Privacy litigation has always evolved.

At first, plaintiffs focused on collection. The questions were relatively simple: What information was collected and when was it collected? The underlying technology was largely the same from case to case: cookies, pixels, SDKs, session-replay technologies, chat tools, and analytics platforms. The claims rose and fell based largely on the nature of the information allegedly collected and whether the collection occurred before or after a consumer exercised an opt-out right.

Eventually, however, the novelty wore off.

Courts spent less time trying to understand how the technology worked and more time analyzing whether plaintiffs actually suffered an injury. In Popa v. Microsoft Corp., for example, the Ninth Circuit held that the collection of routine browsing information was no more injurious than "a store clerk's observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales."

As they are prone to do, plaintiffs pivoted.

The next wave of cases focused less on collection itself and more on what happened after collection. Plaintiffs alleged that otherwise innocuous browsing information became harmful once recipients, often labeled "data brokers," aggregated, enriched, sold, licensed, and commercialized it. The alleged injury was no longer just surveillance. It was also monetization.

Then came SB 690.

By eliminating the private right of action for the use of pen registers and trap-and-trace devices, SB 690 made pure collection cases more difficult to bring. No longer can a plaintiff simply visit a website, identify a script, click around for a few minutes, and file suit. At least in California, collection alone is becoming a less attractive theory.

Unless, of course, the alleged wrongdoing is no longer the collection of data.

That is where we find ourselves today.

Plaintiffs are increasingly targeting companies based on how they use information after it has been collected. Plaintiffs are looking into how companies use consumer data to target advertising based on characteristics such as age, sex, gender, or other inferred traits, and whether that targeting is discriminatory or otherwise detrimental. 

One of those investigations has already become a lawsuit.

According to the complaint, the defendant used artificial intelligence, behavioral data, and consumer-profile information to identify individuals purportedly susceptible to certain behaviors and then target those individuals with personalized advertisements, offers, and promotions. Put differently, the complaint takes little issue with how the data was collected. It takes issue with what the company allegedly did with it.

The causes of action reflect that shift. Rather than relying primarily on privacy theories, the complaint is built around consumer-protection and unfair-business-practices concepts. The allegations focus on exploitation, unfairness, deception, and the use of predictive technologies to influence consumer behavior.

AI will only accelerate this trend.

Historically, targeted advertising was relatively straightforward. Consumers bought a product and then received advertisements for similar products. Modern systems can do much more. They can generate inferences, predict behavior, segment consumers into increasingly precise audiences, identify potentially vulnerable users, and personalize content at scale, oftentimes with little to no human assistance.

As those capabilities become more sophisticated, plaintiffs will inevitably become more interested in the outputs than the inputs.

Privacy litigation has never stood still. Collection cases were only going to take plaintiffs so far. Use is the new frontier.

Whether these new theories ultimately gain traction remains to be seen. But one thing seems certain: we are going to see a lot more of them.