1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 1 of 69
`
`
`
`
`
`Michael W. Sobol (SBN 194857)
`msobol@lchb.com
`David T. Rudolph (SBN 233457)
`drudolph@lchb.com
`Jallé H. Dafa (SBN 290637)
`jdafa@lchb.com
`LIEFF CABRASER HEIMANN
`& BERNSTEIN, LLP
`275 Battery Street, 29th Floor
`San Francisco, CA 94111
`Telephone: 415.956.1000
`Facsimile: 415.956.1008
`
`Attorney for Plaintiffs and the Class
`
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`SAN FRANCISCO DIVISION
`
`Plaintiffs,
`
`
`vs.
`
`Michael Katz-Lacabe, Dr. Jennifer Golbeck
`and Dr. Johnny Ryan, on behalf of
`themselves and all others similarly situated,
`
`
`
`
`ORACLE AMERICA, INC., a corporation
`organized under the laws of the State of
`Delaware,
`
`
`
`
`Case No. 3:22-cv-04792
`CLASS ACTION COMPLAINT
`CLASS ACTION
`DEMAND FOR JURY TRIAL
`
`
`
`Defendant.
`
`
`
`
`
`
`
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 2 of 69
`
`TABLE OF CONTENTS
`
`
`Page
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`I. 
`II. 
`III. 
`IV. 
`V. 
`VI. 
`
`IX. 
`
`B. 
`
`C. 
`
`D. 
`E. 
`
`INTRODUCTION .............................................................................................................. 1 
`THE PARTIES .................................................................................................................... 1 
`JURISDICTION AND VENUE ......................................................................................... 5 
`CHOICE OF LAW .............................................................................................................. 5 
`INTRADISTRICT ASSIGNMENT .................................................................................... 6 
`STATEMENT OF FACTS ................................................................................................. 6 
`Oracle Employs Multiple Methods for the Collection of Personal Data
`A. 
`from Unwitting Internet Users. ............................................................................... 8 
`Oracle Uses The Personal Data of Internet Users To Fuel Its Personal
`Identification and Profiling Product “Oracle ID Graph”. ..................................... 16 
`Oracle Uses the Data Marketplace to Enrich the Dossiers It Compiles on
`Class Members. ..................................................................................................... 26 
`1. 
`Oracle Audiences. ..................................................................................... 26 
`2. 
`Second-party data. ..................................................................................... 27 
`3. 
`Other Data Brokers (third-party data). ...................................................... 28 
`Data Brokers Are a Recognized Threat to Individual Privacy .............................. 36 
`Class Members Have Not and Cannot Consent to Oracle’s Collection or
`Use of their Personal Information ......................................................................... 40 
`VII.  CLASS ALLEGATIONS ................................................................................................. 47 
`VIII.  CAUSES OF ACTION ..................................................................................................... 49 
`First Cause of Action Invasion of Privacy Under the California Constitution (on
`behalf of the California Sub-Class) ....................................................................... 49 
`Second Cause of Action Intrusion Upon Seclusion Under California Common Law
`(on behalf of all Classes) ....................................................................................... 53 
`Third Cause of Action Violations of the Unfair Competition Law (“UCL”),
`Cal. Bus. & Prof Code § 17200, et seq. (on behalf of all Classes) ...................... 56 
`Fourth Cause of Action Violation of the California Invasion of Privacy Act (on
`behalf of the CIPA Sub-Class) .............................................................................. 58 
`Fifth Cause of Action Violation of the Federal Wiretap Act, 18 U.S.C. § 2510, et.
`seq. (on behalf of the ECPA Sub-Class) ............................................................... 60 
`Sixth Cause of Action Unjust Enrichment (on behalf of all Classes) ............................... 63 
`Seventh Cause of Action Declaratory Judgment that Oracle Wrongfully Accessed,
`Collected, Stored, Disclosed, Sold, and Otherwise Improperly Used
`Plaintiffs’ Private Data and Injunctive Relief (on behalf of all Classes) ............. 64 
`PRAYER FOR RELIEF .................................................................................................... 64 
`
`
`
`
`
`
`- i -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 3 of 69
`
`TABLE OF CONTENTS
`(continued)
`
`Page
`DEMAND FOR JURY TRIAL ......................................................................................... 65 
`
`
`X. 
