A major online jewelry retailer recently made headlines for the allegations in a class action lawsuit: Alex and Ani disclosed customer data to TikTok. Specifically, Alex and Ani was accused of using online tracking technologies to collect customers’ information without consent and then sharing it with the popular social media platform. If true, this would constitute a clear violation of California’s privacy laws, including the California Invasion of Privacy Act (CIPA). The individual who filed the lawsuit is represented by the Los Angeles data privacy lawyers at Tauler Smith LLP, and the law firm recently secured an important pre-trial victory in the case. As a result, the lawsuit could soon move closer to trial.
To learn more about the data privacy class action against Alex and Ani, keep reading.
Jewelry Retailer Alex and Ani Sued in California Central District Court
The case, Hassid v. Alex and Ani LLC, was filed by a California resident in the U.S. District Court for the Central District of California. The lawsuit has already garnered significant media attention despite not yet having reached trial. The defendant is Alex and Ani LLC, a retailer and producer of jewelry such as bracelets, bangles, necklaces, earrings, and rings. The company sells these products nationwide, including to California residents who access the Alex and Ani website at www.alexandani.com/.
The plaintiff is a California resident who visited the Alex and Ani website. The plaintiff claimed that when he accessed the site, the jewelry company collected his personal information without permission. Alex and Ani allegedly installed tracking software from TikTok on the site, which allowed TikTok to collect the data of all visitors. This data was then allegedly shared with the Chinese government, raising serious red flags about the jewelry company’s data collection practices. For example, was Alex and Ani customer data shared with any other third parties, such as data brokers who might use it for targeted advertising? Was the consumer data used for more nefarious purposes?
TikTok Allegedly Collects Sensitive Personal Information About American Citizens
One of the most shocking allegations against Alex and Ani is that the jewelry company shared customers’ personal information with TikTok. TikTok’s parent company was ByteDance Inc., which is based in Beijing, China. TikTok came under intense scrutiny from American lawmakers in recent years due to national security concerns that the Chinese Community Party has been amassing sensitive data about U.S. citizens. This prompted the United States Congress to pass a law requiring ByteDance to sell TikTok, and a deal was recently reached to prevent TikTok from being banned in the U.S. Unfortunately, this may have come too late to protect the sensitive personal information of anyone who already visited the Alex and Ani website.
California Invasion of Privacy Act (CIPA) Prohibits the Use of Trap and Trace Devices
The Trap and Trace Law is part of the California Invasion of Privacy Act (CIPA), and the statute is codified at Cal. Penal Code Section 638.51. The law proscribes the use of trap and trace software unless the party utilizing the device has first obtained a court order to do so, or unless all parties are informed of the trap and trace device in advance.
The plaintiff in the class action against Alex and Ani alleges that visitors to the jewelry retailer’s website are never informed that the site uses trap & trace technology and TikTok Software to surveil users and collect their data, nor are site visitors informed that their personal information is being sent to TikTok.
Court Rejects Motion to Dismiss CIPA Claim Against Alex and Ani
After the CIPA claim was filed, the defendant attempted to get it dismissed before trial.
The defendant made three arguments in its motion to dismiss:
- The plaintiff lacked standing to sue.
- The court lacked personal jurisdiction to hear the suit.
- The lawsuit failed to state a valid legal claim.
The federal court rejected all three of these arguments and ruled that the trap and trace claim against Alex and Ani can move forward.
Plaintiff Has Standing to Sue Alex and Ani
Article III of the U.S. Constitution, also known as the “case or controversy clause,” stipulates that a plaintiff must show that they have a personal stake in the outcome of their case. In other words, any injury suffered by the plaintiff must be an injury in fact, not conjectural or hypothetical.
In the data privacy lawsuit against Alex and Ani, the defendant contended that the plaintiff made only “general allegations” about what might happen when someone visits the Alex and Ani website. Furthermore, argued the defendant, the plaintiff did not show that sensitive, intimate, or private facts about website visitors were captured by digital tracking tools installed on the site.
