By Jonathan Stempel
(Reuters) – Oracle Corp has agreed to pay $115 million to settle a lawsuit accusing the database and cloud computing software company of invading people’s privacy by collecting their personal information and selling it to third parties.
A preliminary settlement of the proposed class action lawsuit was filed late Thursday in federal court in San Francisco and requires a judge’s approval. Oracle has denied any wrongdoing.
The plaintiffs, who have no connection to Oracle, said the company violated federal and state privacy laws and the California Constitution by creating unauthorized “digital dossiers” on hundreds of millions of people.
They said the files contained data including where people browsed the internet, where they banked, bought gasoline, ate out, shopped and used their credit cards.
Oracle then allegedly sold the information directly to marketers or through products like ID Graph, which, according to the company, helps marketers “curate a relevant and personalized experience for each individual.”
The settlement covers people whose personal information Oracle collected or sold since August 19, 2018.
As part of the settlement, the Austin, Texas-based company agreed not to collect information generated by users from URLs of websites they have previously visited, or text users enter into online forms other than Oracle’s own websites.
Oracle did not immediately respond to requests for comment Friday.
The plaintiffs include privacy rights activist Michael Katz Lacabi and Jennifer Golbeck, a University of Maryland professor who specializes in social media and privacy.
Liv Cabraser Hyman & Bernstein, which represents the plaintiffs, may seek up to $28.75 million from the settlement for legal fees.
The case is Katz-Lacabi et al. v. Oracle America, Inc., U.S. District Court, Northern District of California, No. 22-04792.