Server-Side Tracking to Shape Future of Pixel Privacy Litigation

Companies seeking to stem the tide of wiretap lawsuits targeting their use of data analytics tools like tracking “pixels” from Meta Platforms Inc. and Google LLC are looking to a relatively new way of handling information they collect from consumers.

The traditional tools that have drawn the litigation are client-side tracking programs, which operate on a person’s browser and send information directly to the third-party analytics companies that installed them on a company’s website.

But companies that would like to avoid liability for privacy violations are turning to server-side tracking, a method that first forwards the data to the website owner, which then passes it along to the third parties.

“You can still see the nature of the data that’s going to server-side tracking technology. What you can’t see that it is consequently being forwarded to TikTok, Facebook, and other third parties,” said Max Anderson, co-founder and head of product at privacy management software company Ketch.

The process makes it more difficult for users to detect the transfer—they don’t see the data going to the third parties, which are normally seen as “intercepting” the communications.

Because the website owners are parties to the conversation, they’re usually exempt from anti-wiretapping laws like the Electronic Communications Privacy Act.

But “most companies that build software products have by-and-large done a very poor job of setting up the guardrails” to comply with privacy laws, he said. While that’s not true of most server-side vendors Anderson’s seen, some fall into that trap.

The partially invisible process makes it hard to ascertain how broadly companies have adopted server-side tracking thus far, said Garrett Johnson, associate professor of marketing at Boston University’s Questrom School of Business. “My strong sense it that it has moved well beyond the early-adopter phase.”

Litigation Shift

Server-side tracking might reduce litigation risk but isn’t likely to eliminate it entirely, attorneys say.

Elaine F. Harwell, who has litigated privacy and data security matters at Procopio, Cory, Hargreaves & Savitch LLP, says the new protocol means complaints bringing wiretapping claims may just need to become more technical.

For example, Judge Rita F. Lin of the US District Court for the Northern District of California ruled that the plaintiffs failed to allege that footwear retailer Rack Room Shoes Inc.'s use of server-side tracking constituted a contemporaneous interception of a communication, as required for a claim under the California Invasion of Privacy Act—a corollary to the federal ECPA.

But the judge didn’t rule either way on the theory that server-side tracking might meet the “in-transit” requirement of CIPA, which regulates communications while in transit over wires, lines, or cables. Lin cited an earlier decision that defined the term as from the person sending the communication to its intended recipient.

That gives plaintiffs “a way to frame their pleadings going forward,” Harwell said.

Forwarding data may end up being safer for companies from a legal perspective.

“Certainly in cases where, as a factual matter, the defendants can show that there’s a delay or there’s some forwarding rather than contemporaneous monitoring, I think that will definitely be a big winner,” said John Jackson of Jackson Walker LLP.

But the courts are likely to reach different conclusions on the issue, he said.

Plaintiffs may argue that server-side tracking “just relocates the mechanics of interception, rather than eliminating it, especially where the data is still being shared with vendors for analytics, marketing, or profiling,” he said.

Brian Focht, a certified privacy professional and senior counsel at Shumaker, Loop & Kendrick LLP, believes that “the focus of privacy-related litigation would actually simply adjust to the shift.”

The demand for litigation won’t decrease unless companies choose to collect less information, which “will immediately be challenged by the institutions that seek data,” and data brokers advertise that they have 10, 15, even 20 thousand data points on every American, he said.

“It doesn’t matter where you’re collecting the data” if the collection is intrusive or dishonest, Focht said. “I don’t think that server-side actually really fixes that particular problem, so I don’t see it reducing the litigation.”

Process Conversion

But reducing litigation risk isn’t the only reason companies are adopting server-side tracking.

There are operational benefits beyond its privacy implications, said Joe Jones, director of research at the International Association of Privacy Professionals.

“Actually doing things in more privacy-preserving ways can present more business advantages, and can present some cybersecurity benefits as well,” he said.

Server-side tracking can be programmed to automatically strip out personal identifiers or halt data flows from the browser to the website owner if a user opts out of tracking, Johnson said.

The protocol also centralizes data, allowing companies to streamline information and unify controls and permissions.

“You get the communication of the consumer and it comes into your organization first, giving you more control over what you collect, what you share, how you share,” said Martin Tully of Redgrave LLP.

But that added control also comes with responsibility.

“You still have to be cognizant of data privacy requirements, have your cookie banner in place, your consent mechanisms, your global privacy controls sensitivities,” Tully said.