Oracle and Salesforce hit with GDPR class action lawsuits over cookie tracking consent

The use of third party cookies for ad tracking and targeting by data broker giants Oracle and Salesforce is the focus of class action style litigation announced today in the UK and the Netherlands.

The suits will argue that mass surveillance of Internet users to carry out real-time bidding ad auctions cannot possibly be compatible with strict EU laws around consent to process personal data.

The litigants believe the collective claims could exceed 10BN, should they eventually prevail in their arguments - though such legal actions can take several years to work their way through the courts.

In the UK, the case may also face some legal hurdles given the lack of an established model for pursuing collective damages in cases relating to data rights. Though there are signs that's changing.

Non-profit foundation, The Privacy Collective, has filed one case today with the District Court of Amsterdam, accusing the two data broker giants of breaching the EU's General Data Protection Regulation (GDPR) in their processing and sharing of people's information via third party tracking cookies and other adtech methods.

The Dutch case, which is being led by law-firm bureau Brandeis, is the biggest-ever class action in The Netherlands related to violation of the GDPR - with the claimant foundation representing the interests of all Dutch citizens whose personal data has been used without their consent and knowledge by Oracle and Salesforce.

A similar case is due to be filed later this month at the High Court in London England, which will make reference to the GDPR and the UK's PECR (Privacy of Electronic Communications Regulation) - the latter governing the use of personal data for marketing communications. The case there is being led by law firm Cadwalader.

Under GDPR, consent for processing EU citizens' personal data must be informed, specific and freely given. The regulation also confers rights on individuals around their data - such as the ability to receive a copy of their personal information.

It's those requirements the litigation is focused on, with the cases set to argue that the tech giants' third party tracking cookies, BlueKai and Krux - trackers that are hosted on scores of popular websites, such as Amazon, Booking.com, Dropbox, Reddit and Spotify to name a few - along with a number of other tracking techniques are being used to misuse Europeans' data on a massive scale.

Per Oracle marketing materials, its Data Cloud and BlueKai Marketplace provider partners with access to some 2BN global consumer profiles. (Meanwhile, as we reported in June, BlueKai suffered a data breach that exposed billions of those records to the open web.)

While Salesforce claims its marketing cloud interacts' with more than 3BN browsers and devices monthly.

Both companies have grown their tracking and targeting capabilities via acquisition for years; Oracle bagging BlueKai in 2014 - and Salesforce snaffling Krux in 2016.

In this case, NYT is sharing visitor data with e.g.:

- https://t.co/NMsaCzjhv5, Oracle, claims to have profiles on 2bn consumers
- https://t.co/foiigL4T9C: Lotame, claims to have profiles on 3bn users
- https://t.co/BCmd8oKDoq: Salesforce DMP, claims to 'interact' with 3bn users

- Wolfie Christl (@WolfieChristl) March 23, 2018

Discussing the lawsuit in a telephone call with TechCrunch, Dr Rebecca Rumbul, class representative and claimant in England & Wales, said: There is, I think, no way that any normal person can really give informed consent to the way in which their data is going to be processed by the cookies that have been placed by Oracle and Salesforce.

When you start digging into it there are numerous, fairly pernicious ways in which these cookies can and probably do operate - such as cookie syncing, and the aggregation of personal data - so there's really, really serious privacy concerns there."

The real-time-bidding (RTB) process that the pair's tracking cookies and techniques feed, enabling the background, high velocity trading of profiles of individual web users as they browse in order to run dynamic ad auctions and serve behavioral ads targeting their interests, has, in recent years, been subject to a number of GDPR complaints, including in the UK.

These complaints argue that RTB's handling of people's information is a breach of the regulation because it's inherently insecure to broadcast data to so many other entities - while, conversely, GDPR bakes in a requirement for privacy by design and default.

The UK Information Commissioner's Office has, meanwhile, accepted for well over a year that adtech has a lawfulness problem. But the regulator has so far sat on its hands, instead of enforcing the law - leaving the complainants dangling. (Last year, Ireland's DPC opened a formal investigation of Google's adtech, following a similar complaint, but has yet to issue a single GDPR decision in a cross-border complaint - leading to concerns of an enforcement bottleneck.)

The two lawsuits targeting RTB aren't focused on the security allegation, per Rumbul, but are mostly concerned with consent and data access rights.

She confirms they opted to litigate rather than trying to try a regulatory complaint route as a way of exercising their rights given the David vs Goliath" nature of bringing claims against the tech giants in question.

If I was just one tiny person trying to complaint to Oracle and trying to use the UK Information Commissioner to achieve that... they simply do not have the resources to direct at one complaint from one person against a company like Oracle - in terms of this kind of scale," Rumbul told TechCrunch.

In terms of being able to demonstrate harm, that's quite a lot of work and what you get back in recompense would probably be quite small. It certainly wouldn't compensate me for the time I would spend on it... Whereas doing it as a representative class action I can represent everyone in the UK that has been affected by this.

The sums of money then work - in terms of the depths of Oracle's pockets, the costs of litigation, which are enormous, and the fact that, hopefully, doing it this way, in a very large-scale, very public forum it's not just about getting money back at the end of it; it's about trying to achieve more standardized change in the industry."

