From Good Faith to Maximum Deterrence

The minimum legal requirement for standing in digital privacy cases is now clearly established. In Camplisson v. Adidas, the federal court held that simply visiting a violating website and being tagged by a tracking pixel is sufficient to establish concrete injury and Article III standing under California's CIPA.

Our plaintiffs go far beyond this bare minimum.

They are genuine privacy advocates who actively identify violating websites, confirm the tracking violations, send formal legal notices, file complaints with government agencies, incur real out-of-pocket expenses for monitoring tools and certified mail, and follow up repeatedly — often three or more times — using certified mail with return receipt.

They exhaust every reasonable pre-litigation remedy available. They give every violating company every possible opportunity to fix the violation before litigation becomes necessary.

But when those good-faith efforts are met with continued violation and willful ignorance of the clear notices received, the approach changes completely.

At that point, remediation is no longer a request — it becomes a court-ordered requirement. The website will be fixed. And we will pursue maximum statutory damages and punitive damages.

This is the opportunity to send a clear message of maximum deterrence to all violators currently operating across the internet.

Precedent: Courts Multiply Damages for Willful Ignorance

Courts have consistently imposed heightened penalties when companies continue violating privacy rights after receiving clear notice.

In FTC v. Wyndham Worldwide Corp. (3d Cir. 2015), the court found that Wyndham's continued failure to secure customer data after repeated warnings constituted willful conduct, exposing the company to multiplied liability for its ongoing privacy violations.

In In re Facebook, Inc. Consumer Privacy User Profile Litigation (N.D. Cal.), Facebook's willful disregard of user privacy settings and continued data misuse after clear notice led to massive statutory exposure and hundreds of millions in settlements.

In Google LLC v. Texas, the state secured over $1.4 billion in penalties after the court found Google continued unlawful tracking and data collection despite repeated state notices — directly multiplying damages due to willful, ongoing misconduct.

In In re Google Location History Litigation (N.D. Cal. 2024), the court recognized Google's continued tracking of users even after they opted out as willful and ongoing, resulting in over $100 million in liability.

In Meta Platforms, Inc. (WhatsApp class action), Meta's maintenance of a backdoor despite years of privacy complaints and formal notices was deemed willful, substantially increasing statutory damages.

Why Privacy Violations Compound

Privacy violations are ongoing and progressive by nature. Once a tracking pixel tags a visitor, a persistent profile is created and continues to build — collecting browsing patterns, preferences, contacts, and behavioral data over time. That single tag doesn't just affect the individual — through network inference, it enables algorithms to identify and profile everyone connected to them.

This is not a one-time event. It is a continuing pattern that expands with each subsequent visit and each additional data point collected.

The Stakes

Digital privacy is the guardian of our First Amendment rights — freedom of speech, expression, and assembly. Without strong privacy protections, anonymity disappears and people cannot speak freely for fear of retaliation.

We also have a fundamental constitutional right to control our own personal information. In the age of AI, this right is under constant threat. Protecting digital privacy is the safeguard of our liberty, freedom, and sovereignty.