Salesforce Wins A Wiretap Round

Open Setup in a [Service Cloud](/terms/service-cloud) org and search for Messaging Sessions. Every row in that list is a stored recording of a conversation a customer had with your company. On Friday a federal judge in San Francisco decided that one of those recordings was not worth a class action.

The court denied class certification in the long-running privacy suit against Salesforce over chat on RiteAid.com. The reason was standing. The proposed class representative's intercepted chat asked about COVID test availability, disclosed no sensitive medical information, and therefore did not amount to a concrete privacy injury.

That is a genuine win for Salesforce and for every company running chat on somebody else's platform. It is also narrower than the headline reads, and the part that survives is the part your org has to answer for.

What The Judge Decided, And What Was Left Open

Class certification is a procedural gate, not a verdict. Losing it does not mean the defendant did nothing wrong. It means this plaintiff cannot stand in for everyone else.

The economics are what make it decisive. Under the California Invasion of Privacy Act, statutory damages run to $5,000 per violation. One plaintiff with one chat is a nuisance. A certified class of everyone who ever opened the chat widget on a national pharmacy's website is an existential number. Take away certification and the case shrinks to something a company settles over lunch.

What the court did not do is rule that Salesforce chat is lawful. It did not hold that transcripts sitting on a vendor's servers fall outside the wiretap statutes. It did not touch the private right of action. It said this named plaintiff, with this chat, could not represent a class.

The next plaintiff will bring a chat about a prescription rather than a test kit.

Four Years To Get Here

Yockey v. Salesforce was filed in the Northern District of California in December 2022 and has sat with Judge Jon S. Tigar ever since. The theory was that Salesforce's chat product intercepted conversations between customers and companies in real time, without consent, and kept the transcripts. Rite Aid and Kaiser Permanente were the sites named.

Salesforce moved to dismiss twice. In August 2023 the court granted that motion in part. In August 2024 it denied the next one, finding the plaintiffs had adequately pleaded claims under CIPA and Pennsylvania's Wiretapping and Electronic Surveillance Control Act, partly because chats carrying health information counted as confidential communications.

So the case cleared the pleadings on the strength of health data and failed at certification on the absence of it. That is not a contradiction. It is one fact answering two different questions.

The Ninth Circuit Got There First

Fourteen months before Friday's order, the Ninth Circuit decided Gutierrez v. Converse. Converse had been sued for aiding and abetting Salesforce in violating CIPA section 631(a) through the chat on its site. The panel affirmed summary judgment for Converse on two grounds.

The first clause of 631(a) speaks of a telegraph or telephone wire, line, cable or instrument. The court held that it does not reach internet communications. That language dates to 1967, and the legislature has amended CIPA twice since without extending it. The second clause failed on evidence: nothing in the record showed Salesforce read or tried to read the message.

The court's description of how the chat worked is the part worth copying into your architecture notes. Messages were encrypted in transit. Transcripts sat on Salesforce servers. Access ran through a password-protected dashboard.

Converse won on the configuration, not on a blanket rule about chat. An org that exports transcripts nightly to a marketing tool, or exposes them through an integration user with a wide permission set, does not have the same facts.

The Ninth Circuit also did not solve this nationally. Its holding binds California and eight other states. The Pennsylvania claim in Yockey runs under a different statute with its own text, and roughly a dozen states require every party to a communication to consent rather than just one. A company operating chat nationally is exposed to whichever of those statutes a plaintiff's lawyer prefers, and the reasoning about telephone wires does not travel automatically.

SB 690 Removes One Theory, Not The Big One

On 28 August the California legislature passed SB 690, clearing the Assembly 66 to 0. It ends the private right of action under CIPA section 638.51, the pen register and trap and trace clause that plaintiffs have been stretching to cover website analytics and session capture, and makes the state attorney general the only party who can enforce it. The bill is written to be operative on 1 January 2027 and to reach pending claims in actions commenced within two years of that date. The governor has not signed it yet.

Now read what it leaves alone. Sections 631 and 632 stay where they are, private right of action intact, $5,000 per violation intact. Those are the provisions behind chatbot, session replay and pixel suits, this one included. Federal ECPA claims stay. CCPA and CPRA stay. Common law privacy theories stay.

