Looming Class Action Litigation Risk and DOJ’s Bulk Sensitive Data Transfer Rule: Navigating an Unexpected Compliance Trap

The U.S. Department of Justice (DOJ) began implementing the Bulk Sensitive Data Transfer Rule (the “BSD Transfer Rule” or the “Rule”) on April 8, 2025, to prevent foreign adversaries from accessing and weaponizing large volumes of sensitive U.S. personal and government data that could be used for espionage, surveillance, or exploitation. However, class action plaintiffs’ attorneys are leveraging the BSD Transfer Rule’s prohibitions to support data privacy and wiretapping claims that carry significant statutory damages.

Introduction

The BSD Transfer Rule’s enforcement authority rests with the National Security Division of DOJ. The Rule gives DOJ broad enforcement powers, including audits and civil and criminal enforcement, imposing civil penalties up to the greater of $368,136 or twice the value of the unlawful transaction. In cases of willful violations, criminal penalties can include fines up to $1 million and imprisonment up to 20 years. The Rule’s initial enforcement was rolled out in phases in 2025. In 2026, requirements under the Rule are in full effect. DOJ is treating violations of the BSD Transfer Rule as a national security concern, and its enforcement efforts are now comparable to export control violations. (For background, see Epstein Becker Green publications from July 2025, October 2025, December 2025, January 2026, and April 2026.)

Notably, the BSD Transfer Rule contains no explicit private right of action. However, less than a year after the Rule took effect, a novel litigation strategy began emerging that seeks to transform the BSD Transfer Rule from a government enforcement tool into a legal predicate for bringing data privacy and wiretapping class actions. Increasingly, class action plaintiffs’ attorneys are leveraging the BSD Transfer Rule’s prohibitions to support claims for illegally disclosing personal data under the state privacy and common laws; the federal Electronic Communications Privacy Act, 18 U.S.C. § 2511 (ECPA); the federal Class Action Fairness Act; and state wiretapping statutes—statutes that carry statutory damages ranging from $100 per day of violation to $10,000 or more per violation for each class member.

These complaints echo litigation arguments for bringing class claims against health care, telehealth, retail, and other online and website providers and platforms that use ubiquitous online cookies, advertising, analytics, and tracking technologies under the ECPA, California’s Invasion of Privacy Act (CIPA), and state common law.

Yet the strategy of private litigators using the BSD Transfer Rule in private litigation targeting the online collection and sharing of consumer personal information is expanding rapidly:

• September 2, 2025: In two class actions—Marissa Porcuna v. Xandr, Inc., No. 4:25-cv-07385 (N.D. Cal.) and Baker v. Index Exchange, Inc., Case No. 1:25-cv-10517 (N.D. Ill.)—the plaintiffs claim that the defendants violated the ECPA by unlawfully intercepting wire communications for the purpose of violating the BSD Transfer Rule. Both cases allege that digital advertising intermediaries used tracking technologies to intercept users’ interactions with third-party websites without meaningful consent and transmitted that data to Chinese-affiliated entities in violation of the BSD Transfer Rule, triggering ECPA liability.
• February 5, 2026: The plaintiff filed a complaint against Lenovo (United States) Inc., a U.S. subsidiary of Lenovo Group Limited (organized in Hong Kong with principal operations in Beijing), alleging that Lenovo had deployed tracking technologies on its website that intercepted communications and transmitted persistent identifiers (including IP addresses, cookie identifiers, advertising IDs, and full URL strings) to its Chinese parent. The lawsuit, which is discussed in more detail in the following section, further alleges that this data was collected from more than 100,000 U.S. persons, thereby satisfying the BSD Transfer Rule threshold, and that Lenovo failed to implement security controls mandated by the Cybersecurity and Infrastructure Security Agency. See Christy v. Lenovo (United States) Inc., Case No. 3:26-cv-01133 (N.D. Cal.).
• More Recently: Multiple class action complaints have been filed alleging violations of both the BSD Transfer Rule and the ECPA, including claims that website advertising infrastructure (such as the use of cookies, syncing mechanisms, and real-time bidding infrastructure) intercepts and transmits American consumers’ sensitive browsing data on a per-website-visit basis to Chinese-affiliated entities.

