A Dutch consumer privacy group says it has given up on EU data protection authorities’ efforts to bring the adtech industry to heel and is going straight for legal action against both Salesforce and Oracle over how their use of real-time bidding breaches GDPR.
With the UK Information Commissioner’s Office widely accused of a go-slow in its own investigation into the sector – the ICO recently admitted that its probe may not restart until 2021 – the Privacy Collective has filed a class action lawsuit in Amsterdam and is planning to do the same at the High Court in London later this month. It reckons the action could cost the California-based companies up to €10bn (£9bn) in pay-outs.
The group alleges both companies collect users’ personal data without their consent and then auction it off to other companies without their knowledge. The Netherlands lawsuit demands a €500 (£451) payment for each user who has not consented to the use of their sensitive personal data.
The Privacy Collective claims that both have used third-party cookies Bluekai and Krux to misuse consumers’ personal data. The cookies, which are hosted on multiple websites including Ikea, Twitch, Dropbox, Booking.com, and Comparethemarket, are used for dynamic ad pricing services.
It insists that Oracle and Salesforce held on to personal data that consumers had not proactively consented to share and took an inconsistent approach to securing sensitive information. The lawsuit further accuses the companies of facilitating sales using harmful ads.
According to the Privacy Collective, both companies sell profiles created from the personal data they have gathered from users to other companies via real-time bidding without the knowledge or consent of the users.
The group stated: “An important argument for suing these two parties in particular is the scope and impact of their unlawful acts in the Netherlands. They are prominent. At the same time, they often operate behind the scenes.
“Everyone knows Google and Facebook, but these companies are less known, while they act in an unprecedented way in our personal data on a daily basis. Many complaints have already been filed with regulators about the adtech industry, but too little is happening with those complaints. Everyone agrees that this should stop, but the world is so complex that regulators do not dare to do it yet.