Settlement: Oracle must pay $115 million for massive data breach

After nearly two years of litigation, a group of international privacy activists has reached a class action settlement with Oracle. The plaintiffs accused Oracle and its adtech subsidiaries, which focus on targeted, programmed advertising, of collecting detailed documents on nearly five billion people without their consent. The complainants included Johnny Ryan of the Irish civil rights organization Irish Council for Civil Liberties (ICCL), Michael Katz-Lackebe, research director at the Center for Human Rights and Privacy (CEHRP), and Jennifer Golbeck, a computer science professor at the University of Maryland.

Advertisement

Meta: Multimodal AI model not coming to the EU

According to the agreement reached in a US federal court in San Francisco, he will pay $115 million to avoid a verdict in the case. According to excerpts from the agreement, the amount should be posted by ryan into a non-repayable cash fund “which will be distributed equally among the members of the comparison group”. The settlement, which was negotiated over a period of eight months, also provides for significant non-monetary compensation for those who complained about data security violations: Oracle has given firm assurances that it will not record certain electronic communications complained of for further use of the products and services described in the lawsuit. The database giant also intends to implement a testing program “to monitor compliance with contractual obligations to protect the privacy of its customers.”

Oracle wants out of the “spying ads” business

The main focus of the lawsuit was the allegation that Oracle used data collected from internet users to create personal profiles and enrich and sell them through its data marketplace. A massive data breach in 2020 provided detailed insight into the Silicon Valley group’s related activities. Oracle compiled extensive user traces primarily through its subsidiary BlueKai. With the help of sniffing cookies and other tracking tools such as pixels on websites including porn portals and HTML emails, the company is said to have built a large advertising network.

As part of the agreement, Oracle announced that it would completely leave the AdTech business. Products such as Digital Audience, including its own “cloud data management” platform, the BlueKai business, and OnRamp with ID Graph identifiers and cross-device tracking, will be shut down by September 30. At the same time, the group intends to automatically delete controversial user and customer data as soon as it fulfills its further obligations under the agreement. Relationships with relevant data providers will also be terminated. Ryan spoke of “big changes for one of the world’s largest data retailers.”

(Middle)