Adult Products Website Owner, Microsoft Sued Over Tracking Tool Use

Stella Tatola, a San Francisco County resident, has periodically visited, browsed and purchased products from Barnaby’s goodvibes.com website, said the complaint. When she did, she communicated her private and protected sexual information (PPSI) to Barnaby, without her consent, it alleged.

Tatola’s use of the website “constitutes internet messages, reports and/or communications between her and Barnaby, which were transmitted and passed over a wire, line or cable,” the complaint alleged. They were “instantly available to Microsoft” when she entered the website, and everything she did on the website “was tracked and disclosed to Microsoft instantly and automatically as it occurred,” it said.

Every time Tatola used goodvibes.com, Barnaby “allowed Microsoft to intercept, learn the contents of, and utilize for commercial gain” her messages, reports and/or communications, the complaint said. Microsoft’s interception occurred “while the messages, reports and/or communications were in transit,” it said.

But Microsoft “is not a party to the messages, reports or communications” between Tatola and Barnaby, the complaint said, and she didn’t know they would be intercepted by Microsoft. The plaintiff “reasonably believed” the communications between her and the website, including her PPSI, “were private,” it alleged.

Barnaby uses Microsoft’s Clarity analytics tool, which allows website owners to track visitors’ actions by providing real-time records so that the owners can view live recordings that “recreate user interactions” with their website, including clicks, scrolls and navigation, the complaint said. When Clarity is embedded in a website’s source code, it sends data about users’ actions and their unique identifiers to Microsoft, it said.

Clarity tracking code uses a machine unique identifier (MUID) cookie to obtain user session data. The unique identifier is generated by Microsoft and assigned to a specific user to track her activity across the internet, the complaint said. Microsoft uses the data it obtains via Clarity to “'gain insights’ that allow it to better target advertisements and 'improve machine learning models’ -- i.e., artificial intelligence -- 'that power many of [its] products and services,’” the complaint said.

The “pervasive nature of Clarity, and the consistent transmission of each user’s communications associated with a unique MUID, enables Microsoft to identify the person who has communicated with Barnaby” via its websites and connect her PPSI to her identity, alleged the complaint. By allowing Microsoft, an “undisclosed third party,” to “eavesdrop and intercept users’ PPSI" -- including sexual orientation, preferences, and desires, among other sensitive, protected information -- the defendant violates its privacy policy, which states it will “never share such information with third parties,” it said.

Microsoft violates users’ right to privacy by intercepting their PPSI, which “exemplifies the utmost invasion of privacy and would be highly offensive to any reasonable person,” alleged the complaint. The tech company’s “invasion of users’ privacy is particularly offensive given that Microsoft intentionally intercepts users’ PPSI with the intent to use it for financial gain through better targeting of advertisements to those users and others, and through improvements to the machine learning models that power many of its products and services,” it said.

Causes of action are violations of the Federal Wiretap Act; California’s Invasion of Privacy Act, constitutional right to privacy statute and Unfair Competition Law; plus unjust enrichment and negligence. Tatola requests orders requiring the defendants to bear the cost of the class notice; disgorge all monies, revenues and profits obtained by their wrongful acts; and pay statutory, compensatory and punitive damages, plus pre- and post-judgment interest. She also requests an order enjoining Microsoft from intercepting, learning the contents of, and profiting from private communications between Barnaby and its website users without consent. The defendants didn't comment.