When prompted to accept the privacy terms on a website do you just accept, or do you take time to manage your settings?
“If you’re like me, you end up rage-quitting the settings halfway through and you end up just clicking ‘accept’ because you’re frustrated, and you just wanted the chocolate brownie recipe,” confessed Rebecca Rumbul, a privacy rights campaigner with the Privacy Collective.
It’s a split-second decision but it can determine whether or not third-party cookies will sit on your browser indefinitely, tracking you as you browse from page to page. Third-party cookies don’t offer you or your device any functional assistance. They are there to collect information about you, primarily for marketing purposes.
“They create this horrifically complex massive profile that has a scary number of data points on you,” explained Rumbul. “And that’s a concern because I don’t know how that information is going to be used against me, used to put things in front of me, or used to decide things for me.”
Not only are many of these cookies unnecessary and invasive, but Rumbul and the Privacy Collective say that they are in breach of European data protection law (GDPR). That’s why they are now taking legal action against two of the largest players in the ad-tech space: Oracle and Salesforce.
“It’s absolutely the case that we believe these companies have been misusing personal data and misusing the way they collect information and process it,” Rumbul said. “We’re not saying they are necessarily the absolute worst offenders. The reason for going for them is because they are so huge, and their cookies are so widely placed that it affects a lot a lot of people and these organisations are the highest value players so they can afford to fight this and to pay compensation if we win.”
The legal action is being taken in the UK (England and Wales) and in the Netherlands. “The cases are fundamentally the same – they hinge on the same legal points,” explained Rumbul, who is the representative claimant for the London lawsuit. “I’m able to be the representative claimant because I’m careless enough to have these cookies on my system. I still click on the ‘accept all’ automatically before thinking about it.”
As a representative action, the lawsuit is being taken on behalf of everyone in England and Wales who has been affected by Salesforce’s and Oracle’s tracking cookies. If the lawsuit is successful, the Privacy Collective will divide the compensation among those affected. “What we’re roughly calculating is that every single person that was affected should get around €500,” Rumbul said, who will get her €500 the same as everyone else. “It’s not going to be very much money on an individual basis, but hopefully the hit to the wallets of these organisations will send ripples through the ad-tech industry.”
Raising awareness for the lawsuit is therefore crucially important, not only so people might eventually be able to apply for their share of the compensation, but so that they have an opportunity to show their support for the case. “We would love more people to engage with the issue, but in terms of a quick win, getting people to click the ‘like to support’ button on our website would be great,” Rumbul said
The Privacy Collective will need to demonstrate that, by and large, people are unaware that they are losing control of their data by accepting these tracking cookies. “Under GDPR you’re supposed to be able to consent and that consent is supposed to be informed,” explained Rumbul. “You cannot exercise your legal rights if you’ve lost control of your own information.”
“Loss of control is a real harm in itself and in violation of the GDPR, and loss of control of your personal data essentially leaves you vulnerable to a multitude of other harms,” Rumbul explained, giving the example of the harm that a barrage of adverts for baby products might cause to a woman who has just suffered a miscarriage. “Or the loss of control of my data, for instance, may result in me paying higher premiums for car insurance,” she said.
These cookies also have the potential to curtail other rights, given that privacy is a gateway for other civil liberties, especially freedom of expression. “The more people become aware of how much of their own data is being hoovered up, the more careful they feel like they have to be about what they do online and how restrictive the online environment becomes. Freedom of expression is very, very difficult when you have literally no idea what people are doing with your data.”
That’s why Index on Censorship is among the organisations supporting The Privacy Collective’s legal actions. Online privacy must be guaranteed in order for freedom of expression to thrive.