Zillow Session Replay Code and Illinois Eavesdropping Act Class Action

Zillow Group, Inc. is responsible for the Zillow website, which the complaint for this class action calls “the leading online homebuying marketplace” in the country. But the complaint also claims that Zillow has third-party vendors, such as Microsoft, embed Session Replay Code in its website that allows Zillow to intercept and record the communications of visitors to the website, in alleged violation of the Illinois Eavesdropping Act and other laws.

The class for this action is all natural persons in Illinois whose website communications were captured with the use of Session Replay Code embedded in www.zillow.com.

At Zillow’s request, the complaint alleges, companies like Microsoft “embed snippets of JavaScript computer code (‘Session Replay Code’) on Zillow’s website, which then deploys on each website visitor’s internet browser for the purpose of intercepting and recording the website visitor’s private electronic communications with the Zillow website…”

The recordings including the visitor’s “mouse movements, clicks, keystrokes (such as text being entered into an information field or text box), URLs of web pages visited, and/or other electronic communications in real[ ]time.” The providers of the code then create a video replay of the user’s visit and make it available to Zillow for analysis.

Zillow’s request for this video, the complaint alleges, “results in the electronic equivalent of ‘looking over the shoulder’ of each visitor to the Zillow website for the entire duration of their website interaction”—that is, eavesdropping on the user’s electronic communications.

The complaint alleges that Zillow is aware that many users are physically present in Illinois when they use the Zillow website or app, through its location-determining tools or the user’s IP address.

Data has become the “world’s most valuable resource,” the complaint alleges, so that businesses now collect personal data, engagement data, behavioral data, and attitudinal data. The complaint alleges, “This information is valuable to companies because they can use this data to improve customer experiences, refine their marketing strategies, capture data to sell it, and even to secure more sensitive consumer data.”

However, consumers are not necessarily comfortable with, or even aware of, their data being used by or shared with anyone other than the website in use. The complaint cites a Consumer Reports study showing that “92% of Americans believe that internet companies and website should be required to obtain consent before selling or sharing consumers’ data,” among other things.

But the complaint alleges that the Session Replay data is received by, and controlled by, the party that wrote the code. That data may include sensitive information, the complaint alleges, like “medical conditions, credit card details, and other personal information displayed or entered on webpages.” It may record data even if the user entered it but did not decide to click Submit or Enter.

The complaint adds, “Session Replay Code does not necessarily anonymize user sessions, either” but offers ways of linking the Replay with specific persons.

Article Type: Lawsuit
Topic: Privacy
Tags: Intercepting Electronic Communications, Recording Electronic Communications Without Consent, Spying or Eavesdropping, Your Privacy