Artificial intelligence is helping legal teams identify where consumer data is at risk, exposing how companies buy and sell personal information without consent.
The changing nature of data privacy lawsuits
Historically, data privacy litigation focused on website owners who collected personal details like browsing history and location without permission. Courts increasingly view intercepting this consumer behavior data without proper consent as a potential wiretap violation. These trackers shape how individuals experience the internet by allowing third parties to customize advertising and other online experiences based on user interests.
A new category of cases is emerging for firms seeking to protect consumer data. Instead of targeting tech giants like Google and Facebook, plaintiffs are bringing claims against organizations whose trackers collect consumer information in the background and profit from it. These entities are typically registered data brokers operating within the real-time bidding infrastructure, which precisely targets ads to individual users based on collected information.
Congressional findings show the financial impact of poor data privacy protections. A recent committee report found that over the last decade, just four data breaches involving major brokers cost U.S. consumers more than $20 billion in losses related to identity theft. Darrow analyzed a subset of consumer data privacy class actions filed directly in federal courts in the first quarter of 2026 involving allegations of website-based tracking. Of the 128 cases identified, over 10 percent targeted advertising technology and data vendors directly rather than the website operators hosting the technology. Prior to 2026, cases advancing wiretap and pen register claims directly against these vendors were far less common.
These legal developments follow a pattern seen in the landmark Facebook litigation, where the U.S. Court of Appeals for the Ninth Circuit held in 2020 that users had standing for their privacy harms and that the company violated wiretap laws. Although that case was settled, the ruling helped shape dozens of subsequent cases across a wide range of sectors entering discovery. As litigation in this sector continues to grow, AI can be used to scan cases and identify potential patterns that could help legal teams more efficiently identify and mitigate areas of potential harm.
Cases setting precedent for data broker liability
Several recent cases and settlements are beginning to establish precedent for future privacy cases focused on actions by data brokers and ad tech vendors. In Riganian v. LiveRamp Holdings Inc. and Gilligan v. Experian Data Corp., the Northern District of California allowed plaintiffs’ claims to move forward based on allegations that the companies’ practices of monitoring and collecting data on users’ web browsing activity could violate wiretap laws. The courts rejected the argument that collecting data for profit, rather than for surveillance, was sufficient to avoid federal wiretap claims.
In Semien v. PubMatic Inc. and Krzyzek v. OpenX Technologies, Inc., the Northern District of California found a privacy injury arising from the collection of IP addresses, device information, and URLs used to profile users. The court rejected defendants’ arguments that the “pseudonymization” of data precluded liability. These cases reinforce that programmatic advertising vendors may be held liable under both wiretap and California Invasion of Privacy Act pen-register laws for the type of tracking and identity-resolution conduct.
Public marketing materials from data brokers and other adtech vendors are rife with claims about the types of data they collect. Legal teams can use AI to analyze tracking behavior across websites and flag inconsistencies between actual practices and privacy policies, as well as discrepancies between the data broker’s privacy policy and the website’s privacy policy where it collects data. Oracle agreed to pay $115 million in 2024 to settle a lawsuit alleging that the company sold consumer profiles containing a wide range of personal information to marketers directly and through an Oracle product that helps companies personalize their online marketing.
The Federal Trade Commission will closely watch data broker Kochava after they reached a settlement requiring the company to revise how it collects, uses, discloses, and disposes of user location data following the resolution of a class action lawsuit over its disclosure of location data from sensitive venues, including health care facilities, jails, and schools. Kochava agreed to a class settlement in 2025 providing injunctive relief and approximately $1.5 million in attorneys’ fees and expenses, saying it lacked sufficient funds and insurance coverage to pay significant class-wide damages.
Read Also: Boardroom Teams Tackle Crisis as Alarm Sounds
Barriers to bringing claims forward
Despite the growing number of data broker and adtech vendor privacy claims, there are several hurdles to bringing forward these claims, from clearly defining the class to proving harm on technology platforms that are constantly changing. Identifying the specific intermediaries that buy and sell consumer data collected on a given website can be challenging. Consider that in California alone, more than five hundred companies have registered with the state as data brokers—a figure that likely does not capture all the companies processing consumer data across the United States.
Because these companies operate in the background, data privacy advocates have historically lacked visibility into the volume and type of consumer data they have accessed. Even when that information is known, classes can be difficult to define if class members used numerous websites with these hidden tracking technologies at different points in time. However, technical analysis used in discovery can help ascertain class members and provide the basis for defining common classes with similar privacy harms.
Another hurdle involves proving harm or consent. Different legal theories exist about what counts as a privacy harm and what level of consent is required when being tracked online. A recent decision from the Northern District of California, In re Meta Android Privacy Litigation, highlights two competing theories of consent. Broad consent posits that if an app or website’s privacy policy discloses the collection and sharing of users’ data, even in general terms, then acceptance of that policy counts as consent to having their information tracked and shared.
Under this theory, reasonable users would understand that their online data is generally being collected. Narrow consent holds that users must be informed of the specific ways in which their information is tracked and shared, meaning they can agree to some usage but not others—particularly if those others rely on technical architecture that a user would not reasonably be expected to understand. Whether a reasonable user would understand and consent to the collection would be determined based on the specific context.
Using AI to map digital exposures
With the arrival of AI, identification of data privacy violations is shifting from reactive methods (in response to a data breach or government enforcement action) to proactive ones (by identifying where trackers are used and determining whether they comply with consent laws). The emergence of AI is allowing legal teams to identify and address potential harm more quickly, enabling them to map their digital exposures and make changes to swiftly mitigate their organization’s risk or take steps to secure remedies for consumers.
Legal teams can use AI to review public disclosures, such as government contracting data, to identify arrangements with data brokers that suggest improper data collection and use. Companies should pay attention to these signals and look for similar agreements that might be putting them at risk. Growing awareness of data brokers’ reach stemming from government use of consumer data—for example, ICE using Medicaid data via a Palantir-created tool for immigration enforcement—is prompting consumers to reassess their comfort level with how their data is used and may make them more open to participating in class actions.
AI enables legal teams to track data brokers’ behavior at scale and better understand what data is being collected, where, and when. Organizations that collect consumer data must handle a growing patchwork of compliance rules, as many states have passed laws in recent years. States such as California with stricter privacy laws are also frequent venues for federal class action litigation.
At the same time, privacy advocates will likely continue to unearth privacy violations caused by data brokers at scale. With this new depth of insight, legal teams have the clarity and foresight needed to flag and address signals of data privacy risk to not only protect consumer data today but also shape how consumer data is tracked and shared online for decades to come.
