A Dutch consumer privacy group has brought a class action claim against tech giants Oracle and Salesforce, alleging that their involvement in placing third party cookies to help track and target internet users with adverts breaches privacy laws.

The Privacy Collective, a non-for-profit foundation, claims that the tech giants are effectively using Dutch customer data without their explicit consent and has taken them to court, claiming at least €10bn in damages. A similar case, also fully funded by Innsworth litigation funder, is set to be filed in England and Wales.

Christiaan Alberdingk Thijm, co-founder of Bureau Brandeis, is representing the claimants in what he said is ‘one of the largest cases of unlawful use of personal data in the history of the internet’, affecting most of the Dutch population.

‘This is a huge claim,’ he told DutchNews.nl. ‘There’s a lot of conduct going on behind the scenes that the average internet user has no knowledge of. It all starts with the cookie being placed on your hard drive, with a unique id. Then you are surfing the net, looking at information about health issues, political items, they might track your location on your phone and know you go to a certain church.

‘They have all this information and you are put into a certain “audience”. On the basis of this shadow identity they will ensure you see, read, listen to and buy for a certain price what they think is fit for you.’

Thijm claimed that these profiles are put up for sale for advertising via Real Time Bidding, and also shared with other partners via cookie synching, without the explicit consent of users.

‘This will happen to everybody who uses the Chrome browser and we know that 65% of internet users use a Chrome browser, but even if you protect yourself by taking precautions, they will still be sharing that information – because they have to inform each other that you are a person who does not want to be tracked. It basically affects everybody who is online,’ he said.

New law

The claim is the first to be filed under a new Dutch class action law, and asks for a €500 payment for each user who has not consented to the use of their sensitive, personal data. It has been filed in the Dutch courts today and, if The Privacy Collective is judged to be genuinely representing the claimants, is expected to go to court by the end of the year.

Joris van Hoboken, a professor in law at the Vrije Universiteit Brussels and board member of the Privacy Collective said in a press release that the new Dutch class action rules ‘give the law teeth’ and that claiming damages was an important way to police privacy rights. The foundation is urging internet users to register on their site, free of charge, to show support for the claim.

Salesforce and Oracle have vigorously denied that they are breaching privacy laws and are contesting the claim. ‘The claim applies to the Salesforce Audience Studio service and does not relate to any other Salesforce service,’ a Salesforce spokesperson told DutchNews.nl. ‘Salesforce disagrees with the allegations and intends to demonstrate they are without merit. Our comprehensive privacy program provides tools to help our customers preserve the privacy rights of their own customers.’

Dorian Daley, Oracle executive vice president and general counsel, said in a statement that the claim was meritless and a ‘deliberate misrepresentation’ of facts: ‘As Oracle previously informed the Privacy Collective, Oracle has no direct role in the real-time bidding process, has a minimal data footprint in the EU, and has a comprehensive GDPR [privacy] compliance programme. Despite Oracle’s fulsome explanation, the Privacy Collective has decided to pursue its shake-down through litigation filed in bad faith. Oracle will vigorously defend against these baseless claims.’