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`- ii -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 4 of 69
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`I.
`
`INTRODUCTION
`1.
`This complaint sets forth how the regularly conducted business practices of
`defendant Oracle America, Inc. (“Oracle”) amount to a deliberate and purposeful surveillance of
`the general population via their digital and online existence. In the course of functioning as a
`worldwide data broker, Oracle has created a network that tracks in real-time and records
`indefinitely the personal information of hundreds of millions of people. Oracle sells this detailed
`personal information to third parties, either directly, or through its “ID Graph” and other related
`products and services derived from this data. The proposed Classes herein lack a direct
`relationship with Oracle and have no reasonable or practical basis upon which they could legally
`consent to Oracle’s surveillance.
`2.
`The named Plaintiff class representatives are informed and concerned citizens who
`believe that the unregulated worldwide data marketplace abrogates the privacy and autonomy of
`the people and threatens core principles essential for democratic self-rule. Plaintiffs bring this
`action to enforce their fundamental right to privacy, seek redress and compensation for the
`financial, dignitary, reputational, and relational harms Oracle has caused, and obtain a ruling that
`Oracle’s conduct is unlawful and therefore must stop. The law, as alleged below, entitles Plaintiffs
`and the proposed Classes to these remedies.
`
`II.
`
`THE PARTIES
`3.
`Plaintiff Michael Katz-Lacabe resides in San Leandro, California. Mr. Katz-
`Lacabe is a privacy rights activist. He is the founder of the Center for Human Rights and Privacy,
`a project dedicated to the promotion of human rights and privacy in the United States, focusing on
`the use of surveillance technologies by local police and other government agencies.1 Mr. Katz-
`Lacabe is also an active member of Oakland Privacy, a grassroots citizens’ coalition that “works
`regionally to defend the right to privacy and enhance public transparency and oversight regarding
`the use of surveillance techniques and equipment.”2 Mr. Katz-Lacabe has been frequently cited by
`
`1 About CEHRP, The Center for Human Rights and Privacy (2014), https://www.cehrp.org/about-
`cehrp/ [https://perma.cc/9T3N-ZH5W].
`2 About, Oakland Privacy (2022), https://oaklandprivacy.org/about/ [https://perma.cc/N8VH-
`5TCH].
`
`
`
`
`
`
`- 1 -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 5 of 69
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`reporters for his privacy work related to the use of license plate readers by local police,3 which has
`been referenced by advocacy organizations in their California Supreme Court Amicus Curiae
`briefs.4
`4.
`Mr. Katz-Lacabe, like most members of modern society, must use the Internet to
`conduct routine affairs of daily life. On May 4, 2022, despite taking significant steps to maintain
`his online and offline privacy, Mr. Katz-Lacabe received a document from Oracle indicating
`Oracle had tracked, compiled, and analyzed his web browsing and other activity and thereby
`created an electronic profile on him. On information and belief, Oracle continues to track
`Mr. Katz-Lacabe’s internet and offline activity, enrich the profile of him as described below, and
`make his personal information available to third parties without his consent. On information and
`belief, Mr. Katz-Lacabe has visited websites where his electronic communications were
`intercepted by the use of Oracle JavaScript code, as described below.
`5.
