Oracle Class Action Lawsuit Filed Over Alleged Worldwide Surveillance, Illegal Sale of Consumer Information [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

Oracle America faces a proposed class action that aims to take the worldwide data broker to task for allegedly surveilling and selling the personal information of hundreds of millions of people, many of whom have no relationship with the company. 

The 69-page lawsuit says that in the course of its business, Oracle has built a network that “tracks in real-time and records indefinitely” the personal information of massive swaths of people who have nothing to do with the company and thus “have no reasonable or practical basis upon which they could legally consent to Oracle’s surveillance.” 

The filing relays that Oracle then sells dossiers of detailed consumer information to third parties, including private commercial and governmental entities, either directly or through its ID Graph and other related products and services. 

“Oracle sits atop a complex data collection and processing apparatus feeding its labyrinthine multinational data marketplace, making it impossible for ordinary persons to reasonably understand the true purpose and extent of Oracle’s data collection, compiling of digital dossiers, and other data exploitation practices, which are opaque, if not invisible, to ordinary data subjects. Given the complexity and disguised nature of Oracle’s collection and use of personal information, and the lack of any direct relationship between Oracle and the Plaintiffs and Class members, there is no reasonable basis for Plaintiffs and the Class members to know the extent to which Oracle is obtaining their data, tracking them, and selling their data or services derived from their data.” 

Oracle operates the BlueKai Data Management Platform, which includes the Oracle Data Marketplace and Oracle Graph ID, the complaint states. Per the suit, the Oracle Data Marketplace is “one of the largest, if not the largest,” commercial data exchanges and impacts “the lives of most Americans and many millions of people worldwide.” It’s on this Data Marketplace that Oracle trades in the personal data it collects itself, personal data that private companies collect from their own users and then sell to Oracle clients, and personal data that other third-party brokers collect and sell to the defendant’s clients, the case explains. 

According to the suit, the general public does not have access to the Oracle Data Marketplace or any insight into who is buying and selling their information. Moreover, Oracle does not publicly disclose the identity of marketplace clients, the filing says.

Oracle’s ID Graph is a marketing tool designed to provide “identity resolution,” essentially by “matching” individual consumer identities and combining them into a single customer profile, the filing says. The case relays that ID Graph, touted as powered by the Oracle Marketing Cloud and Data Cloud, “synchronizes” vast amounts of personal information collected by Oracle. Per the suit, this allows the company to identify individuals and aggregate their identifiers, which, in turn, “facilitates further synchronizing of personal data with a high degree of confidence.” 

More broadly, Oracle and other data brokers are the main cogs in a worldwide “adtech” network, whereby huge volumes of personal information are aggregated and used to identify and profile people for targeted advertising, the suit states. 

When an internet user visits a website on which Oracle’s technologies are employed, the defendant can track and store myriad behavioral activity and personal information, including, but not limited to, their home location, age, income, education, family status, hobbies, interests, weight, political affiliations, medical data, recent purchases and more, the lawsuit says. Oracle can also see and track where they shop and how they pay for purchases, the case shares. 

Per the lawsuit, Oracle gathers personal information through cookies, tracking pixels, widgets, device identification, cross-device tracking, and by acquiring data from other parties. The suit says that popular, high-traffic websites are “blanket[ed]” with Oracle tracking tools. Oracle’s cross-device tracking enables the company to, for example, target consumers whether they’re shopping at home on their iPad, reading the news on their iPhone during their commute, or visiting websites on their computer at work, the complaint says. 

The lawsuit summarizes that the manner in which Oracle tracks the lives of ordinary people is “opaque, if not invisible, to the people it follows” given they have no relationship with the company. Oracle itself, the suit says, built its business on “the surveillance of ordinary citizens,” and surveillance is “central to Oracle’s history and development, and to its current business and marketing plan.” Oracle’s privacy policies do not meaningfully disclose what the company does with internet users’ information, or how much Oracle’s customers pay for it, the complaint states. 

The suit was filed on August 19 in California by three plaintiffs described as “informed and concerned citizens who believe that the unregulated worldwide data marketplace abrogates and the privacy and autonomy of the people and threatens core principles essential for democratic self-rule.” 

The lawsuit looks to cover all natural persons whose personal information, or data derived from their personal information, was used to create a profile and made available for sale or use through Oracle’s ID Graph or Data Marketplace. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.