Self-Serve tier

Illinois Biometric Information Privacy Act (BIPA) — 740 ILCS 14 — written-consent gate for biometric identifier collection, private right of action under §20, statutory damages $1,000 negligent / $5,000 intentional, and post-Rosenbach mere-violation injury rule with post-Cothron

California Consumer Privacy Act (CCPA/CPRA) limited private right of action — Cal. Civ. Code §1798.150 — restricted to unauthorized access of nonencrypted/nonredacted personal information arising from failure to implement reasonable security; statutory damages $100-$750 per consu

California Invasion of Privacy Act (CIPA) — Cal. Penal Code §630 et seq. — pen register / trap and trace theory under §638.51 applied to website tracking pixels and analytics; complementary to §631/§632 wiretap claims; post-Greenley v. Kochava emerging litigation wave.

Children's Online Privacy Protection Act (COPPA) — 15 USC §§6501-6506 — verifiable parental consent for collection of PII from children under 13; FTC enforcement primary, no federal private right; state UDAP and constitutional/tort overlay creates indirect private exposure; FTC p

Meta Pixel VPPA pre-discovery class certification — uniform pixel installation produces classwide commonality and predominance under Rule 23(b)(3); subscriber-status, PII-transmission, and consent-form questions managed at the class level; coordinated MDL strategy.

Rule 23 class certification posture for PII data breach class actions — numerosity automatic in mass breaches; commonality on security-program failure; typicality challenge from differential identity-theft outcomes; predominance under Comcast and TransUnion intra-class standing c

California Shine the Light Act — Cal. Civ. Code §1798.83 — annual customer-direct-marketing-disclosure regime requiring designated request mechanism and 30-day response with prior-calendar-year third-party direct-marketing disclosures; private right of action with $500-$3,000 per

Spokeo, Inc. v. Robins, 578 US 330 (2016) — concrete injury for Article III standing in statutory-violation privacy/FCRA cases; "particularized AND concrete"; Congress cannot create standing by statutory fiat alone; remand framework for FCRA §1681e(b) inaccuracy claims pre-TransU

State two-party / all-party consent wiretap statutes — California §631/§632, Florida §934.03, Pennsylvania 18 Pa.C.S. §5703, Massachusetts 272 §99, Illinois 720 ILCS 5/14, Washington 9.73.030 — applied to call-recording, chatbot session-replay, customer-service voice analytics; p

Telephone Consumer Protection Act (TCPA) — 47 USC §227 — automated telephone dialing system (ATDS), pre-recorded voice, and DNC violations after Facebook v. Duguid, 592 US 395 (2021) narrowed the ATDS definition to a system using a random or sequential number generator; statutory

TransUnion LLC v. Ramirez, 594 US 413 (2021) — Article III concreteness for federal-court privacy/data-breach class actions; "no concrete harm, no standing"; risk-of-future-harm rejected for damages absent materialization; intra-class standing must be analyzed for every class mem

Video Privacy Protection Act (VPPA) — 18 USC §2710 — knowing disclosure of personally identifiable information that identifies a person as having requested or obtained specific video materials, applied to Meta Pixel / Google Analytics / TikTok pixel "video viewing history" disclo