The Irish Council for Civil Liberties (ICCL) has announced its intention to file a class action lawsuit against technology giant Microsoft in the High Court today, accusing the company of breaching users’ privacy through its real-time bidding (RTB) advertising system.
The case is being brought under the EU’s new Collective Redress Directive, which allows civil society organisations to represent groups of individuals in legal actions over breaches of EU law.
RTB is a digital advertising process where advertising space is auctioned in milliseconds as users navigate websites and apps. The ICCL claims that this system involves the widespread sharing of sensitive personal data without users’ knowledge or consent, in violation of European data protection laws.
According to the ICCL, Microsoft’s RTB system operates covertly across the web and mobile apps, collecting and distributing detailed user profiles to advertisers in real time. These profiles, the organisation alleges, can include deeply personal information such as users’ financial situations, health concerns, political affiliations, and relationship status.
“People’s intimate secrets such as their relationship, work, and financial status are broadcast by Microsoft into the real-time bidding advertising system,” said Dr Johnny Ryan, Director of the ICCL’s Enforce unit, who is leading the legal action.
“That system is a black hole of data open to any malicious actor and represents a huge data breach of millions of people’s information,” he added.
The ICCL is seeking to represent all affected individuals in Ireland, arguing that the widespread nature of RTB technology means the personal data of millions may have been exposed.
Microsoft responded to the announcement by stating that it intends to address the ICCL’s filing through the appropriate legal channels. A spokesperson said the company would review the case and respond accordingly but did not provide further comment on the allegations.
This is the first time a class action of this nature has been initiated under the EU’s new collective redress rules in Ireland. If successful, the case could set a precedent for how large technology companies are held accountable for data handling practices under EU law.
The ICCL has long criticised RTB practices, describing the advertising industry’s data sharing mechanisms as opaque and incompatible with the EU’s General Data Protection Regulation (GDPR). Today’s filing marks a significant escalation in the group’s campaign for greater accountability in the online ad ecosystem.
