Ad Tracking Lawsuits Allege Illegal Surveillance of Internet Users by Microsoft, Others

Tech giant and other companies use advertising pixels to illegally track and record web browsing activities of millions of Americans, lawsuits claim.

Several recently filed lawsuits raise allegations that Microsoft and other tech companies are using advertising pixels to unlawfully collect internet data on millions of Americans, including their browsing histories and other private information.

Pixels are pieces of computer code that can be used on a website to track the actions people take when they visit that site. They work by sending data back to the company that placed the pixel, such as what pages were viewed, how long the user stayed, or what was clicked. While originally intended for basic analytics and advertising purposes, these pixels can be engineered to collect far more detailed data. 

These recent ad tracking lawsuits claim that Microsoft and other internet advertising companies allow their pixels to interact with pixels on separate partner sites, providing the companies with additional information about users’ web browsing behaviors, including private information that the users may enter into certain websites.

As a result of the way these pixels are allegedly used, plaintiffs claim that Microsoft and other companies can track individuals across multiple websites and gain access to sensitive personal information entered by users, often without their knowledge or consent.

Lawsuits Claim Microsoft Tracks Users Across the Internet

In a complaint (PDF) brought earlier this month in the U.S. District Court for the Western District of Washington, Stacy Penning and a group of five other plaintiffs present claims against Microsoft Corporation, as the sole defendant.

Penning claims in the lawsuit that when he visited the BuzzFeed website in December 2024, hidden Microsoft Adnxs pixels embedded on the site placed multiple tracking cookies in his web browser without his knowledge.

The Adnxs Pixel is Microsoft’s tracking tool that website developers can embed into their pages to monitor user activity. When activated, it can place cookies, which are small files stored on a user’s device to track and remember information such as browsing behavior, login details or preferences.

Penning claims the pixels installed by the Microsoft software on his computer then recorded the web pages he visited, as well as his IP address, and other information about his device and browser. In addition, with the help of Microsoft’s real-time advertising platform, Xandr, these pixels shared that information with dozens of partner pixels across the internet, according to the complaint.

Xandr, previously called AppNexus, is Microsoft’s real-time bidding platform for advertising, providing a suite of products, which offers Microsoft’s clients data management and analytics tools, as well as the ability to buy and sell digital ad space.

Penning indicates that he did not consent to having his browsing habits tracked and recorded in this way, and that there was no opportunity given him to consent to these actions.

“Through its advertising and analytics platform, Xandr, and its Adnxs Pixel, Microsoft tracks in real time and records indefinitely the personal information and specific web activity of hundreds of millions of Americans,” the complaint states. “This unlawfully collected information is worth billions of dollars to Defendant because it makes up the content of Microsoft’s extensive line of data analysis products and creates individual sales of advertisements in the real-time-bidding ecosystem present on thousands of major websites.”

Penning and his co-plaintiffs are raising allegations of intrusion upon seclusion and unjust enrichment, as well as various violations of the California Invasion of Privacy Act and violations of the U.S. Electronic Communications Privacy Act against Microsoft.

They are asking for compensatory, punitive and statutory damages for themselves and others similarly situated while seeking certification of their complaint as a class action, with a special subclass for California residents.

Pubmatic Data Broker Lawsuit

In addition to the Microsoft complaint, similar lawsuits have also been filed in federal courts across the country against other internet advertising companies.

A complaint (PDF) filed by Kirstie Semien, Michale Selby, Gilbert Gaw, Logan Mitchell and Jane Doe in the U.S. District Court for Northern California on April 8, names Pubmatic, Inc. as the defendant, and raises similar allegations against that organization. 

According to Semien’s complaint, Pubmatic is a “data broker,” who engages in the business of collecting individuals’ online information and then selling that information to third parties.

Similar to Microsoft’s Adnxs Pixel service, Semien claims that Pubmatic’s OpenWrap software development kit enables its pixels to communicate with pixels on dozens of other websites. This design allegedly allows Pubmatic to gather and share a wide range of user data, including demographics, geolocation, and sensitive personal details, such as health information, political views, and sexual orientation, even if that information was entered on unrelated websites.

Semien and her co-plaintiffs raise allegations of intrusion upon seclusion, violations of the California Invasion of Privacy Act, unjust enrichment and violation of the Electronic Communications Privacy Act against Pubmatic.

They are seeking compensatory, punitive and statutory damages, and asking for certification of their complaint as a class action.