Expert: Zillow Privacy Lawsuit Has Wider Implications

The civil lawsuit filed Monday accusing Zillow Group Inc. and Microsoft Corp. of violating the privacy of consumers using Zillow’s website has far wider implications.

According to an expert in internet privacy law, the case and others like it could ultimately result in dramatic changes to the way any company with a website collects information about users.

“The problem for these companies is, the exact moment that technology is allowing this data collection comes at a time when courts and consumers are asking for greater privacy protection,” said David A. Straite, a partner in the New York law firm DiCello Levitt and a certified information privacy professional. “Companies are advancing right into a wall.”

The lawsuit, filed in U.S. District Court for the Western District of Washington in Seattle, seeks class action status. In the complaint, the plaintiffs claim Zillow employs Microsoft and other third-party vendors “embed snippets” of computer code on its website, “which then deploys on each website visitor’s internet browser for the purpose of intercepting and recording” their interactions with the site. This can include recording “mouse movements, clicks, keystrokes, … URLs of web pages visited, and/or other electronic communications in real-time.”

According to the complaint, third-party vendors then use the collected data to recreate each website visitor’s “entire visit to Zillow’s website.”

It continues, “Microsoft and other Session Replay Providers create a video replay of the user’s behavior on the website and provide it to Zillow for analysis.” The complaint adds that this is the “electronic equivalent of ‘looking over the shoulder’ of each visitor to the Zillow website for the entire duration of their website interaction.”

The lawsuit claims this violates the Washington state wiretapping statute, and constitutes an invasion of the privacy rights of website visitors.

This lawsuit was filed about a week after three similar suits were filed in Pennsylvania, targeting not only Zillow but Lowe’s and Expedia. Pennsylvania has a wiretapping law similar to the one in Washington.

Straite, who served as co-lead counsel for a national privacy lawsuit against Facebook-parent Meta that reached a $90 million settlement in February, says the issue boils down to whether companies provide enough information to website visitors about the information they intend to collect from them.

Zillow has posted its privacy policy on its website, he said. “It says Zillow will collect a variety of information ‘automatically.’ They use the word ‘automatically.’ But the policy is incredibly vague.”

With an effective date of March  7, 2022, it mentions collecting search history, what visitors click on, and the amount of time they spend looking at parts of the website, he said.  

“If you take the average middle class American, even if you’ve read the policy, you would think this privacy policy protects your data,” Straite said. “But it doesn’t say ‘mouse movements.’ It doesn’t mention ‘session replay providers.’ … None of the clear details about what is collected is disclosed.”

It also does not mention that keystrokes – including information typed but not submitted – are recorded. 

“This is a test of vagueness,” Straite said. “A test of how vague a privacy policy can be. If this counts as fair disclosure, we’re in trouble. Then future defendants could start integrating more invasive things and say that’s enough to cover it.”

Given the implications, the case could affect any company with a website, from retailers to banks and mortgage lenders to media companies.

“It’ll be an interesting case to watch,” he said.