`Plaintiff Dr. Jennifer Golbeck resides in Sugarloaf Key, Florida. Dr. Golbeck is an
`associate professor at the University of Maryland in College Park and is Director of the Social
`Intelligence Lab. She is an expert in social networks, social media, privacy, and security on the
`web. As described in her Wikipedia entry, Dr. Golbeck “is known for her work on computational
`social network analysis. She developed methods for inferring information about relationships and
`people in social networks. Her models for computing trust between people in social networks are
`among the first in the field . . . [Dr.] Golbeck has received attention for her work on computing
`
`
`3 Cyrus Farivar, Op-Ed: Technology TurnsOour Cities into Spies for ICE, Whether We Like it or
`Not, Los Angeles Times (May 2, 2018, 4:15 AM), https://www.latimes.com/opinion/op-ed/la-oe-
`farivar-surveillance-tech-20180502-story.html [https://perma.cc/89AL-WMA4]; Cyrus Farivar,
`California cities, counties have spent $65M on spy tech in past decade, Ars Technica (Nov. 12,
`2014, 6:45 AM), https://arstechnica.com/tech-policy/2014/11/california-cities-counties-have-
`spent-65m-on-spy-tech-in-past-decade/ [https://perma.cc/NA4Z-MRV9]; Andy Greenberg &
`Ryan Mac, How A 'Deviant' Philosopher Built Palantir, A CIA-Funded Data-Mining Juggernaut,
`Forbes (Aug.14, 2013, 10:10 AM),
`https://www.forbes.com/sites/andygreenberg/2013/08/14/agent-of-intelligence-how-a-deviant-
`philosopher-built-palantir-a-cia-funded-data-mining-
`juggernaut/?sh=6b9236727785[https://perma.cc/25ZT-BBL6].
`4 Application for Leave to File Amicus Curiae Brief and Amicus Curiae Brief of Electronic
`Privacy Information Center (EPIC) in Support of Petitioners, Supreme Court of the State of
`California (May 17, 2016), https://www.courts.ca.gov/documents/15-s227106-ac-elec-privacy-
`info-ctr-051716.pdf [https://perma.cc/PBK6-LDFJ].
`
`
`
`
`
`
`- 2 -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 6 of 69
`
`
`
`personality traits and political preferences of individuals based on their social network profiles.
`Her presentation at TEDxMidatlantic, discussing the need for new methods of educating users
`about how to protect their personal data, was selected as one of TED’s 2014 Year in Ideas talks.”5
`Dr. Golbeck’s TED talk, “The curly fry conundrum: Why social media ‘likes’ say more than you
`might think,” has received over 300,000 views on YouTube.6
`6.
`Dr. Golbeck, like most members of modern society, must use the Internet to
`conduct routine affairs of daily life. Despite taking precautions to keep her personal information
`from being collected by third parties, Dr. Golbeck discovered Oracle tracking devices on multiple
`of her computers that she regularly uses for internet browsing and other activities. Additionally,
`on March 10, 2022, Dr. Golbeck received from Oracle a document indicating Oracle had tracked,
`compiled, and analyzed her web browsing and other activity and thereby created an electronic
`profile on her. On information and belief, Oracle continues to track Dr. Golbeck’s internet and
`offline activity, enrich the profile of her as described below, and make her personal information
`available to third parties without her consent. On information and belief, Dr. Golbeck visited
`websites where her electronic communications were intercepted by the use of Oracle JavaScript
`code, as described below.
`7.
`Plaintiff Dr. Johnny Ryan resides in Dublin, Ireland. Dr. Ryan is a Senior Fellow at
`the Irish Council for Civil Liberties, and a Senior Fellow at the Open Markets Institute. His work
`as a privacy advocate and scholar focuses on surveillance, data rights, competition/antitrust, and
`privacy. His previous roles include Chief Policy Officer at Brave and Chief Innovation Officer at
`The Irish Times. His regulatory interventions and commentary appear in The New York Times, The
`Economist, Die Zeit, Wired, Le Monde, The Financial Times and other leading media. Dr. Ryan
`has testified at the US Senate and European Parliament, advises on data legislation, and is the
`author of two books, including “A History of the Internet and the Digital Future.” He is a Fellow
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`5 Wikipedia, Jen Golbeck, https://en.wikipedia.org/wiki/Jen_Golbeck [https://perma.cc/7Y2P-
`SU4C].
`6 TED, Jennifer Golbeck: The Curly Fry Conundrum: Why Social Media "Likes" Say More Than
`You might Think, YouTube (Apr. 3, 2014), https://www.youtube.com/watch?v=hgWie9dnssU
`[https://perma.cc/89JD-556N].
