The complaint filed Monday in federal court challenges Seattle-based Zillow's use of session-replay code, a common technology that allows websites to record and replay users' interactions with the site to learn how they use it.
The technology amounts to the "electronic equivalent of 'looking over the shoulder' of each visitor to the Zillow website for the entire duration of their website interaction," the complaint said. Many users are likely unaware the replay exists, according to the suit, which likens the practice to wiretapping.
The suit alleges Zillow uses Microsoft's session-replay technology known as Clarity and names both companies.
Neither company commented on the substance of the allegations Tuesday. Microsoft spokesperson David Cuddy said the company was "looking into this closely."
Zillow is "currently reviewing" the suit, spokesperson Will Lemke said. "Zillow takes the privacy and security of users' information very seriously. We are transparent with our users through our privacy policy, which explains to users the types of information we collect as they use our apps and websites."
The Seattle attorneys who filed the case did not respond to an interview request.
The filing this week is one of a handful of similar cases across the country. Several cases in Pennsylvania challenged the software used by Zillow, Lowe's and Expedia, Bloomberg Law reported. Another recent case in California named Old Navy.
Last year, dozens of similar cases were filed with mixed results, according to Kristin Bryan, an attorney who works in Cleveland and New York and has represented companies defending against similar lawsuits. (Bryan declined to speak specifically about the latest case filed against Zillow and Microsoft.)
"Privacy and cybersecurity [are] a top-of-mind issue right now," Bryan said.
The Washington case, filed on behalf of two Zillow users from South Carolina and Pennsylvania, alleges the practice violates Washington wiretapping law and "constitutes an invasion of the privacy rights of website visitors."
State law prohibits intercepting or recording private communications without permission from the participants, except in certain emergency situations.
According to the complaint, the session-replay code used on Zillow's site can capture mouse movements, clicks, zooms and keystrokes, as well as information about properties users view, personal information users enter to schedule a tour and which pages they view.
"Website visitors reasonably expect that their interactions with a website should not be released to third parties unless explicitly stated," the filing said.
Cases challenging session-replay code typically revolve around whether website users sufficiently consented to the replay technology in a website's terms of use and whether state wiretapping laws should cover online activity like mouse clicks, Bryan said.
Frequent lawsuits challenging tracking technology can lead corporations to write broader terms of service to try to avoid being sued.
"Since last year, many commercial website operators have taken note of this rise in litigation activity," Bryan said, "and have reexamined their practices and perhaps buttressed or supplemented their privacy policies accordingly."
© 2022 The Seattle Times. Distributed by Tribune Content Agency, LLC.
