21 Aug 2025
A trap and trace device is a surveillance tool that is generally used to capture incoming call information (such as phone numbers) without recording the content of the communication. The trap and trace concept has been expanded recently to include websites, capturing the data of visiting website users (all without notice to and consent of the visitor).
There are potentially both state law violations (for example, under the California Invasion of Privacy Act) and federal law violations (for example, under the United States Electronic Communications Privacy Act) that could apply if an individual’s privacy rights are violated.
A recent case was brought by Jose Licea against Hickory Farms, an online gift retailer. The lawsuit claimed that Hickory Farms’ website recorded Licea’s IP address without his consent. In 2024, a California State Court dismissed Licea’s claim as to the website violation, articulating that the applicable law covered only devices used to record phone numbers, not IP addresses. The Court stated that “Such a broad-based interpretation would potentially disrupt a large swath of internet commerce without further refinement as the precise basis of liability, which the court declines to consider.”
Recently, another trap and trace lawsuit was filed in a California State Court, this time against Extra Space Storage. The proposed class action lawsuit (Heiting v. Extra Space Storage, Inc.) alleged that Extra Space allowed TikTok to track consumers’ behavior on the company’s website. Moreover, the lawsuit alleged that the information gathered by Extra Space on their website is “sent simultaneously to TikTok” so that TikTok could use its data to identify the user. In that case, Extra Space was successful in removing the case to Federal Court and, shortly thereafter, the case was dismissed without prejudice by the Plaintiff.
The legal landscape on this issue is evolving. Given the number of cases pending and the varying court decisions, businesses with consumer-facing websites (including self-storage companies) are advised to review their use of analytics and tracking tools. Ensuring transparent data collection practices and obtaining explicit user consent can be crucial steps in mitigating potential legal risks associated with trap and trace claims under both applicable state law and federal law.
For example, every website should now contain a “cookie waiver” typically seen as a cookie banner on a website. Certainly, by using these consent features businesses can argue that their users agreed to the collection of their data. These cookie waivers can demonstrate transparency by clearly informing users about the website’s tracking tools, including analytics and third-party integrations. It is important that the waivers offer customizable preferences, providing options for users to opt-in or opt-out of certain tracking methods.
Unfortunately, these waivers are not necessarily a complete defense to possible claims since courts have issued mixed rulings on whether consent banners alone provide adequate legal protection. Further, if the tracking occurs before a user gives consent, businesses may still be exposed to litigation.
Best practices in this area would be for every website to implement true “Opt-In” consent, ensuring that no tracking occurs before the visiting user explicitly agrees that their data may be tracked. It is also recommended that businesses using this technology keep and maintain their records of user consent (for future legal defense) and regularly audit and update their tracking scripts and privacy policies.
This article was originally published by Modern Storage Media and written by Scott Zucker, May 20th, 2025.
Scott Zucker is a founding partner in the Atlanta law firm of Weissmann Zucker Euster Morochnik &Garber P.C. and has been practicing law since 1987. Scott represents self-storage owners and managers throughout the country on legal matters including property development, facility construction, lease preparation, employment policies and tenant claims defense. He also provides, on a consulting basis, advice to self-storage companies in the areas of foreclosure and lien sales, premises liability and loss control safeguards. Scott can be reached at 404-364-4626 or by e-mail at Scott@wzlegal.com
