NL

Share on facebook
Share on linkedin
Share on twitter

This article was originally published on TechCrunch.

The use of third party cookies for ad tracking and targeting by data broker giants Oracle and Salesforce is the focus of class action style litigation announced today in the UK and the Netherlands. The suits will argue that mass surveillance of Internet users to carry out real-time bidding ad auctions cannot possibly be compatible with strict EU laws around consent to process personal data.

The litigants believe the collective claims could exceed €1 0BN, should they eventually prevail in their arguments - though such legal actions can take several years to work their way through the courts. In the UK, the case may also face some legal hurdles given the lack of an established model for pursuing collective damages in cases relating to data rights. Though there are signs that's changing.

Non-profit foundation, The Privacy Collective, has filed one case today with the District Court of Amsterdam, accusing the two data broker giants of breaching the EU's General Data Protection Regulation (GDPR) in their processing and sharing of people's information via third party tracking cookies and other adtech methods. The Dutch case, which is being led by law-firm bureau Brandeis, is the biggest-ever class action in The Netherlands related to violation of the GDPR - with the claimant foundation representing the interests of all Dutch citizens whose personal data has been used without their consent and knowledge by Oracle and Salesforce.

A similar case is due to be filed later this month at the High Court in London England, which will make reference to the GDPR and the UK's PECA (Privacy of Electronic Communications Regulation) - the latter governing the use of personal data for marketing communications. The case there is being led by law firm Cadwalader.

The Dutch case, which is being led by law-firm bureau Brandeis, is the biggest-ever class action in The Netherlands related to violation of the GDPR

Under GDPR, consent for processing EU citizens' personal data must be informed, specific and freely given. The regulation also confers rights on individuals around their data - such as the ability to receive a copy of their personal information.

It's those requirements the litigation is focused on, with the cases set to argue that the tech giants' third party tracking cookies, BlueKai o and Krux o - trackers that are hosted on scores of popular websites, such as Amazon, Booking.com, Dropbox, Reddit and Spotify to name a few - along with a number of other tracking techniques are being used to misuse Europeans' data on a massive scale.

Per Oracle marketing materials, its Data Cloud and BlueKai Marketplace provider partners with access to some 2BN global consumer profiles. (Meanwhile, as we reported in June, BlueKai suffered a data breach that exposed billions of those records to the open web.)

While Salesforce claims its marketing cloud 'interacts' with more than 3BN browsers and devices monthly. Both companies have grown their tracking and targeting capabilities via acquisition for years; Oracle bagging BlueKai in 2014 - and Salesforce snaffling Krux in 2016.

Read the original article on TechCrunch here.