• by Wendy Davis , Yesterday

Siding against PubMatic, a federal judge has ruled that web users can proceed with various privacy related claims over the ad tech company's alleged data collection practices.

"At this stage of the litigation, plaintiffs have adequately pled a 'highly offensive' intrusion of privacy that invades a reasonable internet user’s expectation of privacy," U.S. District Judge Susan Illston in the Northern District of California said in a 19-page decision issued Tuesday.

The ruling comes in a lawsuit brought last year by four California residents -- Gilbert Gaw, Michael Selby, Logan Mitchell and a woman proceeding anonymously as Jane Doe.

They alleged that PubMatic used trackers such as cookies and device identifiers to collect browsing data, traded that information with other data brokers, and harnessed the combined data for ad-targeting profiles.

For instance, PubMatic allegedly created a profile of Gaw that placed him in ad-targeting buckets such as "age and life stage," "credit risk," "yearly household income," "affluence level,” "field of study," and "confidence in keeping a budget."

The class-action complaint included claims that PubMatic violated federal and state wiretap laws, and that it engaged in "intrusion upon seclusion" -- a California privacy claim involving "highly offensive" privacy violations.

PubMatic urged Illston to dismiss the lawsuit at an early stage, arguing that the allegations, even if proven true, wouldn't establish liability for any of the claims.

"Plaintiffs advance reflect an illogical reading of California (and federal) law that would have vast consequences for how the internet functions," PubMatic argued in an October filing.

The company added that the plaintiffs "have no reasonable expectation of privacy in their anonymous web browsing data," arguing that the data it allegedly collects is tied to user IDs -- and not to "a specific individual."

"Even if someone with the ID 'user123' can be associated with certain browsing history and related information, those data are still anonymous without plausible allegations that PubMatic discloses that user123 is a specific person," PubMatic argued.

Illston rejected that argument, writing that the complaint included allegations that PubMatic's technology could de-anonymize data.

PubMatic also argued to Illston that other judges have ruled that online data collection and disclosure to third parties is "routine commercial behavior," as opposed to a highly offensive privacy violation.

The company noted that the 9th Circuit Court of Appeals, which handles appeals from federal courts in California, ruled in favor of Microsoft in a privacy lawsuit over "session replay" technology that allegedly recorded a consumer's activity on the site PetSuppliesPlus.com.

A three-judge appellate panel found in that case that the consumer, Pennsylvania resident Ashley Popa, didn't allege that she entered personally identifiable information into PetSuppliesPlus's website, or that Microsoft was able to connect any data it allegedly collected to her identity.

Judge Jed Rakoff, who authored the opinion in that matter, said Microsoft's alleged monitoring of Popa's interactions with PetSuppliesPlus.com "seems most similar to a store clerk’s observing shoppers in order to identify aisles that are particularly popular or to spot problems that disrupt potential sales."

Illston also rejected those arguments.

She wrote that the appellate decision in favor of Microsoft involved different circumstances, noting that Microsoft allegedly only collected a consumer's data while she browsed on a single website.

By contrast, Illston said, "plaintiffs allege a more invasive injury."

"The court finds that PubMatic’s alleged conduct is very different from being observed by a retailer while shopping in their store," she wrote. "PubMatic allegedly tracks, compiles, and sells massive amounts of information about plaintiffs without their knowledge."

Illston's decision comes around six months after a different federal judge ruled that data broker LiveRamp must face similar privacy claims.