In the latest privacy damages lawsuit, X Corp, formerly known as Twitter, and its former subsidiary MoPub are facing a class action lawsuit filed in the Netherlands. The lawsuit alleges that MoPub, a mobile ad platform, engaged in “illegal trafficking” of millions of app users’ personal data. Although X Corp no longer owns MoPub, it operated the mobile adtech during the period in question, which includes several years when the EU’s General Data Protection Regulation (GDPR) was in effect.
Key Takeaway
X Corp and MoPub are facing a class action lawsuit in the Netherlands over illegal trafficking of app users’ personal data. The lawsuit alleges GDPR violations and seeks compensation for affected individuals. This case highlights the growing wave of privacy class actions in the EU and the need for both regulatory enforcement and privacy litigation to protect individuals’ privacy rights.
Allegations of Unlawful Tracking and Data Sharing
The lawsuit claims that MoPub’s adtech platform unlawfully tracked app users and collected their personal data without their knowledge or consent as they used third-party software like games, period trackers, and dating apps. This data was then allegedly shared and traded with numerous companies, violating GDPR regulations. The lawsuit demands compensation on behalf of 10 million Dutch adults and one million children who are estimated to have used apps embedded with MoPub’s trackers, as well as the deletion of unlawfully collected data.
Implications of GDPR Violations
The GDPR regulates the processing of personal data and requires companies to have a valid legal basis for any operations involving personal data. The plaintiffs argue that X Corp and MoPub collected far more information than necessary and shared sensitive data, including sexual orientation and religious beliefs, with thousands of third parties without adequate consent. The lawsuit claims that meaningful consent was impossible due to the sheer number of companies involved.
Potential Damages and Legal Proceedings
If the lawsuit succeeds, damages could potentially amount to several billion euros. Individual cases have seen judges award compensation ranging from €250 to €500 per person. However, since this is a class action suit, the final amount is uncertain. The legal process could take several years, with a ruling not expected until at least 2026, unless a settlement is reached. X Corp initially engaged in discussions but later withdrew, prompting the decision to go to court.
Strategic Litigation and Privacy Reform
The non-profit data protection foundation, Stichting Data Bescherming Nederland (SDBN), is funding the legal action against X Corp. It aims to obtain compensation for affected individuals and drive reform of adtech business models that rely on tracking and profiling users without adequate consent. Similar foundations are filing privacy damages suits in the Netherlands, capitalizing on the country’s opt-out class action regime. These lawsuits aim to raise awareness and hold companies accountable for privacy violations.