`
`
`- 3 -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 7 of 69
`
`
`
`of the Royal Historical Society, and a member of the World Economic Forum’s expert network on
`media, entertainment and information.
`8.
`Mr. Ryan, like most members of modern society, must use the Internet to conduct
`routine affairs of daily life. At least until September 2020, Oracle tracked and compiled
`information on Internet users in the European Union and the United Kingdom using data derived
`from “third-parties,” as described in more detail below.7 As noted in the press, Oracle’s
`announcement that it would no longer make this functionality available in Europe and the U.K.
`came “just weeks after Oracle and rival data broker Salesforce were named in a class-action
`lawsuit in both the U.K. and the Netherlands that could result in the two companies having to pay
`up to $11.7 billion in fines under GDPR rules.”8 Oracle publicly described that lawsuit as a
`“shake-down”—yet it purported to cease certain of the practices complained of in that lawsuit only
`weeks after it was filed.9
`9.
`On information and belief, at least until September 2020, Oracle tracked Dr. Ryan’s
`internet activity, created profiles of him as described below, and made his personal information
`available to third parties without his consent, all during the class period.
`Defendant Oracle America, Inc. (“Oracle” or “Defendant”) is a United States
`10.
`public corporation incorporated under the laws of the State of Delaware and is registered with the
`State of California pursuant to California Civil Code § 1798.99.80 as a “data broker” residing at
`500 Oracle Pkwy, Redwood City, California. On information and belief, Redwood City,
`California is, or has been for a majority of the class period, the principle place of business for
`Oracle and until at least December 2020, was the sole location it listed as its residence.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`7 Ronan Shields, Oracle to Shutter Third-Party Data Services in Europe, Adweek (Sept. 9, 2020),
`https://www.adweek.com/programmatic/oracle-to-shutter-third-party-data-services-in-europe/
`[https://perma.cc/6VAK-2G5U].
`8 Id.
`9 Natasha Lomas, Oracle and Salesforce Hit with GDPR Class Action Lawsuits Over Cookie
`Tracking Consent, TechCrunch (Aug. 14, 2020), https://techcrunch.com/2020/08/14/oracle-and-
`salesforce-hit-with-gdpr-class-action-lawsuits-over-cookie-tracking-consent/
`[https://perma.cc/79R7-SFU9].
`
`
`- 4 -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 8 of 69
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`III.
`
`JURISDICTION AND VENUE
`11.
`This Court has original jurisdiction over this matter pursuant to 28 U.S.C. § 1331 as
`it arises under the laws of the United States. This Court also has subject matter jurisdiction over
`this action pursuant to 28 U.S.C. §§ 1332 and 1367 because this is a class action in which the
`matter or controversy exceeds the sum of $5,000,000, exclusive of interest and costs, and in which
`some members of the proposed Classes are citizens of a state different from Defendant.
`12.
`This Court has personal jurisdiction over Defendant because Defendant conducts
`substantial business within this District and throughout the State of California, and was
`headquartered in Redwood City, California, for at least a substantial portion of the class period.
`13.
`Venue properly lies with this Court pursuant to 28 U.S.C. § 1391(b)(1) and (b)(2),
`because Plaintiff Katz-Lacabe resides within this District and because Oracle maintains substantial
`business operations in this District, and because a substantial part of the events or omissions giving
`rise to the claims described herein occurred in this District.
`
`IV. CHOICE OF LAW
`14.
`California law governs the substantive legal issues in this case. The State of
`California has a significant interest in regulating the conduct of businesses operating within its
`borders. California, which seeks to protect the rights and interests of California and all residents
`and citizens of the United States against a company doing substantial business in California, has a
`greater interest in the claims of Plaintiffs and Class members than any other state or country and is
`most intimately concerned with the claims and outcome of this litigation.
`15.
