Web firm settles claims over ‘surreptitious’ Internet tracking
A San Francisco federal judge has approved a settlement in a class-action lawsuit that enjoins a Web analytics company from hacking users’ computer software and browser tools to track their Internet activity without their knowledge.
The settlement covers two named plaintiffs, their counsel and the defendant Web company but is not binding on the potentially “millions” of people who comprise the affected class, according to settlement papers filed in the U.S. District Court for the Northern District of California.
Named plaintiffs John B. Kim and Dan C. Schutzman sued Space Pencil Inc., which does business as KISSmetrics, for privacy violations, unfair competition and other claims, according to an order by U.S. Magistrate Judge Laurel Beeler.
Their complaint was filed on behalf of a class of users whose Internet activities were unlawfully tracked. It sought unspecified compensatory and punitive damages, restitution, disgorgement of ill-gotten gains and an injunction barring further online tracking.
“This case is one of over 176 class-action lawsuits that have been filed around the country against various companies who market through websites and mobile apps pertaining to so-called behavioral or targeted advertising,” said Dominique R. Shelton, a partner at Edwards Wildman Palmer in Los Angeles. She has been following the case but does not represent any of the parties.
Although KISSmetrics denied all liability, it settled the case and agreed to the injunctive relief. The company further agreed to pay about $474,200 in attorney fees, nearly $36,000 in costs and $2,500 incentive awards to the named plaintiffs, the order said.
The attorney fees are “relatively manageable, particularly given the fact that there were over 26 defendants originally named in the suit,” Shelton said.
The class-action complaint alleged that KISSmetrics and various websites — including Etsy.com and Slideshare.net and music-streaming application Spotify — coordinated to store tracking codes in class members’ browser files.
To do so, the complaint said, the defendants repurposed the class members’ browser cache and software to store a KISSmetrics identifier.
This technique allowed the defendants to track users’ Internet activity while bypassing their computers’ security settings and privacy preferences, the complaint maintained.
Earlier this year, the class members voluntarily dismissed their suit against the websites, leaving KISSmetrics as the sole defendant.
For purposes of the settlement, Judge Beeler certified a class of all individuals assigned a KISSmetrics identifier using their computer’s software and browser tools from March 4, 2011, through July 28, 2011.
Under the terms of the settlement, only the named plaintiffs released all claims against KISSmetrics, the order notes. The agreement is not binding on other class members, but the injunction barring KISSmetrics from unlawful Internet tracking activities “is appropriate respecting the class as a whole,” the settlement agreement says.
Judge Beeler stressed that the order does not restrict KISSmetrics from installing tracking technologies on users’ computers so long as it complies with industry standards and does not circumvent user privacy and security controls.
“The agreed upon injunctive relief protects a user’s information and browsing activity but does not completely prohibit KISSmetrics’ ability to use certain technologies,” she said.
“This order may signal that plaintiffs are beginning to gain some ground in Internet privacy cases,” Purcell said.
In similar cases, she added, “courts grant motions to dismiss because the plaintiffs cannot prove harm or injury.”
Shelton notes that KISSmetrics filed a dismissal motion, but the parties settled before they filed responsive briefs.
She said this highlights “how these class actions are resulting in resolution so as to avoid complicated and protracted litigation.”
But companies can take affirmative steps to protect themselves against similar lawsuits, she added.
“The name of the game in tracking is transparency and consent,” Shelton said. “Companies can achieve this by using best practices and implementing a compliance program … for collection of tracking information that is reasonably linkable to an individual,” she said.