This development potentially transforms the BSD Transfer Rule from a national security regulation enforced exclusively by the government into an unexpected catalyst for high-stakes private litigation. For companies with international operations and partners, particularly those with business ties to designated “countries of concern,” the implications are immediate.

The BSD Transfer Rule 101

Understanding the emerging litigation risk requires first understanding the rule itself. The BSD Transfer Rule restricts and, in certain circumstances, prohibits providing access to U.S. personal data to certain “covered persons”—defined broadly to include entities headquartered in, organized under the laws of, or 50 percent or more owned by countries of concern (currently China, including Hong Kong and Macau; Russia; Iran; North Korea; Cuba; and Venezuela)—in a variety of “covered” business relationships and arrangements deemed “covered transactions.” The BSD Transfer Rule applies to transactions providing access to “bulk” quantities of “sensitive personal data,” broadly defined to be more expansive than protected health information under the Health Insurance Portability and Accountability Act, as well as “government-related data.”

However, the “bulk” threshold is deliberately low. For consumer identifiers, the BSD Transfer Rule applies when a U.S. company engages in data brokerage involving the “combination of any two listed identifiers” (such as IP addresses, mobile advertising IDs, or device identifiers) associated with 100,000 or more U.S. persons. The BSD Transfer Rule defines “sensitive personal data” expansively, including not just names and addresses, but precise geolocation data, financial information, health data, and biometric identifiers. Importantly, the Rule’s protections apply regardless of whether the data is de-identified, anonymized, pseudonymized, or encrypted.

The Rule divides covered transactions into two categories: “prohibited” and “restricted.” Prohibited transactions are simply banned—they cannot proceed under any circumstances. Restricted transactions can proceed if the company implements specific privacy and cybersecurity measures, including written data security programs, risk-based vendor screening procedures, annual independent audits, and senior management certification of compliance.

The BSD Transfer Rule also imposes a reporting obligation. U.S. persons must report known or suspected violations of contractual restrictions on bulk data transfers to DOJ within 14 days. From a litigation standpoint, this reporting obligation may create a paper trail and an implicit acknowledgment of legal risk awareness that plaintiffs’ attorneys may mine in discovery.

Christy v. Lenovo: Using the BSD to Attempt to Circumvent ECPA Defenses

The Christy v. Lenovo complaint, filed on February 5, 2026, in the Northern District of California, represents this new development in data privacy litigation. The case alleges that Lenovo, a Delaware corporation with a principal place of business in North Carolina, knowingly and systematically embedded third-party tracking technologies on its U.S. website that intercepted detailed information about American consumers’ browsing activity (including full URLs, pages viewed, product pages clicked, and behavioral patterns) and transmitted that data to Lenovo Group, its parent company in the People’s Republic of China.

This fact pattern itself is very common in current class action privacy litigation (especially in California). Indeed, most businesses deploy tracking pixels, cookies, and similar web analytics tools as routine business practice. But the Christy complaint innovates by invoking the BSD Transfer Rule as a potential predicate to strip Lenovo of its primary legal defense under the ECPA. 

Under the ECPA—a one-party consent statute enacted in 1986—it is generally unlawful to intentionally intercept, disclose, or use the content of electronic communications. However, the statute contains a crucial exception: a party to a communication can lawfully monitor its own communications without the other party’s knowledge or consent. This “party exception” potentially shields website operators from ECPA liability for deploying tracking technologies on their own websites.

But the ECPA’s crime-tort exception to the party exception creates an opening: when data is intercepted for the purpose of committing a criminal or tortious act, the “party exception” does not apply. The Christy complaint alleges that violation of the BSD Transfer Rule constitutes a criminal or tortious act, thereby triggering the crime-tort exception and stripping Lenovo of its party-exception defense. If successful, this theory would expose Lenovo to ECPA liability carrying statutory damages of up to $100 per day of violation per consumer, multiplied across a class potentially numbering in the millions.

