CVS class action alleges retailer allows third parties to access mobile app communications

CVS class action overview: 

• Who: Two California residents are suing CVS.
• Why: The plaintiffs claim the company secretly intercepted their communications through its mobile app.
• Where: The class action was filed in a California federal court.

Two California residents have slapped CVS with a class action lawsuit alleging the pharmacy chain secretly wiretapped its customers’ communications while they were using its mobile app.

Plaintiffs Ariel Brooks and Nora Borowsky filed the class action complaint against CVS Health Corp. and its subsidiary CVS Pharmacy on Dec. 12 in a California federal court. 

The plaintiffs accuse CVS of using a third-party software service, Quantum Metric Inc., to intercept sensitive user data, violating California’s Invasion of Privacy Act. 

CVS used session replay tech to monitor customers, lawsuit claims

The lawsuit alleges that CVS used Quantum Metric’s session replay technology to monitor app users’ interactions in real-time. 

This tool captured detailed information, including users’ names, addresses, email addresses and even prescription details, without their consent, the CVS app lawsuit alleges.

Brooks, who accessed the CVS app on her Android device in October 2024, claims her private data was intercepted as she browsed over-the-counter medications and refilled prescriptions. 

Borowsky, who has used the app on her iPhone for five years, claims the company did the same to her during a November 2024 session. Both plaintiffs were unaware their interactions were being recorded and transmitted.

Quantum Metric’s software, which includes a session replay function, allows companies to analyze user behavior by capturing their digital interactions down to clicks, keystrokes, and screen views, the lawsuit states. The plaintiffs argue that this technology effectively acts as real-time surveillance.

According to the lawsuit, the system captures user data “at hyper-frequent intervals, often just milliseconds apart,” creating a seamless video-like reproduction of a user’s app session. The plaintiffs allege this level of data capture constitutes illegal wiretapping under California law.

As a result, the plaintiffs seek to represent a class of California Android users and a class of California iOS users whose electronic communications were intercepted while they were logged into their CVS app accounts.

They are suing for violations of the California Invasion of Privacy Act and seek certification of the class action, damages, fees, costs and a jury trial.

This complaint comes after another class action lawsuit filed in November that alleges CVS Pharmacy falsely advertises its acetaminophen PM products as non-habit-forming.

What do you think of the allegations in this CVS class action? Let us know in the comments. 

The plaintiffs are represented by L. Timothy Fisher at Bursor & Fisher P.A.

The CVS class action is Ariel Brooks et al. v. CVS Health Corporation et al., Case No. Case 4:24-cv-08990 in the U.S. District Court for the Northern District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

• Photobucket class action claims company wants to sell customer images
• MasterClass class action claims company shares customer data with third parties
• Parent files TikTok class action over collection, sale of children’s data
• AT&T class action claims provider spams non-account holders