Detroit is not the first city that comes to mind when compliance officers think about digital privacy litigation risk. California dominates that conversation, and for good reason — CIPA wiretapping claims, CCPA enforcement, and a plaintiff bar that has spent a decade developing pixel-tracking theories in the Northern and Central Districts. But plaintiff litigation does not stay in its home jurisdiction. A firm with established class action infrastructure, a history of taking on large corporate defendants, and the willingness to file in California federal court on behalf of California residents can operate as effectively from Michigan as from San Francisco. Liddle & Dubin, P.C. was once one firm who was doing exactly that. Now they are split into two firms Dubin Law in Ann Arbor & Liddle Sheets who is a class action consumer protection law firm with a recent settlement of $32.5 million in the McKnight v. Uber Technologies
Both firm’s expansion into digital privacy class actions follows a pattern that has become familiar across the plaintiff bar over the last several years: consumer protection litigators with existing class action infrastructure recognizing that website tracking technologies create the uniform, class-wide factual predicates that make mass litigation economically viable. The technical violation is the same for every consumer who visited the website. The damages formula is the same. The discovery demands are the same. The only variable is the number of class members, and for companies with significant web traffic, that number tends to be large.
Dubin Law Firm and Liddle Sheets
These consumer protection Detroit-based plaintiff litigation firms with a history in consumer protection and class action matters spanning multiple industries. The firm has built its practice around representing consumers against large corporate defendants — a posture that translates directly into the digital privacy litigation context, where defendants are typically consumer-facing companies with significant web presences and the plaintiffs are the consumers those websites track.
The firm’s Midwest base serves a dual function. Michigan provides home jurisdiction for consumer protection claims under the Michigan Consumer Protection Act, a statute that can be applied to deceptive data collection practices affecting Michigan residents independently of federal privacy theories. It also places the firm in a litigation environment where class action practice is well established and where courts are accustomed to handling complex multi-party consumer cases.
More consequentially for companies assessing their exposure, Liddle & Dubin’s national class action practices gives them the infrastructure to file and litigate in California — home to CIPA, the most frequently litigated state privacy wiretapping statute in the country. A Detroit-based firm that can credibly file and litigate CIPA claims in the Northern or Central District of California is not geographically constrained in the way that a pure state-court plaintiff boutique would be. Any company with California users is within reach.
Primary Legal Theories
California Invasion of Privacy Act
CIPA is the central statutory vehicle for their digital privacy practice. The firm pursues claims under Section 631 — California’s wiretapping prohibition — against companies whose websites run third-party tracking scripts that capture user interactions in real time. The theory holds that these scripts, operated by companies that are not party to the communication between the user and the website, constitute unauthorized interceptions of electronic communications under the statute.
The “party to the communication” defense — the argument that a website operator is inherently a party to any communication occurring on its platform and therefore cannot intercept its own communications — is the most commonly raised basis for dismissal in CIPA pixel cases. Courts in the Ninth Circuit have been inconsistent on this defense, and its availability depends heavily on how the complaint characterizes the role of the third-party script operator relative to the website. Plaintiff firms with experience in this litigation have become skilled at drafting complaints that emphasize the independence of the third-party vendor from the website operator, framing the vendor as an unauthorized listener rather than a disclosed service provider. The defense does not reliably produce dismissal at the pleadings stage, and cases that survive early motion practice tend to resolve in settlement.
The geographic reach of their CIPA practice is not limited to California-based companies. The statute applies whenever California residents are among the affected consumers, regardless of where the defendant is headquartered. A Michigan retailer, a Texas healthcare provider, a New York media company — all face CIPA exposure if their websites track California users through non-consensual third-party scripts. The firm’s willingness to file in California federal court on behalf of California class members extends its reach to every company with meaningful California web traffic.
On the Liddle Sheets website it talks about Data Privacy/Security:
“Data breaches or misuse are a growing and serious problem. In today’s world the companies you do business with are responsible for protecting and responsibly using your sensitive data. When they don’t, your privacy can be seriously threatened or your identity may be used by criminals. Various laws protect your rights to privacy and data security. We can help affected people vindicate those rights.”
Electronic Communications Privacy Act
Federal ECPA claims provide a jurisdiction-independent theory that can be pursued in any federal court regardless of the defendant’s or plaintiff’s home state. The firm’s ECPA wiretapping theory parallels its CIPA theory: real-time transmission of user interaction data to third-party advertising platforms constitutes unauthorized interception of electronic communications under Title I of the statute.
ECPA claims serve two functions in Liddle & Dubin’s litigation architecture. First, they provide a federal hook that supports nationwide class treatment, expanding the potential class beyond California residents to all consumers whose data was transmitted without authorization. Second, they create redundancy — if a CIPA claim is dismissed on party-to-the-communication grounds, a companion ECPA theory that has survived the same motion maintains the case and the settlement pressure that comes with active litigation.
