GameStop "wiretapped" customers without consent, claims lawsuit

Cal Jeffrey

Posts: 3,668   +1,129
Staff member
Editor's take: If it wasn't stupid enough that GameStop dove headfirst into the NFT and crypto market right before the bubble burst, hang on for a second — the company wants you to hold its beer. It is now being sued for recording customer service chats without consent and selling transcripts to a marketing firm.

GameStop is getting sued over privacy violations in California. According to a lawsuit filed Tuesday with the US Central District Court of California, the company has been "wiretapping" online customer service chats and selling the transcripts to a third-party marketing firm. This practice is not uncommon, but most companies make it clear that they are recording calls or chats, something GameStop failed to do.

The filing, obtained by Bloomberg, lists Miguel A. Licea as the plaintiff. According to Mr. Licea's lawyers, GameStop's customer service chat feature does not inform or gain consent to use customer conversations for marketing or any other reason.

"[Customer Support] covertly wiretaps the communications of all visitors who utilize [its] chat feature and shares the secret transcripts of those wiretaps with a third party that boasts of its ability to harvest personal data from the transcripts for marketing and other purposes," the suit reads, adding, "Defendant neither informs visitors nor obtains their prior, express consent to these intrusions."

Most people in the US are accustomed to companies regularly recording conversations "for quality assurance and training purposes." Some even offer customers to opt out of the recording. The rules and regulations can vary from state to state regarding what is allowed to be recorded and shared and how much say the consumer has in the process.

Califonia is one of the stricter states regarding privacy and recording without consent. Recently, California has enacted several privacy laws specifically targeting online communications. However, the suit claims GameStop violates Califonia's long-established Invasion of Privacy Act (IPA) of 1967.

Under IPA protections, recording someone without their consent and knowledge is illegal. This provision used to only apply to telephone communications or on-body recorders. However, the California legislature extended protection to "social media" in 2017 (CA Penal Code: Part 1, Title 15, Chapter 1.5 Section 632.01). Under the law, social media covers almost all online communications, "including, but not limited to, videos or still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles."

"Defendant's conduct is both illegal and offensive."

Licea's legal team paints an even uglier picture by pointing out that GameStop sells these "secret" transcripts to a company called Zendesk. Zendesk prides itself on "its ability to harvest highly personal data from chat transcripts for sales and marketing purposes."

The plaintiff's legal team calls GameStop's actions "illegal and offensive."

The complaint does not list specific damages, but the IPA allows for one year in jail and/or a $2,500 fine in criminal cases. However, civil courts can access $5,000 or three times the amount of actual damages per "wiretap," whichever is greater.

GameStop has not commented on the lawsuit.

Permalink to story.

 

psycros

Posts: 4,465   +6,661
Always say 'no' to being recorded. If they don't ask you about it, ask THEM if you're being recorded. Don't install apps from any company that wants to sell you something. If nothing else give the spies fake info. Do all you can to make data scraping unprofitable.
 

Endymio

Posts: 1,838   +1,909
Talk about gaslighting. Calling the retention of an online chat transcript to be "illegal wiretapping" is ludicrous. If you send text messages to a company in *any* format, any reasonable person assumes they're being retained in some manner -- companies are, in fact, legally *required* to retain all communications pertaining to certain matters.

And while this article points out that CA Penal Code 632 was extended to social media, it does so only for "confidential" communications; ones that no one would expect to be retained. A text chat message is no more "confidential" than are emails, which are retained automatically. By the logic of this lawsuit, if I myself screenshot the dialog from any company's chat system, I'm liable to do prison time.

Now, there may (or may not) be a secondary issue with the sale of this information. But that's a side issue, and certainly isn't a criminal matter.
 

ZedRM

Posts: 1,363   +946
While the NFT & Crypto things were stupid, I have side with GameStop on this one. People engaging in communications with a company should not consider those communications private unless they contain uniquely personal info, which most do not. GameStop is required by law to keep names, addresses and CC info private. Incidental communications are not covered by those laws. So even if GameStop didn't warn as such, they still have done no wrong.
 
Last edited:

Strontium

Posts: 9   +18
Talk about gaslighting. Calling the retention of an online chat transcript to be "illegal wiretapping" is ludicrous. If you send text messages to a company in *any* format, any reasonable person assumes they're being retained in some manner -- companies are, in fact, legally *required* to retain all communications pertaining to certain matters.

And while this article points out that CA Penal Code 632 was extended to social media, it does so only for "confidential" communications; ones that no one would expect to be retained. A text chat message is no more "confidential" than are emails, which are retained automatically. By the logic of this lawsuit, if I myself screenshot the dialog from any company's chat system, I'm liable to do prison time.

Now, there may (or may not) be a secondary issue with the sale of this information. But that's a side issue, and certainly isn't a criminal matter.

Also, at this point, this is still just an accusation. No proof has been presented (at least as far as this article).

I love how an accusation is pretty much a presumption of guilt, these days...
 
Last edited:

Cal Jeffrey

Posts: 3,668   +1,129
Staff member
While the NFT & Crypto things were stupid, I have side with GameStop on this one. People engaging in communications with a companie should not consider those communication private unless they contain personal info, which most do not. GameStop is required by law to keep names, addresses and CC info private. Incidental communications are not covered by those laws. So even if GameStop didn't warn as such, they still have done no wrong.
The lawyers that filed the complaint do mention that GameStop's CS transcripts included their client's private information.
 

ZedRM

Posts: 1,363   +946
The lawyers that filed the complaint do mention that GameStop's CS transcripts included their client's private information.
It'll depend on what info was distributed as to whether there is actual validity to the plaintiffs claims. Names are generally public info and not protected. Addresses/emails/phone can be protected but again, are generally public info. Uniquely personal data is what is protected and I greatly doubt GameStop shared/sold that kind of info, that's if they even had possession of such info to begin with.

See Edit...
 

brucek

Posts: 1,298   +1,928
Anyone have a link to the full legal filing(s)? Or the Zendesk product/service that is being referred to here (I don't see it on their front page?)

Legalities aside, I'm pretty curious what extra value this analysis service is claiming to deliver above the full GameStop customer list, the sale or rental of which would hardly be new. Do they occasionally hear a customer say "oh I have to feed the cat" so they note the customer is a cat owner too?
 

Bobbydpue

Posts: 394   +263
Lawsuit being filed doesn't mean the other party is automatically guilty. All the comments assuming what the lawsuit is claiming is accurate without any data other than what the lawsuit is claiming.