2023 hasn’t been a great year for Adobe. Well, it has. They’ve had a lot of successes, including the release of the Firefly 2 engine. But they’ve also faced challenges, including patent infringement, an FTC investigation and the death of a co-founder.
Their latest is a Dutch privacy watchdog suing them. The Dutch Data Protection Foundation (SDBN) has accused them of selling private customer data of approximately 7 million Dutch users.
Adobe collecting data on millions, lawsuit says
The Netherlands has a population of around 17.5 million people. According to VPN Overview, the SDBN claims around 7 million of them have been illegally tracked by Adobe. But that’s not all they’re saying. They say that Adobe has sold these people’s private data to a number of third parties.
The SDBN alleges that Adobe collects data about Dutch internet users. It uses various technologies, including cookies and code embedded into various popular apps and websites. These websites don’t even appear to be Adobe-owned websites, either. The SDBN includes the Dutch Tax Authority as one of the websites collecting this data.
They say that Adobe does this through its Audience Manager platform. This is part of the Adobe Experience Cloud. Adobe calls this a marketing tool. The SDBN says it “allows companies to create profiles of internet users”.
While Adobe is primarily recognized as a design software supplier, what’s surprising is its simultaneous involvement in the digital personal data market – tracking your online activities
Anouk Ruhaak, SDBN Chair
Collecting data on non-Adobe customers
The SDBN says that Adobe has tracking cookies spread across popular Dutch websites. These are activated when users visit these sites and blindly click on the “Accept All” button – as most of us tend to do these days. The SDBN alleges that Adobe does this, however, even for users who don’t provide consent.
They say that Adobe collects data “on virtually every Dutch internet user, irrespective of whether they have ever used an Adobe product”. They even claim that Adobe creates these tracking cookies before you’ve even had the opportunity to click the accept button for cookies.
It’s not just on the web
Adobe maintains several Software Development Kits (SDKs) that allow developers to incorporate Adobe’s technology into their apps. According to the SDBN, these SDKs automatically track the habits of users running the apps that utilise them.
This is done via tens of thousands of websites and apps, including websites that many Dutch people regularly visit (such as TUI,beterhoren.nl and Douglas) and popular apps (such as Marktplaats, Buienradar and Bol.com)
The above statement is from an article on the SDBN website. It goes on to say that after collecting all this data, it uses it to create detailed profiles of individual users. These profiles are then sold on to commercial parties.
The lawsuit
If true, this violates the GDPR, as SDBN rightly says. So, they’re taking Adobe to court. They are demanding that Adobe immediately stop illegally collecting data on Dutch citizens and delete any existing data they already have.
They also expect Adobe to pay compensation for profits earned on the sale of illegally obtained users data, to be split amongst Dutch internet users registered with the SDBN. They estimate that at least seven million Dutch users have been affected.
They don’t expect a ruling to happen any time soon, though. Their earliest estimates say that a result won’t come until 2027 at the earliest. Of course, it may be a lot sooner if Adobe has any say in things.
Registration with the SDBN to be included in the suit and potentially receive compensation if they win is free.
Adobe denies the claims
In a statement to PetaPixel, Adobe has denied the claims by the SDBN – which has also sued both Twitter/X (after Musk got his hands on it) and Amazon over similar privacy issues. The statement from Adobe, published to PetaPixel, reads:
Contrary to the claims, Adobe is not a ‘data controller’ when providing services to our Experience Cloud customers. Adobe is a processor of data collected by customers. This means the customer is the data controller and as such, decides which cookies to deploy, what data to collect, what uses to put that data to, and determines what consent to collect from visitors to its own websites. As a data processor, Adobe enables its customers to make these decisions within Adobe Experience Platform, part of Adobe Experience Cloud. Adobe does not sell or distribute our customers’ data and provides integrations to consent management tools to help customers implement consent management on their sites as they deem legally necessary based on the countries they operate in.
I can’t say whether the SDBN has any legitimate claims with Adobe, Twitter/X, Amazon, or anybody else they set in their sights. However, it does come across like they’re throwing a lot of stuff at the wall and seeing what sticks, hoping at least one of them will prove out.
That being said, it wouldn’t surprise me if there’s at least some truth in one or more of their lawsuits.
[via VPNOverview]
