Oracle settles for $115m over tracking allegations

US tech firm Oracle has settled a California class action privacy case for $115 million. The company faced allegations of creating “digital dossiers” about billions of people without their consent. Under the settlement, Oracle has agreed to change how it collects and uses data. 

Here’s a look at what went wrong for Oracle and how the case might affect the wider digital advertising industry. 

The case against Oracle

The complaint against Oracle was filed in August 2022 and alleged that the company: 

• Engaged in widespread surveillance of internet users, including by collecting, storing, and selling their personal information without their consent 
• Using various methods to covertly track individuals’ online activities, including cookies, tracking pixels, JavaScript code, and device IDs.  
• Creating detailed profiles of individuals, linking their online behavior with offline data 
• Selling such profiles via its “Oracle ID Graph” and other related products.  

The plaintiffs accused Oracle of creating “dossiers” about people based on “online and offline data”, which allegedly constitute “precisely the sort of ‘cradle-to-grave profiles’ the right to privacy under the California Constitution was created to constrain…” 

The case also highlighted the risks to individuals posed by these so-called dossiers, including in political campaigns, which the plaintiffs claimed: “have ‘needle-in-the-haystack capabilities’ to ‘micro target voters on all their devices’ using personal information sold by data brokers.”  

The case cites the 2016 Trump campaign, which reportedly created a “220 million–person database of voter information named ‘Project Alamo’ using Datalogix, a data collection platform owned by Oracle.”​ 

The plaintiffs argued that Oracle’s actions violated their privacy rights, including those protected under the following laws and torts: 

• California Constitution: Invasion of Privacy under the California Constitution. 
• California common law: Intrusion Upon Seclusion. 
• California Unfair Competition Law (UCL) 
• California Invasion of Privacy Act (CIPA) 
• Federal Wiretap Act (Electronic Communications Privacy Act – ECPA) 
• Unjust enrichment: Claim under common law principles 

What Oracle agreed under the settlement 

The case never proceeded to a full court hearing, but a judge has approved the following terms under a settlement between Oracle and the plaintiffs: 

• Monetary settlement: Oracle agreed to establish a $115 million settlement fund, which will cover compensation for eligible class members, attorneys’ fees, and administrative costs associated with the settlement. 
• Non-monetary relief: Oracle agreed to implement specific privacy-related measures, including: 
• Not capturing user-generated information within referrer URLs (URLs of previously visited pages) associated with a website user. 
• Not capturing any text entered by users in online web forms (except for Oracle’s own websites). 
• Implementing an audit program to reasonably review customer compliance with contractual consumer privacy obligations. 

Class members who wish to receive compensation can do so by submitting a claim form. The amount each class member receives will be determined on a pro-rata basis depending on the number of valid claims submitted. 

In exchange for these benefits, all class members will release Oracle from any and all claims related to the allegations in the lawsuit. 

Lessons for the digital marketing industry

Digital advertising involves the large-scale collection, storage, use, and sharing of data about billions of people. For years, many businesses have failed to be transparent about their practices and have sometimes failed to offer people any control over how their data is used. 

Oracle’s settlement is just one example of how the digital advertising industry is becoming more focused on privacy. 

The Oracle case relied on a handful of state and federal laws, all of which have been in place for decades. Businesses now face a complex patchwork of privacy laws, with around 20 states having enacted comprehensive privacy legislation since 2018. 

The digital advertising industry is changing fast in response to these new laws, increased regulatory scrutiny, and changing consumer attitudes about the use of their personal data. Oracle itself closed its digital advertising business in June. 

Not every company will end up in a $115 million court settlement – but any company that fails to adapt will face countless risks.