A class action lawsuit has been filed against Ubisoft for allegedly sharing PII from its store without the user’s consent. Plaintiffs Trevor Lakes and Alex Rajjoub allege their personally identifiable information was shared with Facebook parent company Meta after purchasing a game from Ubisoft’s store, while logged into their Facebook accounts. The lawsuit has been filed via a 46-page complaint in the US District Court for Northern District Court of California.
Per filed complaint (via Court Listener):
- “This is a class action brought on behalf of all persons who: (i) visited https://www.ubisoft.com/ (the “Website”), operated by Defendant; and, either (a) purchased a video game on the Website (the “Purchasers”), or (b) subscribed to the Website’s Ubisoft+ service, which allowed users to gain access to video games on the Website (the “Subscribers”) (collectively, the “PII Users”).”
- “Defendant does not disclose on the Website that PII Users’ personally identifying information (“PII”) would be captured by the Meta Platforms, Inc. (“Meta” or “Facebook”) tracking Pixel (the “Pixel”) utilized by Defendant, and then transferred to Meta thereby exposing the subscribers’ PII to any person of ordinary technical skill who received that data.”
- “Defendant knew that their Pixel resulted in users’ PII and search terms being shared (resulting in VPPA and Wiretap Act violations), and that they failed to obtain users’ consent to allow their Pixel to operate in a way that shares users’ protected information with Facebook.”
The basis for legal action from the plaintiffs comes from violating the Video Privacy Protection Act. The VPPA was passed in 1988 and was originally intended to protect video rental customers’ PII by preventing “wrongful disclosure of video tape rental or sale records”, such as rental/purchase history. The bill had been passed following the release of Supreme Court nominee Robert Bork’s video rental history in a newspaper, then called the Bork Tapes which consisted of roughly 146 video rentals that were considered modest and/or non-salacious. The VPPA was amended in 2013 to include digital distribution following the epic success of Netflix’s online streaming service.
Pixel
At the crux of this lawsuit is a service called Pixel which is a tracking technology used for sharing data across platforms. As with any law, VPPA is subject to restrictions in how it can be applied and then hold defendants accountable. In this particular case, it is noted that both plaintiffs downloaded a game that contained cutscenes and that detail becomes an anchor for the lawsuit. The VPPA has specific language relating to video footage and that a video tape service provider is liable to its consumers for knowing disclosure of PII without getting written consent from its consumers. The plaintiffs allege that Ubisoft did not disclose that PII would be shared with Meta or Facebook using Pixel.
Per filed complaint
- “Thereafter, Plaintiff Lakes used the Website on his Chrome browser, while logged into his Facebook account, to download at least one video game containing cinematics or cut scenes.4 The video games downloaded by Plaintiff Lakes include cut scenes and cinematics.”
- “Thereafter, Plaintiff Rajjoub visited the Website on his Chrome browser, while logged into his Facebook account, to download at least one video game, which contained cut scenes and cinematics.”
- “Defendant does not disclose on the Website that PII Users’ personally identifying information (“PII”) would be captured by the Meta Platforms, Inc. (“Meta” or “Facebook”) tracking Pixel (the “Pixel”) utilized by Defendant, and then transferred to Meta thereby exposing the subscribers’ PII to any person of ordinary technical skill who received that data.”