The circuit courts have divided on important threshold questions under ECPA’s application to website tracking, including what constitutes “contents” of a communication as opposed to routing or addressing information, and whether the consent of the website operator to the tracking script’s operation satisfies the statute’s authorization requirements. These unresolved questions mean that ECPA claims in the tracking context are not guaranteed to survive dismissal — but they are viable enough in enough circuits to remain a standard component of digital privacy complaints.
Michigan Consumer Protection Act and State Equivalents
The Michigan Consumer Protection Act prohibits unfair, unconscionable, or deceptive methods, acts, or practices in the conduct of trade or commerce. Applied to website tracking, the theory holds that collecting consumer data through undisclosed tracking technologies, or collecting data in ways that contradict published privacy policy representations, constitutes a deceptive practice under the statute.
MCPA claims serve a different function than CIPA or ECPA claims. They are not wiretapping theories dependent on the real-time interception framework — they are consumer fraud theories dependent on the gap between what companies tell consumers about their data practices and what those practices actually are. A company that publishes a privacy policy stating that it does not share personal data with third parties, while simultaneously running advertising pixels that transmit user data to Meta and Google, has a MCPA exposure that exists independently of whether the interception theory prevails.
The layering of state consumer protection claims with federal and California privacy theories is standard practice among plaintiff firms that have built multi-jurisdictional digital privacy practices. Each statutory layer has different elements, different damages structures, and different threshold questions — which means that no single successful defense theory resolves all claims simultaneously.
Target Industries and the Profile of a Liddle & Dubin Defendant
The firm’s targeting logic follows the consumer-facing web presence model that characterizes most digital privacy plaintiff practices. Any company with significant Michigan or California user bases that runs standard third-party analytics and advertising infrastructure without a consent management platform that obtains prior opt-in consent fits the exposure profile.
Retail and e-commerce. Retailers operating websites with advertising pixels — Meta Pixel, Google Analytics, TikTok Pixel, and their equivalents — are the most common targets in digital privacy class action litigation. The density of tracking code on retail sites, combined with the large consumer classes that retail web traffic produces, makes these defendants structurally attractive for the class action model.
Healthcare providers and health technology companies. Healthcare defendants face compounding exposure: ECPA and CIPA claims based on tracking pixel deployment combine with HIPAA-adjacent theories about the unauthorized transmission of protected health information when authenticated patients interact with provider websites or patient portals. Healthcare organizations that have not audited their pixel inventory since the HHS Office for Civil Rights issued tracking pixel guidance in December 2022 are operating with unreviewed exposure.
Financial services. Banks, credit unions, insurance companies, and fintech platforms that use behavioral analytics on consumer-facing websites face both the standard wiretapping theory and heightened damages arguments based on the sensitivity of the underlying financial relationship. Courts and juries are more receptive to “intentional or reckless” violation arguments when the data at issue involves financial account activity.
Media and publishing. Companies that monetize audience data through advertising networks are in the direct line of the tracking pixel litigation wave. Any media organization whose website runs advertising pixels alongside content that authenticated subscribers view faces potential exposure under both CIPA and, if video content is present, the Video Privacy Protection Act.
The Michigan-to-California Filing Strategy and What It Means for Defense
A Michigan firm filing CIPA claims in California federal court on behalf of California class members is not a novel phenomenon — it is a feature of how national class action practice works. But it has implications for how defendants should assess and respond to demand letters from either Liddle Sheets or Dubin Law
The firm’s willingness to litigate in California means that defendants cannot assume that geographic distance from the plaintiff’s home jurisdiction reduces exposure. A demand letter from Detroit does not represent less litigation risk than a demand letter from Los Angeles when the underlying claims are California statutory claims that will be litigated in California federal court under California law.
The co-counsel coordination model that characterizes multi-jurisdictional class action practice further amplifies the firm’s effective capacity. Dubin & Liddle Sheets established relationships with the broader plaintiff class action bar mean that a case the firm originates can draw on the litigation resources and discovery infrastructure of co-counsel as it develops. Defendants who assess the firm’s capacity solely by its size or geographic base are likely to underestimate the resources available to the opposition.
Compliance Implications: What This Filing Profile Tells You to Fix
Michigan operations do not insulate Michigan companies from CIPA. The most common geographic misconception in digital privacy compliance is that CIPA applies only to California-based companies. It applies to any company whose website is used by California residents. A Detroit retailer with California customers and a standard Meta Pixel deployment has CIPA exposure that the firm’s home state makes no difference to.
