LiveRamp Privacy Class Action to Proceed

Data firm LiveRamp must defend itself against a class action alleging violation of state and federal privacy laws, a California District Court has ruled. Plaintiffs argued that the firm created and sold comprehensive identity profiles of consumers without their consent, and its motion to dismiss has now been denied.

The US District Court for the Northern District of California said on Friday that the lead plaintiffs in a complaint made in April, Christine Riganian and Donna Spurgeon, had adequately pleaded claims of invasion of privacy, unjust enrichment, and violations of the federal Wiretap Act and the California Invasion of Privacy Act. The complaint says LiveRamp 'has tracked, compiled, and analyzed vast quantities of their personal, online, and offline activities to build detailed 'identity profiles' on them [known as RampIDs] for sale to third parties' - despite their never having interacted with the company.

The suit says LiveRamp 'claims to have resolved the identities of more than 250 million consumers in the United States (i.e., virtually every single adult) 'and many more worldwide' by assigning them each a unique RampID.' It further alleges that 'the Data Marketplace contains segments based on both standard demographics and sensitive attributes - such as health conditions, financial vulnerability, religious affiliation, and sexual orientation.'

The plaintiffs made Subject Access Requests to ascertain what data LiveRamp held on them and Riganian says she discovered 'decades of offline data such as her name, postal address history, and phone numbers that LiveRamp linked to online identifiers like cookies, device IDs, and smart TV IDs.' This included interaction with the CVS pharmacy web site multiple times to 'view information on specific conditions and medications'. During these visits, LiveRamp's tracking technologies 'captured full string URLs and other communications reflecting her activity on the CVS site'. The plaintiffs says that they and hundreds of millions of others 'never meaningfully consented to this pervasive surveillance because they 'cannot reasonably foresee all the ways in which LiveRamp may use the comprehensive identity profiles it is compiling on them' or all 'the specific third parties to which LiveRamp will provide their personal information or what those third parties will do with that information.''

The Court says LiveRamp argues that the plaintiffs have not alleged that any of the specific data collected on them was sensitive, and that its alleged compilation of off-line data (names, addresses, emails) 'is no different than maintaining a phone directory' - with non-confidential contact information. The firm's contention that it publicly discloses its data collection practices is not considered relevant by the Court given that the plaintiffs 'were not aware of LiveRamp's conduct at all... so LiveRamp's disclosures have no effect on their reasonable expectations of privacy.' LiveRamp had also argued that its anonymizes or 'pseudonymizes' the profiles created, but the Court said it was not persuaded by this, since as the plaintiffs allege, 'the Attribute Enrichment feature allows any of LiveRamp's customers to seek any 'segment' information associated with an individual by providing the individual's name, physical address, or email address - effectively rendering any anonymity functionally meaningless.'

The Court therefore denied LiveRamp's motion to dismiss, on five of the six claims made against it, and the case will proceed.

Web site: www.liveramp.com .

All articles 2006-23 written and edited by Mel Crowther and/or Nick Thomas, 2024- by Nick Thomas, unless otherwise stated.