In its ruling rejecting the motion to dismiss, the federal court declared that the defendant’s arguments about Article III standing were “unpersuasive.” The court highlighted the plaintiff’s allegation that the TikTok tracking pixels used on the Alex and Ani website allow the defendant to regularly collect personalized information about site visitors. This is a violation of the longstanding right of individuals to control their private information, and the disclosure of the plaintiff’s personal data without consent would constitute a concrete harm under both common law and California law. In fact, noted the court, CIPA codified a substantive right to privacy and was passed for the express purpose of protecting the consumer privacy rights of California residents.
The U.S. District Court concluded that the plaintiff does have Article III standing to sue Alex and Ani for violating the data privacy rights of visitors to the jewelry company’s website.
Court Has Jurisdiction to Hear Alex and Ani Lawsuit
The defendant also argued that the lawsuit against Alex and Ani should be dismissed because the court does not have specific personal jurisdiction in the case. For specific jurisdiction in a California lawsuit, an out-of-state defendant like Alex and Ani must have sufficient minimum contacts with the state that are relevant to the lawsuit.
In its ruling on the motion to dismiss, the court applied a three-part test assessing whether a defendant has enough contacts with the state for specific jurisdiction:
- The defendant must purposefully direct their activities toward a person in the state.
- The claim must arise out of the defendant’s activities in the state.
- The exercise of jurisdiction by the court must be reasonable.
On the first part of the personal jurisdiction test, the court observed that Alex and Ani “regularly engages with individuals in California through its website.” The court further noted that Alex and Ani expressly aimed its conduct at California by targeting California consumers on its website and by allegedly using TikTok tracking software to collect information from California residents who visit the website.
On the second part of the personal jurisdiction test, the court stated that the TikTok trackers installed on the Alex and Ani website allegedly collected the plaintiff’s personal information while he was located in California and then shared that data with TikTok in California. The court concluded that the plaintiff, a California resident, would not have suffered a violation of his online privacy rights but for Alex and Ani utilizing website tracking tools to collect and share website visitors’ personal data in the first place.
On the third part of the personal jurisdiction test, the court quickly rejected the defendant’s contention that the CIPA claim is inconsistent with Due Process simply because Alex and Ani merely “operates” a website in California but does not target customers in the state. The court declared that Alex and Ani does target California residents for both the sale of jewelry online and the alleged collection of personal information to be shared with TikTok.
Plaintiff Stated a Valid Claim Against Alex and Ani
The defendant’s final attempt to get the data privacy lawsuit thrown out before trial was to argue that California’s Trap and Trace Law does not apply to the Alex and Ani website because (1) the TikTok Software is not a trap & trace device; (2) the Trap and Trace Law does not apply to commercial websites that don’t allow for person-to-person communications; and (3) the defendant consented to the use of the TikTok Software. The court rejected all of these arguments.
The court found that the lawsuit sufficiently alleges that Alex and Ani’s online surveillance practices included the use of a trap and trace device to capture personal information from website visitors. That’s because the TikTok Software allegedly installed on the Alex and Ani website meets the statutory definition of a trap & trace device: it is software that identifies visitors, gathers their personal data, and then correlates that data through unique fingerprinting so that TikTok can potentially deanonymize users.
The court also said that California’s Trap & Trace Law should be construed broadly to apply to any website that embeds TikTok Software to collect visitors’ information, regardless of whether there are actual online communications.
Finally, the court highlighted the absurdity of the defendant claiming that it had consent to collect user information because the website operator had given consent. That’s because it is clearly the user of the website who must provide affirmative consent for the collection of their personal information, not the recipient of the information. Since the plaintiff in the lawsuit against Alex and Ani did not give express or implied consent for the collection and sharing of his personal data, the defendant’s actions could constitute a violation of California’s data privacy laws.
Did You Visit the Alex and Ani Website? You May Be Eligible to Join a Class Action Lawsuit
Tauler Smith LLP is dedicated to protecting the data privacy rights of California consumers. That’s why we are representing the plaintiff who filed the proposed class action lawsuit against Alex and Ani. This lawsuit seeks to certify a class of all persons within California whose identifying information was sent to TikTok as a result of accessing the Alex and Ani website. If you visited the Alex and Ani website, you may be eligible to join the class action and receive financial compensation.
One of our experienced Los Angeles consumer protection lawyers can help you learn more. Call or email us today.
