This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Oracle is facing a class action lawsuit alleging that its algorithmic data processing system functions as a 'worldwide surveillance machine.' The suit claims the company collects vast amounts of personal data from billions of users without consent to build detailed profiles for advertising. The litigation highlights the challenges of pursuing privacy claims in the U.S. due to the lack of comprehensive federal privacy laws.
Oracle's automated system involving algorithmic data processing was alleged in a lawsuit to have been unlawfully collecting personal data from millions of people and violating their privacy rights.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
The incident involves allegations that Oracle's algorithmic system collects vast amounts of personal data without consent to profile individuals and bypass privacy controls, violating their privacy.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The privacy risks and surveillance are the result of intentional corporate decisions by Oracle to deploy and operate an algorithmic data profiling system post-deployment.
A class-action lawsuit alleges Oracle operates a global surveillance machine tracking five billion people to build detailed advertising dossiers without consent. While primarily a commercial privacy issue, the immense scale of data harvesting represents a substantial concern for global civil liberties and societal privacy standards.
The report describes an algorithmic data processing system that automatically tracks users across the web and compiles detailed dossiers on billions of individuals without direct human intervention.
High Risk: The system is an algorithmic profiling and tracking tool with significant implications for fundamental rights, specifically the right to privacy of billions of individuals.
The system's primary function is to track user behavior across the internet and build detailed profiles (behavioral models) for advertising purposes.
The report clearly details the legal allegations, the scale of the affected population (five billion people), and the specific mechanisms of privacy violation (tracking, profiling, and data marketplaces). While the technical architecture of Oracle's algorithmic system is not described in deep detail, the nature of the privacy risk is unambiguous.
The tracking could be viewed as standard adtech data collection rather than an AI safety incident, though the scale and algorithmic profiling justify its inclusion.
Technology
Surveillance Machine
Oracle amassed detailed dossiers on five billion people using adtech.
Use of Proxies for Sensitive Data
Used proxies to circumvent privacy controls and enrich user profiles.
Cookie Tracking Technology
Used BlueKai cookie tracking to follow users across the web.
Data Inputs
Unconsented Data Collection
Collected vast amounts of data from unwitting internet users.
Data Marketplace Enrichment
Enriched user profiles using an extensive third-party data marketplace.
Lack of Data Control
Users had no control over how their personal data was harvested.
Human Factors
Unwitting Internet Users
Users were unaware of the extensive tracking and profiling taking place.
Process and Methods
Circumvention of Privacy Controls
Methods were deployed to bypass user privacy settings and controls.
Lack of Consent Mechanisms
No robust processes to obtain explicit consent before tracking.
Management
Dangerous Surveillance Mission
Management prioritized tracking where every person goes and what they do.
Corporate Privacy Violations
Management allowed systemic tracking of billions of people globally.
Regulatory Environment
No US Federal Privacy Law
Absence of comprehensive federal privacy law created a hostile legal climate.
Inadmissible Class Actions
European courts ruled some class actions inadmissible due to standing.
High Burden of Proof for Damage
UK Supreme Court required proof of individual damage to claim compensation.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