Privacy policy accuracy is an independent liability vector. MCPA and equivalent consumer protection claims turn on the gap between disclosed and actual data practices, not on the wiretapping theory. Companies that have implemented consent banners but have not updated their privacy policies to accurately reflect what their tracking infrastructure actually does — which third parties receive data, what categories of data are transmitted, whether that transmission occurs before or after consent — face consumer fraud exposure that exists separately from wiretapping claims.
Consent management implementation must be technically accurate, not just legally sufficient on its face. A consent banner that categorizes advertising cookies as “functional” or that fires tracking scripts before the user has interacted with the consent interface does not satisfy CIPA’s prior consent requirement regardless of how the banner is labeled. Plaintiff firms audit the technical implementation of consent tools, not just their existence. What matters is what fires when, not what the privacy policy says should fire when.
Michigan Consumer Protection Act claims broaden the class beyond California residents. A company defending a Liddle & Dubin complaint cannot limit its exposure analysis to California users. MCPA claims potentially cover all Michigan consumers affected by the same data practices, and the pairing of state consumer protection claims with federal ECPA claims can support nationwide class treatment. The total class size in a multi-theory complaint is larger than the California-resident subclass alone.
Healthcare organizations must treat pixel audits as a compliance priority, not a discretionary review. The combination of ECPA, CIPA, and HIPAA-adjacent exposure that healthcare pixel cases generate means that a single non-compliant pixel deployment on a patient portal or health information page creates multiple simultaneous liability theories. The remediation cost of a proactive audit is a small fraction of the defense cost of a federal class action.
The Longer View
Michigan plaintiffs firms for consumer protection violations around data privacy is an expansion into digital privacy class actions is one data point in a broader pattern: established plaintiff firms with consumer protection infrastructure entering a litigation market that has been demonstrated to produce substantial settlements across a wide range of industries and company sizes. The firm does not need to invent new legal theories — CIPA, ECPA, and state consumer protection statutes are well-established, and the factual predicate for filing against most consumer-facing companies with standard digital marketing infrastructure is present on the first visit to their website.
For companies assessing their exposure, the relevant question is not whether their tracking practices are typical. They almost certainly are. The question is whether typical practices are compliant practices — and in the current enforcement and litigation environment, the answer for most companies is that they are not, or at least not demonstrably so in the ways that matter when a plaintiff firm starts building a complaint.
Geographic distance from the plaintiff bar’s home jurisdictions provides no protection. Compliance does.
5 Compliance Steps to Reduce Your Exposure
- Inventory and classify every tracking technology on your website. Each tool must be categorized by purpose — essential, functional, analytics, or advertising — with documentation of the specific data transmitted, the third parties receiving it, and the legal basis for collection. This inventory is the foundation of every other compliance step and the first document opposing counsel will seek in discovery.
- Implement a consent management platform that obtains prior, affirmative opt-in consent before non-essential tracking fires. The technical sequence matters as much as the legal language: consent must be obtained before the script executes, not after. Test your implementation to confirm that advertising and analytics pixels do not fire on page load before user interaction with the consent interface.
- Audit your privacy policy against your actual tracking infrastructure. Every third party that receives data from your website, every category of data transmitted, and the conditions under which transmission occurs must be accurately reflected in your published disclosures. The gap between policy language and technical reality is the basis for consumer protection claims that exist independently of wiretapping theories.
- Assess your exposure under both Michigan and California law if your website serves consumers in either state. CIPA applies to California users regardless of your headquarters. MCPA applies to Michigan consumers regardless of where your server infrastructure is located. Multi-state web operations require multi-state compliance analysis.
- Conduct a vendor contract review that allocates CIPA and ECPA compliance obligations explicitly. Third-party tracking vendors whose scripts generate wiretapping exposure are not your liability shield — they are your co-defendants in the complaint the plaintiff firm drafts. Contracts that address privacy compliance obligations and include appropriate indemnification provisions reduce your exposure; contracts that are silent on these issues do not.
How Captain Compliance Can Help
The compliance gaps that these Michigan consumer protection firms target — undisclosed third-party data flows, consent banners that fire scripts before user interaction, privacy policies that have not been updated to reflect actual tracking infrastructure — are identifiable before a demand letter arrives and fixable before a complaint is filed. Captain Compliance specializes in comprehensive website tracking audits, consent management platform implementation, CIPA and ECPA risk assessments, multi-state privacy policy reviews, and litigation-readiness analyses that close the gaps plaintiff firms find on their first visit to your site.
While Michigan doesn’t as of the time of this writing have a comprehensie data privacy law it can certainly pay dividends to protect your business and be proactive as there are pistons firing even from Michigan when it comes to privacy litigation risk. Book a demo below to protect your business today.
