PHILADELPHIA – A group of shoppers have filed a class action lawsuit against pharmacy retailer Rite Aid, charging that it installed tracking tools on its website which would share its customers’ search and purchase information with Google and other applications, such as Facebook, Instagram and TikTok.
Marylou Anderson of Forest City, Autumn Blaze of Centre Hall, Calder Duffy and Nashere McGee of Philadelphia filed suit in the U.S. District Court for the Eastern District of Pennsylvania on Aug. 25 versus Rite Aid Corporation, of Philadelphia.
“Rite Aid controls and operates https://riteaid.com. The website provides users, such as plaintiffs and class members, with access to various goods, including food, cosmetics, health-related goods and prescription medications. Using the website, visitors can fill prescriptions, purchase sensitive health-related goods, and browse sensitive health-related goods. The website offers the option for tracked users to search for goods which can be purchased from local Rite Aid store locations or purchased and delivered directly to the visitor,” the suit says.
“To use the website’s search function, tracked users type search queries or search terms into the search bar to search for specific goods on the website. After typing and submitting queries into the search bar, lists of results are obtained from the website and displayed to its tracked users. Unbeknownst to tracked users, Rite Aid employs tracking tools on the website which intercept communications between tracked users and the website. The tracking tools, which were created by Google and Meta send the tracking entities information relating to tracked users’ searches on the website.”
The suit adds that when tracked users click on specific items on the website, detailed descriptions of each item are shared with the tracking entities, and these details are shared again when tracked users add items to their carts – and that by sharing the items that tracked users search for, look at and add to cart, the defendant shares protected private health information with the tracking entities.
“The website does not provide tracked users with notice that the website’s use of a search bar would cause their queries to be shared with the tracking entities, that viewing items or adding items to a cart will result in detailed information about those items being intercepted by the tracking entities, or that such interceptions will be used to benefit the defendant and tracking entities separate from the services being rendered to the visitor. Nor does Rite Aid obtain tracked users’ consent to its disclosure practices prior to tracked users’ use of the website. Some tracking entities, such as Google, provide business tools to Rite Aid, which result in the tracking of tracked users’ information to improve website functionality and developing a holistic profile of tracked users to improve the effectiveness of targeted advertising,” the suit states.
“Other tracking entities, such as Meta, improve the value of advertising by collecting and analyzing visitor data to determine interests, lifestyles, demographics and other relevant categorizations to ensure relevant ads reach tracked users. This value can be cashed out by using this information to sell advertising across multiple websites to marketing firms looking to target visitors based on their use of the website or demographics. In short, the tracking entities receive a benefit by tracking more visitor interactions on the website. A data sharing policy for a website or online store is an important factor for individuals deciding whether to provide personal information to that website.”
According to the lawsuit, both federal and Pennsylvania legislatures addressed citizens’ privacy expectations when communicating with parties over wired communications – leading Congress to pass the Wiretap Act, which “prohibits the unauthorized interception of electronic communications”, and Pennsylvania to pass the Wiretapping and Electronic Surveillance Control Act, which “attaches liability to any person who intercepts, discloses, uses or procures any other person to intercept, disclose or use electronic communications.”
“Rite Aid purposefully implemented and utilized various tracking tools on its website, including Google’s Retail API and advertising tools, and Facebook’s Pixel. The website does not obtain consent to share tracked users’ queries with third-parties contemporaneously with tracked users’ search requests. Rite Aid knew that the search feature used on the website would feed tracked users’ queries to the tracking entities, and that the website did not provide notice of or obtain consent as to such practices. Visitors of the website who used the search bars have been harmed by Rite Aid, resulting in violations of WESCA and the Wiretap Act. In addition to monetary damages, plaintiffs seek injunctive relief requiring Rite Aid to immediately (i) remove the tracking tools from the website, or (ii) add appropriate and conspicuous disclosures about the nature of its search bar, and obtain the appropriate consent from visitors,” the suit says.
“Plaintiffs also had their privacy interests violated. Visitors of the website, such as plaintiffs, have an interest in maintaining control over their private and sensitive information, such as their queries, as well as an interest in preventing their misuse. Plaintiffs’ claims are brought as a class action, pursuant to Federal Rule of Civil Procedure 23, on behalf of themselves and all other similarly-situated persons. Plaintiffs seek relief in this action individually and on behalf of tracked users for violations of WESCA, breach of implied contract, breach of fiduciary duty, violation of Pennsylvania Unfair Trade Practices and Consumer Protection Law and for violating the privacy rights of plaintiffs and tracked users. Defendant violated the plaintiffs and tracked users’ privacy interests the moment, and each time, plaintiffs and tracked users entered and submitted queries via the website’s search bar and had their queries intercepted by the tracking tools.”
For counts of violating Pennsylvania’s Wiretapping and Electronic Surveillance Control Act, Pennsylvania’s Unfair Trade Practices and Consumer Protection Law, breach of implied contract, breach of fiduciary duty and invasion of privacy, the plaintiffs are seeking the following relief:
• An order determining that this action is properly brought as a class action and certifying plaintiffs as the representatives of the Classes and their counsel as Class Counsel;
• An order declaring that the Rite Aid’s conduct violates the statutes referenced herein;
• An order finding in favor of plaintiffs and the Classes on all counts asserted herein;
• Entry of an order for injunctive and declaratory relief as described herein, including, but not limited to, requiring Rite Aid to immediately (i) remove the tracking tools from the website or (ii) add and obtain the appropriate consent from tracked users;
• Damages in amounts to be determined by the Court and/or jury;
• An award of statutory damages or penalties to the extent available;
• For Rite Aid to pay $1,000 to plaintiffs and members of the Class, as provided by WESCA;
• For pre-judgment interest on all amounts awarded;
• For an order of restitution and all other forms of monetary relief;
• An award of all reasonable attorneys’ fees and costs; and
• Such other and further relief as the Court deems necessary and appropriate.
The plaintiffs are represented by Russell D. Paul and Jacob M. Polakoff of Berger Montague in Philadelphia, plus Mark S. Reich and Courtney Maccarone of Levi & Korsinsky, in New York, N.Y.
The defendant has not yet secured legal counsel.
U.S. District Court for the Eastern District of Pennsylvania case 2:23-cv-03332
From the Pennsylvania Record: Reach Courts Reporter Nicholas Malfitano at nick.malfitano@therecordinc.com