Beyond CIPA: The Rise of CDAFA in Tracking Technology Litigation
The article says California privacy tracking litigation is increasingly adding claims under the California Comprehensive Computer Data Access and Fraud Act (CDAFA, Penal Code §502) alongside CIPA. It explains CDAFA’s private right of action, broader “damage or loss” language, and how courts differ on “without authorization” and consent. It also notes CDAFA requires a plaintiff ownership/possessory interest, which can be harder for data collected by third parties.
Background
The article explains how plaintiffs are increasingly using California’s Comprehensive Computer Data Access and Fraud Act (CDAFA) instead of (or alongside) CIPA to challenge website tracking technologies.
Why it matters
It frames CDAFA’s elements (unauthorized access/use, consent defenses, and ownership/possessory interest) and notes courts’ shifting interpretations post-Christensen and in light of Van Buren’s limits on CFAA authorized-use theories.
Market relevance
No specific public company is named or tied to a new lawsuit outcome; the piece is best treated as legal/strategy background for privacy litigation risk in California tracking cases.
Market effects
Educational/sector-legal analysis of CDAFA vs CIPA for website tracking litigation; potential read-across to privacy-risk for adtech/website operators but no named issuers.
California-focused privacy litigation theory evolution could increase compliance/legal-cost expectations for affected US web businesses.
US-specific statute comparison (CFAA/CDAFA) may influence how global privacy/anti-fraud claims are argued, but no direct cross-border catalyst is described.
Alternative perspectives
Because the piece is largely doctrinal (pleading/consent/authorization/ownership tests) without new case outcomes, near-term pricing impact for any issuer is likely limited.
Actual market impact depends on which specific defendants face suits, class certification, damages theories, and any injunction/settlement terms—none are provided here.
Key entities
- statuteCalifornia Comprehensive Computer Data Access and Fraud Act (CDAFA)
California Penal Code § 502; provides a private right of action and does not include a $5,000 civil loss threshold like the CFAA.
- statuteCalifornia Invasion of Privacy Act (CIPA)
California Penal Code §§ 631 and 638.51; described as the historically dominant privacy theory in tracking litigation.
- court_decisionUnited States v. Christensen
Ninth Circuit decision distinguishing CFAA (unauthorized access) from CDAFA (unauthorized taking or use of data).
- court_decisionVan Buren v. United States
Supreme Court decision narrowing CFAA’s reach for authorized database uses even with improper purpose.
