Microsoft Edge Secretly Tracks Users’ Internet Browsing Activity Without Consent, Class Action Alleges

A proposed class action filed late last week claims Microsoft Corporation has failed to adequately inform Microsoft Edge users that it programmed certain versions of the web browser to intercept and collect a wide range of private data relating to their internet activity.

The 92-page case alleges the tech behemoth, which first released Edge in 2015 to succeed Internet Explorer, has designed versions 90, 92 and 93 of the browser (as well as earlier and later iterations) to track users’ internet browsing activities, searches and online shopping behavior, even when they’re using an “InPrivate” window to browse in Microsoft’s supposedly incognito mode. According to the complaint, Microsoft uses this data to improve its software, services and devices, provide targeted advertising and develop its artificial intelligence and machine-learning systems, such as ChatGPT.

The plaintiffs, four individuals who use Edge to search the internet, say they were completely unaware of – and therefore, could not consent to – Microsoft’s interception, collection and use of their private data.

What data does Microsoft allegedly collect?

The suit contends that versions 90, 92 and 93 of Edge, all of which were released in 2021, intercept the text users type into a website’s search bar and the URLs of each webpage they visit. Edge then sends this data to the Microsoft Bing server, the filing says.

In addition, version 92 Edge users who set Yahoo as their default search engine and don’t use an InPrivate window have data about their search engine queries collected and sent to Microsoft’s SmartScreen server, the case claims.

The lawsuit alleges that the three versions of Edge also intercept, collect and send to the Microsoft-controlled servers “a plethora” of data associated with users’ shopping habits, including on Amazon.com, eBay.com, Walmart.com and BestBuy.com. 

Specifically, the defendant intercepts and collects “the URLs users visit, the search terms they input, the contents of the product pages they view (e.g., product reviews, product images), and the contents of their shopping carts,” the complaint says, claiming that Edge tracks this data “with no regard for the nature of the product a user browses or purchases, even those items for intimate use.”

According to the suit, Microsoft is able to identify individual users and link them with their internet activities by installing unique user identifiers and/or cookies on their devices as it intercepts their data. 

“By associating the collected private data with the unique user identifiers and cookies, Defendant can and does determine individual users’ precise internet browsing activities and habits,” the case states. “Defendant thus utilized and configured Versions 90, 92, and 93, and earlier and later versions of the Edge browser to intercept, collect and process personally identifiable private data.”

The lawsuit stresses that Edge can link a specific user to their internet browsing data even when they are using an InPrivate window – despite Microsoft’s claims that its private browsing window deletes users’ browsing information when they close it and “prevents Microsoft Bing searches from being associated with [users].”

Further, earlier and later versions of Edge also collect and store on Microsoft servers “a wide range of data” about users’ internet browsing and online shopping activities, including “at least some of the same categories of data” collected by versions 90, 92 and 93, the suit claims.

Microsoft’s alleged misconduct constitutes a “serious invasion of privacy” in violation of several federal and state laws that require companies to transparently disclose their data collection practices to users, the suit charges. The filing further chides the defendant over its alleged use of consumers’ data for commercial profit “without providing anything of value” to Edge users in exchange for their private information.

Edge users are unaware of Microsoft’s data collection practices, lawsuit says

The lawsuit explains that because Edge comes pre-installed as the default browser on most new Windows devices, this “massive swath” of Microsoft’s user base who had Edge “forced upon them” are given no notice of the company’s “highly intrusive” data collection practices. 

Consumers who download the software on their own must scroll through Microsoft’s software license terms and click a separate link to view its “flawed and deficient” privacy statement, the case contends. What’s more, Microsoft does not require consumers to scroll through its terms or click on the privacy statement before they can download the web browser, the suit says.

As the case tells it, these electronic documents have “no legal effect” because the company’s interception and use of consumers’ data is “not conspicuously, immediately or directly presented” to users.

Who does the case look to cover?

The lawsuit looks to represent anyone in the United States who, at any time since July 29, 2015, used Microsoft’s Edge browser to browse, enter keyword searches or visit URLs and whose communications, including personal information, online browsing activity, keyword searches, or visited URLs were intercepted, received, or collected by Microsoft Corporation.

How do I join the lawsuit?

There’s usually nothing you need to do to join or be included in a proposed class action lawsuit when it’s first filed. It’s only if and when the case settles that those who have been affected, i.e., the “class members,” may be notified directly and will likely need to fill out and file a claim form online or by mail. 

If you’ve used Microsoft Edge within the past several years, or simply want to stay in the loop on class action lawsuit and settlement news, sign up for ClassAction.org’s free weekly newsletter.