`Until at least December 2020, Oracle’s principal place of business is, or has been
`for the majority of the class period, Redwood City, California, where it is registered a data broker
`under California law, where it is functioning, during the majority of the relevant time period, as
`the “nerve center” of its business activities—the place where its high-level officers direct, control,
`and coordinate the corporation’s activities, including its marketing, software development, and
`major policy, financial, and legal decisions.
`16.
`Oracle’s privacy-invasive conduct as described herein emanated from, and was
`conceived and executed in, California.
`
`
`
`
`
`
`- 5 -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 9 of 69
`
`
`
`17.
`Application of California law with respect to Plaintiffs’ and Class members’
`claims is reasonable and fundamentally fair because California has a state interest in the claims of
`the Plaintiffs and the Classes based upon Oracle’s significant and ongoing contacts with
`California.
`18.
`Under California’s choice of law principles, which are applicable to this action, the
`common law of California applies to the common law claims of all Class members. Additionally,
`given California’s significant interest in regulating the conduct of businesses operating within its
`borders, California’s consumer protection laws may be applied to non-resident Plaintiffs and Class
`members.
`
`V.
`
`INTRADISTRICT ASSIGNMENT
`19.
`Pursuant to Civil L.R. 3-2(c), assignment to this division is proper because a
`substantial part of the conduct which gives rise to Plaintiffs’ claims occurred in this district.
`Defendant’s conduct as described below is directed at Internet users and people throughout the
`United States, including in Alameda County, California.
`
`VI.
`
`STATEMENT OF FACTS
`20.
`Oracle is one of the world’s largest data brokers, in addition to its prominent public
`facing business of database related software and data storage services, including “Oracle Cloud”
`that developers may use to build and run internet sites and mobile applications.10 Oracle reaps
`great financial benefit from its conduct described herein; while the revenue attributable to its data
`broker businesses is not publicly disclosed, Oracle’s market capitalization exceeds $227 billion.
`21.
`As a data broker, Oracle facilitates the buying and selling of digital data, including
`personal information, among private commercial and governmental entities. Oracle operates a
`data management platform called the BlueKai Data Management Platform, which includes two
`key features: the Oracle Data Marketplace and the Oracle ID Graph. The Oracle Data Marketplace
`
`
`10 Oracle Products, Solutions, and Services, Oracle, https://www.oracle.com/products/
`[https://perma.cc/96FG-AYQC].
`
`
`
`
`
`
`- 6 -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 10 of 69
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`is one of the world’s largest, if not the largest, commercial data exchange, with a broad impact
`upon the lives of most Americans and many millions of people worldwide.11
`22.
`The Oracle ID Graph is a service product designed to provide “identity resolution,”
`the process of “matching individual customer identities . . . and combining them into a single
`consistent and accurate customer profile.”12 Oracle’s ID Graph “synchronizes” the vast amounts
`of personal data Oracle has amassed; that is, it matches personal data that can be determined to
`share a common origin with other personal data. This synchronizing allows Oracle to identify
`individuals and aggregate their many identifiers, which in turn facilitates further synchronizing of
`personal data with a high degree of confidence. As Oracle, in velveteen marketing language,
`describes it:
`
`The Oracle ID Graph helps marketers connect identities across disparate marketing
`channels and devices to one customer. Powered by the Oracle Marketing Cloud
`and Oracle Data Cloud, the Oracle ID Graph seamlessly pulls together the many
`IDs across marketing channels and devices that comprise a given person, enabling
`marketers to tie their interactions to an actionable customer profile. This ID
`enables the marketer to orchestrate a relevant, personalized experience for each
`individual across marketing channels and device types.13
`23.
`Oracle and other data brokers act as central nodes in the “adtech” network, where
`massive volumes of personal information on the world’s population is aggregated and used to
`identify and profile individuals for “targeted advertising” or other commercial and political
`purposes.
`24.
