are arguing for these comprehensive privacy laws, they're also supporting essentially wiretapping laws. It was argued on a different legal issue, but it's supporting the ability to have these private rights of action, alleging privacy violations on the basis of wiretapping laws. Is that — is that an example of state AGs just using weapons available to them? And okay, we have our UDAAP laws. Maybe we have a state privacy law. Now we have this wiretapping thing. We're gonna use anything we can to protect consumers. Is that it?
**Alysa:** I think it's picking and choosing. Right? So they coalesced to file this statement in support of a class action being able to move forward without addressing the elephant in the room, which was — that case is about wiretapping and a privacy violation. And you know these cases are happening, and there's not an acknowledgment of those. And how do you reconcile a comprehensive framework that says opt-out with old nineteen-seventies state wiretapping law that requires a different result?
**Jonathan:** Wow. Awesome. So what's the next step here? What are we looking for?
**Alysa:** Just a lot of litigation. I mean, it'd be interesting to see what the Ninth Circuit does. So clearly that'll be one appellate. It won't resolve everything, but it'll certainly be interesting and telling.
**Jonathan:** Okay. We'll watch it. Thanks, Alysa. This is fascinating.
**Alysa:** Never dull.
**Jonathan:** No. I know. I'll see you.
