In a recent legal development, a prominent consumer-rights organization in the Netherlands has taken Amazon to court over allegations of invasive data tracking practices. The lawsuit, which utilizes newly expanded legal provisions enabling class actions, asserts that Amazon’s actions violate the European Union’s stringent privacy laws.
The legal action, initiated by Stichting Data Bescherming Nederland (SDBN), translates to the Dutch Data Protection Foundation, alleges that Amazon’s use of cookies to monitor visitors to popular websites for the purpose of creating targeted advertisements is carried out without the requisite user consent.
This case is significant due to a European Union law that came into effect in June, compelling all 27 member states to enact legislation that facilitates consumer groups in bringing forth class-action lawsuits against corporations. As a result, corporate legal teams are anticipating a surge in similar complaints representing vast numbers of consumers.
According to SDBN, the class-action lawsuit encompasses approximately five million Amazon account holders residing in the Netherlands. The organization seeks both compensation for affected consumers and a court order to halt Amazon’s data tracking practices. This lawsuit echoes a 2021 regulatory penalty imposed on Amazon by Luxembourg’s privacy regulator, which fined the company a staggering $887 million for its use of personal data in advertising. Amazon has chosen to appeal this penalty.
Anouk Ruhaak, the chair of SDBN, stated, “We hope that by increasing the pressure, Amazon will eventually recognize the costliness of its actions.”
Notably, SDBN has also taken legal action against X, formerly known as Twitter, in a Dutch court, with a focus on consumer data collected to tailor targeted advertisements.
Amazon responded to the lawsuit with a statement from a spokesperson, who said, “We disagree with these claims, and we will defend ourselves through the legal process. Maintaining the privacy and security of our customers’ information is a top priority, and Amazon adheres to all legal requirements in the countries and regions where we operate.”
Ruhaak emphasized that the lawsuit is an avenue for consumers to seek redress because Amazon has not taken steps to rectify the violations identified by Luxembourg’s privacy regulator two years ago.
It is worth noting that many large companies frequently challenge European privacy fines, which can potentially reach up to 4% of their global revenue or €20 million (approximately $21.1 million), depending on which amount is higher. For instance, on a recent note, the U.S. software company Clearview AI successfully appealed against a $9.1 million fine imposed by Britain’s privacy watchdog. The regulator had issued the fine the previous year and had ordered Clearview AI to delete image data collected on U.K. residents and cease web data scraping activities.
One of the persistent concerns among European consumer groups and privacy advocates is the protracted nature of regulatory cases. When a business chooses to appeal a regulator’s penalty, it can effectively delay implementing any changes that regulators might demand to enhance privacy measures.
Carlo Piltz, a partner at the Berlin-based law firm Piltz Legal, noted, “There is a trend toward individuals suing over potential privacy violations, sometimes coming on top of fines from regulators and piling pressure onto companies.” He anticipates more lawsuits initiated by consumer protection groups regarding data protection law violations in the future.
The lawsuit against Amazon alleges that the tech giant collects personal data through cookies, tracking consumers’ online behavior across various websites and its own platforms. Subsequently, Amazon uses this data to target individuals with tailored advertising, a practice that SDBN is eager to halt.
European privacy regulators have increasingly scrutinized how large companies leverage consumer data to create targeted online advertisements. Earlier this year, Ireland’s data protection regulator imposed a fine of over $400 million on Meta and explicitly prohibited the use of online contracts to justify sending consumers personalized ads based on their online activity. Meta is currently challenging the lawsuit and has recently proposed a plan to introduce paid subscriptions for Instagram and Facebook users who decline to provide their personal data for ad purposes.
In summary, the lawsuit filed by Stichting Data Bescherming Nederland against Amazon underscores the growing concern over privacy violations in the digital age and the determination of consumer groups to hold tech giants accountable for their data handling practices. As the legal battle unfolds, it will undoubtedly have implications for how companies navigate the complex landscape of data privacy regulations and consumer rights in the European Union and beyond.