If Salesforce and Oracle are not successful in fighting this then hopefully that send out ripples across the adtech industry as a whole - encouraging those that are using these quite pernicious cookies to change their behaviours," she added.

The litigation is being funded by Innsworth, a litigation funder which is also funding Walter Merricks' class action for 46 million consumers against Mastercard in London courts. And the GDPR appears to be helping to change the class action landscape in the UK - as it allows individuals to take private legal action. The framework can also support third parties to bring claims for redress on behalf of individuals. While changes to domestic consumer rights law also appear to be driving class actions.

Commenting in a statement, Ian Garrard, managing director of Innsworth Advisors, said: The development of class action regimes in the UK and the availability of collective redress in the EU/EEA mean Innsworth can put money to work enabling access to justice for millions of individuals whose personal data has been misused."

A separate and still ongoing lawsuit in the UK, which is seeking damages from Google on behalf of Safari users whose privacy settings it historically ignored, also looks to have bolstered the prospects of class action style legal actions related to data issues.

While the courts initially tossed the suit last year, the appeals court overturned that ruling - rejecting Google's argument that UK and EU law requires proof of causation and consequential damage" in order to bring a claim related to loss of control of data.

The judge said the claimant did not need to prove pecuniary loss or distress" to recover damages, and also allowed the class to proceed without all the members having the same interest.

Discussing that case, Rumbul suggests a pending final judgement there (likely next year) may have a bearing on whether the lawsuit she's involved with can be taken forward in the UK.

I'm very much hoping that the UK judiciary are open to seeing these kind of cases come forward because without these kinds of things as very large class actions it's almost like closing the door on this whole sphere of litigation. If there's a legal ruling that says that case can't go forward and therefore this case can't go forward I'd be fascinated to understand how the judiciary think we'd have any recourse to these private companies for these kind of actions," she said.

Asked why the litigation has focused on Oracle and Saleforce, given there are so many firms involved in the adtech pipeline, she said: I am not saying that they are necessarily the worst or the only companies that are doing this. They are however huge, huge international multimillion-billion dollar companies. And they specifically went out and purchased different bits of adtech software, like BlueKai, in order to bolster their presence in this area - to bolster their own profits.

This was a strategic business decision that they made to move into this space and become massive players. So in terms of the adtech marketplace they are very, very big players. If they are able to be held to account for this then it will hopefully change the industry as a whole. It will hopefully reduce the places to hide for the other more pernicious cookie manufacturers out there. And obviously they have huge, huge revenues so in terms of targeting people who are doing a lot of harm and that can afford to compensate people these are the right companies to be targeting."

Rumbul also told us The Privacy Collective is looking to collect stories from web users who feel they have experienced harm related to online tracking.

There's plenty of evidence out there to show that how these cookies work means you can have very, very egregious outcomes for people at an individual level," she added. Whether that can be related to personal finance, to manipulation of addictive behaviors, whatever, these are all very, very possible - and they cover every aspect of our lives."

Consumers in England and Wales and the Netherlands are being encouraged to register their support of the actions via The Privacy Collective's website.

In a statement, Christiaan Alberdingk Thijm, lead lawyer at Brandeis, said: Your data is being sold off in real-time to the highest bidder, in a flagrant violation of EU data protection regulations. This ad-targeting technology is insidious in that most people are unaware of its impact or the violations of privacy and data rights it entails. Within this adtech environment, Oracle and Salesforce perform activities which violate European privacy rules on a daily basis, but this is the first time they are being held to account. These cases will draw attention to astronomical profits being made from people's personal information, and the risks to individuals and society of this lack of accountability."

Thousands of organisations are processing billions of bid requests each week with at best inconsistent application of adequate technical and organisational measures to secure the data, and with little or no consideration as to the requirements of data protection law about international transfers of personal data. The GDPR gives us the tool to assert individuals' rights. The class action means we can aggregate the harm done," added partner Melis Acuner from Cadwalader in another supporting statement.

We reached out to Oracle and Salesforce for comment on the litigation.

Oracle EVP and general counsel, Dorian Daley, said:

The Privacy Collective knowingly filed a meritless action based on deliberate misrepresentations of the facts. As Oracle previously informed the Privacy Collective, Oracle has no direct role in the real-time bidding process (RTB), has a minimal data footprint in the EU, and has a comprehensive GDPR compliance program. Despite Oracle's fulsome explanation, the Privacy Collective has decided to pursue its shake-down through litigation filed in bad faith. Oracle will vigorously defend against these baseless claims.

A spokeswoman for Salesforce sent us this statement:

At Salesforce, Trust is our #1 value and nothing is more important to us than the privacy and security of our corporate customers' data. We design and build our services with privacy at the forefront, providing our corporate customers with tools to help them comply with their own obligations under applicable privacy laws - including the EU GDPR - to preserve the privacy rights of their own customers.

Salesforce and another Data Management Platform provider, have received a privacy related complaint from a Dutch group called The Privacy Collective. The claim applies to the Salesforce Audience Studio service and does not relate to any other Salesforce service.

Salesforce disagrees with the allegations and intends to demonstrate they are without merit.

Our comprehensive privacy program provides tools to help our customers preserve the privacy rights of their own customers. To read more about the tools we provide our corporate customers and our commitment to privacy, visit salesforce.com/privacy/products/

Cookie consent tools are being used to undermine EU privacy rules, study suggests