The complaint further alleges violations of the CIPA and California’s consumer protection statutes. But the BSD Transfer Rule allegation is the mechanism by which plaintiffs’ attorneys are attempting to bypass the customary defenses that have long protected website operators from ECPA liability.

The Christy Theory Creates BSD Transfer Rule Risk

In Christy, plaintiffs are attempting to leverage regulatory risk as a predicate to statutory liability. By characterizing BSD Transfer Rule violations as underlying criminal or tortious acts, plaintiffs’ attorneys transform a regulatory compliance failure into a privacy statute violation, potentially unlocking treble damages and nationwide jurisdiction under the ECPA.

The risks posed by the Christy theory extend far beyond traditional class action litigation in three important ways. First, it may cause the courts to reconcile established privacy doctrine (largely focused on notice, consent, and opt-out rights) with novel national security arguments about cross-border data transfers. Second, it fundamentally reshapes corporate risk: companies previously focused on DOJ enforcement could now face unpredictable class action risks that have not yet been tested in court. Third, it potentially expands liability across the entire data supply chain. Website operators, analytics vendors, ad networks, and data brokers could all face claims for transferring user data to countries of concern in violation of the BSD Transfer Rule.

Implications for Corporate Compliance

The emergence of this litigation strategy creates the following immediate compliance imperatives for companies, particularly those with international operations or cross-border data flows:

• First, companies should conduct comprehensive audits of their data transactions to identify whether they constitute “covered data transactions” under the BSD Transfer Rule. This requires mapping data flows from collection through transmission, identifying “bulk” thresholds, and determining whether any transactions involve “covered persons” or “countries of concern.” Notably, auditing companies with complex structures is extraordinarily challenging under the BSD Transfer Rule, as covered persons encompass not just entities headquartered in countries of concern, but also those entities that are 50 percent or more owned, controlled, or directed by such countries, employees, agents, or contractors working for covered entities, and designated persons.
• Second, companies should assess whether their current privacy policies and data security practices comply with BSD Transfer Rule requirements, particularly as pertaining to their website operations. The Rule requires written cybersecurity programs, risk-based vendor screening, annual audits, and senior management certification. These compliance requirements took effect on October 6, 2025 (over nine months ago). Thus, companies that have failed to implement these measures may create a potential litigation vulnerability since the absence of compliance programs potentially becomes evidence of knowing or reckless violation.
• Third, companies should recognize that the BSD Transfer Rule has emerged as a potential litigation predicate. Legal and compliance teams should coordinate to understand whether alleged BSD Transfer Rule violations could support claims under ECPA, state wiretapping laws, and state consumer protection statutes.
• Fourth, companies engaged in digital advertising, analytics, or data brokerage should scrutinize their relationships with downstream recipients of data. The Christy and related complaints target the full supply chain—from website owner to analytics provider to advertising network to final recipient. Companies should take efforts to understand where user data ultimately flows and whether any recipients qualify as covered persons. The BSD Transfer Rule’s requirement to report known or suspected violations to DOJ within 14 days means that companies with knowledge of questionable data flows could face both regulatory and litigation exposure if they fail to investigate and disclose.

Conclusion

The emergence of private litigation based on alleged violations of the BSD Transfer Rule represents a significant new development in data privacy law and litigation. Plaintiffs are now attempting to use a national security regulation designed to prevent foreign adversary access to bulk data in private class action litigation to arguably support statutory damages claims under decades-old wiretapping statutes. Although this new theory is presently unproven in court, its very emergence creates compliance obligations and unexpected litigation risks.

Thus, it is a best practice for businesses to implement comprehensive BSD Transfer Rule audits and compliance remediation. Further, impacted businesses will need to adopt a compliance infrastructure, vendor diligence, and data flow mapping to fully and timely comply with BSD Transfer Rule requirements.

* * * *

For additional information about the issues discussed in this Insight, please contact the attorney(s) listed on this page or the Epstein Becker Green Health Care and Life Sciences attorney who regularly handles your legal matters.

Explore our dedicated hub for in-depth insights and resources on the DOJ’s BSD Transfer Rule: Learn more here.

Epstein Becker Green Staff Attorney Ann W. Parks contributed to the preparation of this Insight.