REALTOR® associations and brokerages should be aware of an emerging website privacy litigation trend involving the California Invasion of Privacy Act (CIPA). According to the National Association of REALTORS®, there has been a recent surge in demand letters alleging that websites using certain tracking technologies violate the law. The technology at issue isn’t necessarily unusual. Websites commonly use tracking tools for analytics and other functions, including collecting information about pages visited, website sessions, IP addresses, and geolocation data. The application of CIPA to these modern website technologies remains unsettled and contested.
Why This Matters Outside California
While CIPA is a California law, NAR cautions that its protections follow the California resident, not the location of the business or website. That means an Oklahoma brokerage could potentially face a claim based on a California resident visiting its website. For that reason, NAR recommends that organizations account for the CIPA regardless of where they are located.
What You Can Do Now
Brokerages should consider reviewing their websites and privacy practices with legal counsel. NAR has identified several potential risk-reduction measures, including providing visitors with clear notice about tracking and data-collection technology, using a conspicuous cookie consent banner with opt-in and opt-out options, and providing transparent disclosures and clear instructions for opting out of tracking technologies.
Analysis of the CIPA and its interaction with these technologies is still ongoing, so these measures should be discussed with your own legal counsel rather than treated as a one-size-fits-all solution. If your brokerage receives a CIPA demand letter or lawsuit, you should contact local legal counsel.
The takeaway: Even if your business operates entirely in Oklahoma, now is a good time to understand what tracking technologies are running on your website, review how visitors are notified about them, and talk with your website provider and legal counsel about whether updates to your privacy and cookie-consent practices are appropriate.
