Oracle is being served a class-action lawsuit on the grounds the cloud provider's regularly conducted business practices result in "deliberate and purposeful surveillance of the general population."

The lawsuit claims that by acting as a worldwide data broker, Oracle created a network to track in real-time and record indefinitely hundreds of millions of individuals' personal information. It further alleges that the vendor sells that personal data to third parties directly and through its ID Graph product and other services based on personal data.

The "informed and concerned citizens" who make up the plaintiff class claim they "lack a direct relationship with Oracle and have no reasonable or practical basis upon which they could legally consent to Oracle’s surveillance."

To that point, the lawsuit aims to enforce individuals' "fundamental" right to privacy by seeking compensation for financial, dignitary, reputational, and relational harms caused by Oracle. It also demands a ruling that the tech giant's "conduct is unlawful and therefore must stop."

Oracle is a data broker because it facilitates the buying and selling of digital data among private and government entities through its BlueKai data management platform. BlueKai includes the Oracle Data Marketplace, which is one of the largest commercial data exchanges, and ID Graph, which has "the capability of identifying Internet users and compiling personal data associated with them, including so-called 'anonymous' data which Oracle re-identifies to specific individuals," the lawsuit reads, adding ID Graph is for sale to private and government buyers on the vendor's data marketplace.

In other words, the lawsuit alleges ID Graph synchronizes personal data obtained by Oracle by matching data that can be determined to share a common origin with other personal data. "This synchronizing allows Oracle to identify individuals and aggregate their many identifiers, which in turn facilitates further synchronizing of personal data with a high degree of confidence," the plaintiffs explained.

Oracle, on the other hand, describes ID Graph as a tool to help marketers "connect identities across disparate marketing channels and devices to one customer" and "orchestrate a relevant, personalized experience for each individual across marketing channels and device types."

The plaintiffs argue that Oracle and other data brokers are central nodes in the adtech network, which they define as a network where vast amounts of personal data is aggregated and used to profile individuals for targeted advertising or commercial and political purposes.

The information Oracle allegedly collects includes concrete identifiers like names, home and work addresses, email addresses, and phone numbers. The lawsuit claims Oracle also gathers data on individuals' behavior from the sites they visit online, digital and offline purchases, places they shop, and methods of payment.

All of this information is collected via Oracle's own suite of Internet technologies including cookies, tracking pixels, device identification, and cross-device tracking, along with buying data from third parties. This information is then analyzed and monetized by Oracle, according to the lawsuit.

Oracle's primary method of personal data collection, however, is through BlueKai cookies and pixels "from persons having no privity whatsoever with Oracle," meaning the company's data collection isn't dependent on any relationship or association an Internet user might have with Oracle. "Even privacy-conscious users who endeavor to understand the origins of Oracle cookies may not know Oracle is amassing data about them because Oracle’s cookies and pixels do not bear the company’s name," the plaintiffs explained.

"The lawsuit against Oracle is essentially a lawsuit against the technology Oracle employs — namely, real-time bidding (RTB) driven by third-party tracking," The Media Trust CEO Chris Olson wrote in an email to SDxCentral. "The case will face stiff challenges, because the U.S. does not have a national data privacy standard, and Oracle's activities are not illegal in most states," he explained.

Olson noted that the most promising legal precedent named in the lawsuit is the California Invasion of Privacy Act (CIPA), which could classify Oracle's use of RTB as wiretapping. "Whether the case succeeds largely hinges on how well the plaintiffs can argue that point," he said.