`Oracle tracks the lives of the general public in a manner that is opaque, if not
`invisible, to the people it follows, as they have no direct relationship with Oracle. Oracle is
`registered as a “data broker” in California (and in other States), which is defined as “a business
`that knowingly collects and sells to third parties the personal information of a consumer with
`whom the business does not have a direct relationship.” Cal. Civ. Code § 1798.99.80. As such,
`
`
`11 Giridhari Venkatadri, Piotr Sapiezynski, et al., Auditing Offline Data Brokers via Facebook’s
`Advertising Platform, The World Wide Web Conference ( May 13-17, 2019), https://lig-
`membres.imag.fr/gogao/papers/databrokers-measurement_finalCameraReady.pdf
`[https://perma.cc/H7XW-PWE2].
`12 What Is a Customer Data Platform, Oracle, https://www.oracle.com/bh/cx/customer-data-
`platform/what-is-cdp/ [https://perma.cc/FBW7-X8DP].
`13 ID Management, Oracle, https://docs.oracle.com/en/cloud/saas/data-cloud/data-cloud-help-
`center/IntegratingBlueKaiPlatform/id_management.html [https://perma.cc/LCW9-9PCH].
`CLASS ACTION COMPLAINT
`
`- 7 -
`CASE NO. 3:22-CV-04792
`
`
`
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 11 of 69
`
`
`
`Oracle does not even maintain a pretense of having directly obtained the consent of the subjects of
`its surveillance—i.e., the proposed Classes herein—who have no legal or practical ability to
`consent to Oracle’s conduct.
`25.
`Oracle’s business model has long roots in the surveillance of ordinary citizens.
`Oracle takes its name from a CIA project codename. In 1977, Oracle’s founder, Larry Ellison,
`was hired by the CIA to build a database; the CIA was Oracle’s first customer. As of 2020, Oracle
`had contracts with all five branches of the military, and recent or pending contracts with the CIA,
`as well as substantial relationships with local law enforcement across the country. Surveillance is
`central to Oracle’s history and development, and to its current business and marketing plan.
`
`A.
`
`Oracle Employs Multiple Methods for the Collection of Personal Data from
`Unwitting Internet Users.
`26.
`Operation of Oracle’s ID Graph depends upon the accumulation of vast amounts of
`personal data concerning as many people as possible. Oracle utilizes multiple means to collect and
`aggregate the personal data of people worldwide, including the primary methods alleged in this
`subsection.
`27.
`Oracle collects many types of personal information from Internet users including
`concrete identifiers such as names, home and work addresses, e-mail addresses, and telephone
`numbers. Oracle also amasses data about peoples’ behavior, including the sites they visit online,
`their digital and offline purchases, where they shop, and how they pay for their purchases. Oracle
`gathers this personal information from a suite of its own Internet technologies, including cookies,
`tracking pixels, device identification, cross-device tracking, as well as from its acquisition of data
`from other parties. Oracle then processes, analyzes, and monetizes this data, as described below.
`28.
`Cookies. Oracle deploys its own proprietary “cookies” which are pieces of
`software code sent by Oracle that are stored on Internet users’ web browsers and collect
`information regarding Internet use. Oracle’s cookies are frequently labeled “BlueKai,” named
`after a start-up Oracle acquired in February 2014. Oracle’s BlueKai cookies track online and
`mobile app activity, obtaining data in real time and transmitting it back to Oracle’s servers. When
`an Internet user visits a webpage or uses a mobile application, Oracle employs its BlueKai cookies
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`- 8 -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 12 of 69
`
`
`
`to gather and transmit to itself information including the unique user ID, IP address, session time,
`number of sessions or visits, and the URL or websites an Internet user has visited (e.g., Referrer
`and Origin headers), hyperlinks clicked, and documents downloaded.14 Oracle is able, with the
`use of algorithmic data processing, to use the data it gathers from BlueKai cookies (and, as
`explained below, which may also be associated with additional data from other sources) to infer a
`wide range of behavioral traits and information that it attributes to individual Internet users
`through persistent identifiers or other personal information of the Internet users—from their
`consumer preferences, income levels, and their politics.
`29.
