Oracle Faces Class Action Lawsuit Over "Surveillance Machine" Tracking 5 Billion People

Three privacy rights advocates filed a class action lawsuit against Oracle Corporation on August 19, 2022, in the Northern District of California, alleging that the company operates a “worldwide surveillance machine” that has compiled detailed digital dossiers on approximately 5 billion internet users without their knowledge or consent. The 66-page complaint (Case No. 3:22-cv-04792) was filed by Dr. Johnny Ryan of the Irish Council for Civil Liberties, Mike Katz-Lacabe of the Center for Human Rights and Privacy, and Professor Jennifer Golbeck of the University of Maryland’s College of Information Studies.

The lawsuit alleges that Oracle’s data broker operations “amount to a deliberate and purposeful surveillance of the general population via their digital and online existence,” tracking and recording vast amounts of personal information on hundreds of millions of people globally. According to the complaint, Oracle has generated more than $42 billion in revenue by selling this personal information, creating one of the world’s largest commercial surveillance operations. The plaintiffs claim Oracle collects highly personal information including browsing history, location data, purchase behavior, and online activity without meaningful consent or transparency.

The legal claims allege violations of the Federal Electronic Communications Privacy Act, the California Constitution, the California Invasion of Privacy Act, competition law, and common law privacy protections. The lawsuit challenges Oracle’s business model as a major data broker, which involves purchasing, aggregating, and reselling personal data from thousands of sources to create comprehensive profiles of individual internet users for targeted advertising and other commercial purposes.

This lawsuit exposes the infrastructure behind modern surveillance capitalism, where companies like Oracle monetize the digital activity of billions of people without direct relationships with those individuals. Oracle’s role as both a major intelligence community contractor through the C2E cloud program and a commercial surveillance operation raises profound questions about the convergence of state and corporate surveillance. The same company providing cloud infrastructure to the CIA and NSA also operates massive commercial data collection operations, suggesting potential information flows between intelligence agencies and private sector surveillance apparatus.

The lawsuit underscores how Oracle’s business model exemplifies the privatization of surveillance, where commercial entities build capabilities that parallel or exceed those of government intelligence agencies, then potentially make this data available through contracts, legal processes, or data breaches.