The bill changes who may sue under one clause. It does not declare any tracking technology lawful, and it creates no safe harbour. Anyone reading SB 690 as the end of California web privacy litigation is reading the wrong section.

The Product In The Case No Longer Exists

Legacy Chat, the product Yockey was actually about, was retired on 14 February 2026. Live Agent, Salesforce Chat, Embedded Chat and Service Chat all went with it. What replaced it is Messaging for In-App and Web, since renamed Enhanced Chat, running on Hyperforce with asynchronous conversations a customer can pick back up days later.

Persistent is the word that matters. Legacy Chat produced a transcript per session, which ended when the customer closed the window. Enhanced Chat produces a conversation that keeps accumulating across visits, devices and channels. Agentforce service agents write into the same object graph. Service Cloud Voice adds transcribed calls, and Einstein Conversation Insights adds meeting audio on the sales side.

Add it up and the volume of stored customer speech in an average org is several times what it was when this complaint was filed in 2022. The consent notice on most chat widgets has not been rewritten in that time.

The migration itself changed the shape of the data as well as the volume. Legacy Chat wrote to LiveChatTranscript. Enhanced Chat writes MessagingSession and ConversationEntry records, and the entry rows hold the message contents. Anyone who moved off Chat before the February retirement built a mapping for the reporting they cared about. Very few of them revisited the retention rules, the field-level security, or the sharing model on the new objects, because the migration was scoped as a functional swap rather than as a change to where sensitive customer text lives.

There is a second wrinkle. Salesforce began enabling Agentforce on eligible orgs on a rolling basis in the first week of September. Every new agent conversation is another stored record, created under a notice written for a human representative, with a retention period nobody has set.

Elsewhere This Weekend

The first Winter '27 production upgrade wave ran Friday night into Saturday. The remaining waves are 2 October and 9 October. Confirm your own instance on Salesforce Trust rather than assuming, because instance assignment follows no pattern worth guessing at.

Dreamforce runs 15 to 17 September at Moscone Center. Dreamfest is on the 16th at Oracle Park, headlined by Usher and Gwen Stefani, with tickets starting around $1,500. The event has raised more than $130 million for UCSF Benioff Children's Hospitals over its history.

Salesforce in Claude, the plugin half of the Claudeforce partnership announced in August, is still expected to reach open beta this month. Nothing had shipped as of this weekend.

What To Do This Week

Find your retention period. Look at Messaging Sessions and Conversation Entries and work out how long each is kept. In most orgs nobody ever set a number, which means the real answer is forever. A four-year-old transcript is a liability with no operational value attached to it.

Read your consent notice against your current products. The wording on most chat widgets describes a single session with a human representative. It was written before persistent conversations, before agent handoffs, and before an Agentforce service agent was the first thing a customer talked to. If the notice does not describe what happens now, it is not doing the job it exists to do.

Check the architecture against the one that won. Encrypted in transit, stored on the platform, reachable only through authenticated and permissioned users. Then look for the exceptions: the nightly export, the integration user with broad object access, the reporting tool holding a copy outside the org. Those are the facts a plaintiff would use to distinguish your setup from Converse's.

Separate agent conversations from human ones. Do it in the data model, not in a report filter. Retention, disclosure and consent all have reasons to differ between the two, and sorting them out by hand under a deadline is the worst version of this task.

Give conversation data an owner. Support assumes legal owns it. Legal assumes support does. Marketing has a copy of it in a segment nobody remembers building. Name a person, write it down, and put a review date on it.

Start with retention. It costs an afternoon, needs no budget approval, and it is the only one of the five that gets more expensive every week you leave it. The ruling on Friday bought the ecosystem time. It did not change what is sitting in your org.

About the Author

Dipojjal Chakrabarti is a B2C Solution Architect with 29 Salesforce certifications and over 13 years in the Salesforce ecosystem. He writes and edits salesforcedictionary.com, published by KineticBit Inc., to help admins, developers, architects, and cert/interview candidates sharpen their fundamentals. More about Dipojjal.