`JavaScript. Oracle utilizes a proprietary software device, referred to as “bk-
`coretag.js” JavaScript code, to “extract,” or intercept, “user attributes,” which include the contents
`of users’ communications with websites, and secretly sends them to Oracle while the users are in
`the process of communicating with those websites. Oracle’s technical documentation explains that
`bk-coretag.js JavaScript code deployed by Oracle collects “user attributes” “such as product views,
`purchase intent, [and] add-to-cart actions”15 and other communications that users have with
`websites and simultaneously copies and sends those communications to Oracle.
`30.
`Oracle places the bk-coretag.js JavaScript code on Internet users’ electronic devices
`when they browse a website that contains certain Oracle code. When an individual Internet user
`visits a web page, his or her browser sends a message called a “GET request” to the webpage’s
`server. The GET request tells the website what information is being requested and also instructs
`the website’s server to send the information back to the user. The bk-coretag.js JavaScript code
`then communicates with Oracle’s servers and source code by sending separate “GET” requests to
`Oracle that contain copies of contents in the initial “GET” request being sent by the user’s browser
`to the website they are visiting.
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`14 Martin Degeling & Jan Nierhoff, Tracking and Tricking a Profiler Automated Measuring and
`Influencing of Bluekai’s Interest Profiling, Workshop on Privacy in the Electronic Society (Oct.
`15, 2018), https://dl.acm.org/doi/pdf/10.1145/3267323.3268955 [https://perma.cc/7UVK-ALU9].
`15 Oracle Data Cloud Core Tag Implementation, Oracle, https://docs.oracle.com/en/cloud/saas/data-
`cloud/data-cloud-help-center/IntegratingBlueKaiPlatform/DataIngest/coretag_implementation.html
`[https://perma.cc/8XVU-8Z2F].
`
`
`- 9 -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 13 of 69
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`31.
`Oracle uses the bk-coretag.js JavaScript code to intercept the contents of Internet
`users’ communications with web sites as follows:
`a.
`When a user opens an Internet web page that contains certain code, a
`request is sent by the user’s browser to Oracle’s servers to fetch the bk-coretag.js JavaScript file.
`b.
`The bkcoretag.js code then triggers a series of additional network “GET”
`
`requests.
`
`c.
`As part of these “GET” requests, the bk-coretag.js code intercepts the
`contents of the user’s communications with the browser and simultaneously copies those contents
`and sends them to Oracle.
`32.
`Through this practice, Oracle is able to intercept substantive communications
`between internet users and websites, including, inter alia: 16
`a.
`the URLs being browsed by the Internet user as well as the referrer URL;
`b.
`webpage title;
`c.
`webpage keywords;
`d.
`the exact date and time of the website visit;
`e.
`the IP address of the user’s computer;
`f.
`product page visits;
`g.
`“purchase intent”17 signals;
`h.
`“add-to-cart actions”; and
`i.
`data entered by the user into forms on the website.
`33.
`The bk-coretag.js code also sends to Oracle the Internet user’s login status and
`“hashes” of the user’s email address and phone number.18 Oracle attributes the communications to
`
`
`16 Data Ingest, Oracle, https://docs.oracle.com/en/cloud/saas/data-cloud/data-cloud-help-
`center/IntegratingBlueKaiPlatform/data_ingest.html [https://perma.cc/99JS-5Z64].
`17 Oracle’s technical documentation does not appear to define the term “purchase intent,”
`however an Oracle document describes “Interest and intent signals” as including “search, page
`views, and price comparison.” See Activation Playbook, Oracle (2020),
`https://www.oracle.com/za/a/ocom/docs/cx-activation-vertical-playbook-2020.pdf
`[https://perma.cc/TYS5-NKX4].
`18 According to Oracle, “Hashing is a form of encryption used for swapping data between
`integrated data management systems.” See Hashing Identifier, Oracle,
`
`
`
`
`
`
`- 10 -
`
`CLASS ACTION COMPLAINT
`CASE NO. 3:22-CV-04792
`
`

`

`Case 3:22-cv-04792-SK Document 1 Filed 08/19/22 Page 14 of 69
`
`
`
`1
`2
`3
`4
`5
`6
`7