On May 18, 2021, a consumer filed a putative class action lawsuit against a tech company in California federal court. The consumer alleges that the company violates users’ privacy by selling their personally identifiable information (PII) to third parties in connection with a real-time bidding system it uses for digital ad sales. In his complaint, the plaintiff alleges that the company represented in its privacy policy, terms of service, and elsewhere that a user’s PII would not be shared with third parties without the user’s consent. However, the complaint avers that the company purportedly sold users’ PII—including user location data, browsing history, and demographic and health information—to third parties that participate in the company’s ad bidding auction process, and that it did so without ever informing users that their data was being shared. The complaint alleges that this conduct violates the Electronic Communications Privacy Act (ECPA) as well as a range of consumer privacy and contract rights under California constitutional, statutory, and common law.
This case demonstrates the importance of making sure that public-facing representations made about the use of PII are consistent with how such information is actually used in practice. Businesses should revisit their privacy policies and terms of service on a regular basis to ensure that users are properly informed about how their data may be used and with whom that data may be shared.