Titleist, FootJoy Websites Visitor Wiretapping Class Action

Businesses nowadays believe they need detailed information on their potential customers in order to succeed. But in trying to gather this data, the complaint alleges, some companies are violating the privacy rights of visitors to their websites. It brings suit against Acushnet Company and Acushnet Holdings Corp., alleging that the companies gather too much information from website visitors without their consent and violate the Federal Wiretap Act and the California Invasion of Privacy Act (CIPA).

The class for this action is all natural persons in California whose website communications were captured in California via Session Replay Code embedded in the websites www.titleist.com or www.footjoy.com.

Because businesses are dependent on consumers for their success, the complaint alleges that they believe that “the ability to capture and use customer data to shape products, solutions, and the buying experience is critically important to a business’s success.” The complaint quotes a report as saying that those who “leverage customer behavior insights outperform peers by 85 percent in sales growth and more than 25 percent in gross margin.”

In the case of Acushnet, how is this information gathering done? The complaint alleges that the company has gotten a third-party vendor such as FullStory to put bits of JavaScript code into its website. This code is known as Session Replay Code, the complaint alleges, and it can intercept and record website visitors’ electronic communications with the websites, including their mouse moves, clicks, keystrokes, and so on.

This information isn’t just retained at Acushnet, the complaint alleges, but sent on to a particular other server, usually owned by the third party that provided the Session Replay Code.

Later, the complaint alleges, Acushnet can replay every moment of the website visit, including any entries made into fields at the website, even if the visitor does not ultimately click the Submit button to register the information. The company can replay the session, the complaint claims, as if it is “looking over the shoulder” of the website visitor for the whole length of their visit. So can the third party that stores this information, the complaint says.

The complaint also alleges that the sessions are not always anonymous, because they record whatever information visitors enter, including if they log into an existing account. Session Replay Providers can also create “fingerprints” from certain information, and the complaint alleges, “The resulting fingerprint, which is often unique to a user and rarely changes, are collected across all sites that the Session Replay Provider monitors.” Visitors who provide identifying information to any one of the sites are thus identified for all of the sites.

Visitor are not asked to consent to this interception of their electronic communications and may not even be aware that it is occurring.

Article Type: Lawsuit
Topic: Privacy
Tags: CIPA, Improper Collection of Information, Your Privacy, wiretapping