(co-author: Anna Chan)

• Recently, there has been an increase in the number of class action privacy lawsuits under the Arizona Telephone, Utility, and Communication Service Records Act involving the use of popular email marketing analytics technologies.
• Defendants assert standard defenses, including lack of a cause of action under Article III, and also challenge the applicability of the 2007 Arizona statute to email tracking pixels.

Class action lawsuits against pixels and other tracking technologies show no signs of slowing down, and while most of these cases have focused on website tracking technology and California’s eavesdropping law, Arizona has recently seen an increase in cases alleging violations of the Arizona Telephone, Utility, and Communication Service Records Act ARS § 44-1376 et seq. (“Arizona Statute”) based on email pixel tracking. As previously reported, a handful of cases centered on email pixel tracking emerged late last year, based on both the California Invasion of Privacy Act (CIPA) and Arizona law, and a new group of such cases was recently filed accusing several companies, including Target (Smith v. Target Corporation.), Gap (Carbajal v. Gap Incorporated et al.), Lowe’s, and Salesforce (Dominguez v. Lowe’s Companies Incorporated et al.), of embedding “spy pixels” in marketing emails in violation of Arizona law.

Arizona Telephone, Utility and Communication Service Records Act

Arizona’s law is modeled on the federal Telephone Records and Privacy Act of 2006, which prohibits “knowingly and willfully obtaining or attempting to obtain confidential information from telephone records … by making false or fraudulent statements or representations” (18 U.S.C. §1039(a)(1)). Arizona enacted a state version of this law, which was later amended to extend the prohibition to “communication service records” and “public utility records” (A.R.S. §44-1376.01). The law defines “communication service records” as “subscriber information, including name, billing or installation address, length of service, payment method, telephone number, electronic account identifier and related screen names, billing or access logs, records of the electronic communications path between the origination point and the delivery point, and the nature of the communications service provided, such as caller identification, automatic number identification, voicemail, electronic mail, pager, or other service features” (A.R.S. § 44-1376). Notably, Arizona law, unlike federal law, includes a private right of action (A.R.S. § 44-1376.04).

Recent Class Action Lawsuits in Arizona

The latest round of privacy class action lawsuits is very similar to the lawsuits we saw against Saks Fifth Avenue (Mills v. Saks.com LLC.) and Nordstrom (McGee v. Nordstrom Inc.) in 2023. The complaints allege that the defendant companies violate Arizona law by embedding common analytics technologies (referred to in the complaints as “spy pixels”) in emails without first obtaining consumer consent. The plaintiffs argue that the data collected by email analytics pixels—such as when and where an email was opened, the number of times an email was opened, whether an email was forwarded/printed, and what type of email server the recipient was using—constitutes a “communications service record” under Arizona law. As noted below, this is a novel argument that has not yet been tested by an Arizona court.

Responses of the defendant companies

The defendant companies that have responded to date have generally argued in their motions to dismiss that the plaintiff lacks Article III standing because they have not actually suffered any harm, since the plaintiff has not alleged how the challenged data collection, if true, harmed them. The defendant companies have also argued that the Arizona statute does not apply to email marketing analytics technologies. Specifically, some defendants have argued that the Arizona statute was enacted to prohibit the unauthorized sale and/or disclosure of telephone records by telecommunications carriers and does not apply because they are not telecommunications carriers or communications service providers. The defendants have also argued that the information collected by the analytics pixels does not constitute “communication service records” under Arizona statute, noting that there is no case law interpreting the meaning of “communication service record” under Arizona law and that the Arizona legislature has not taken any steps to amend the statute to include the types of data captured by the challenged technologies.

To go

This latest wave of litigation follows a familiar playbook for privacy class actions: applying old but widely developed private right of action laws to modern technologies that were not contemplated when the laws were enacted. Many of these cases are at the motion to order stage, but organizations using similar tracking technologies should be aware of the possibility of lawsuits filed on behalf of Arizona email recipients. As with all evolving risks associated with the use of tracking technologies, companies should ensure they have a robust governance program in place and continue to balance commercial benefits with risks and available mitigation strategies.