Ulta Illegally Tracks Website Visitors Using ‘Spyware,’ Class Action Alleges

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims Ulta Salon, Cosmetics & Fragrance, Inc. uses “session replay” software to record website visitors’ interactions without their knowledge or consent.

The 21-page lawsuit alleges Ulta has violated the Federal Wiretap Act and the California Invasion of Privacy Act by secretly recording the electronic communications of anyone who visits Ulta.com. According to the case, Ulta has embedded session replay “spyware” within its website code, allowing it to track consumers’ mouse and scroll movements; clicks; keystrokes; search items; copy and paste actions; information inputted into the website; and pages and content viewed.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The suit contends that the software, which Ulta received from a third-party provider, lets the company view each browsing session in real-time, as if the retailer were looking over the consumer’s shoulder. Ulta uses the data it collects to create a detailed profile of each visitor to the site, the complaint alleges.

Although session replay technology is typically used to identify broken website features, “the extent and detail” of consumer data collected by Ulta go far beyond the software’s legitimate purpose, the case contends. Instead, the lawsuit alleges, companies like Ulta deploy the spyware to access an “unprecedented goldmine of digital data” that can be used for “the interpretation of human behavior online and shaping a future of addictive customer experiences,” according to one industry expert.

The case claims that consumers reasonably expect their visits to Ulta.com to be private, especially since the company’s website fails to present a pop-up disclosure or consent form notifying users that it monitors their communications.

“Moreover, the collection and storage of page content may cause sensitive information and other personal information displayed on a page to [leak] to third parties,” the case adds. “This may expose website visitors to identity theft, online scams, and other unwanted behavior.”

The lawsuit looks to represent anyone in the United States whose communications were intercepted by Ulta Salon, Cosmetics & Fragrance, Inc. or its agents.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.