Delta Air Lines Wiretapping of Website Visitors Pennsylvania Class Action

Companies collect all kinds of data on potential customers—not just on their personal characteristics, but also on their engagement, behavior, and attitudes. The complaint for this class action alleges that Delta Air Lines, Inc. obtains detailed information through wiretapping, from code embedded in its website that intercepts and records visitors’ actions, in violation the Pennsylvania Wiretapping and Electronic Surveillance Control Act.

The class for this action is all natural persons in Pennsylvania whose website communications were captured in Pennsylvania through the use of Session Replay code embedded in www.delta.com.

How does Delta perform this wiretapping? The complaint alleges that it gets third parties, like FullStory, to deploy bits of JavaScript computer code—Session Replay code—in its website. These bits of code deploy into the browsers of visitors to the website, intercepting actions like mouse movements, clicks, keystrokes, and pages visited.

The visitor’s browser follows instructions from the Session Replay Code, the complaint claims, and sends the information to a server. “Typically,” the complaint alleges, “the server receiving the event data is controlled by the third-party entity that wrote the Session Replay Code, rather than the owner of the website where the code is installed.”

At a later time, the visitors’ sessions can be individually replayed for the website owner, the complaint claims, “in the electronic equivalent of ‘looking over the shoulder’ of each visitor” during the entire visit to the website. The information may include what the complaint calls “a variety of highly sensitive information … captured in event responses from website visitors, including medical conditions, credit card details, and other personal information displayed or entered on webpages.”

In fact, the complaint claims that the code collects even information that the visitor decides not to provide to the website, for example, when the visitor enters information in a field but then does not click Submit.

This information may not remain anonymous. Session Replay can record visitors’ entry of personally identifying information, can use cookies that link sessions to identified users, or can create “fingerprints” comprised of settings that are unique to users.

The fingerprints can be linked back to all sites served by the Session Replay provider, and when visitors identify themselves to any one of these sites, the provider “can then back-reference all of that user’s other web browsing across other website previously visited, including on websites where the user had intended to remain anonymous—even if the user explicitly indicated that they would like to remain anonymous by enabling private browsing.”

All this is done, the complaint alleges, without obtaining the visitors’ consent or the visitors even being aware of these operations

According to the complaint, this violates the Pennsylvania Wiretapping and Electronic Surveillance Control Act.

Article Type: Lawsuit
Topic: Privacy
Tags: Recording Electronic Communications Without Consent, Your Privacy, wiretapping