Noom Website Trackers Breach California Privacy Law, Class Action Lawsuit Claims

The weight loss plan website Noom and a partnering software company are facing a class action lawsuit for allegedly tracking customers without permission through its website. 

Plaintiffs in a class action lawsuit are claiming digital trackers, made by FullStory Inc. and embedded into the Noom website, are violating California privacy laws. 

The Noom website promises weight loss and takes visitors through a screening process that includes filling out personal details, plaintiffs allege. 

Noom website visitors are directed to fill out their height, weight, age and other medical conditions as part of this screening process, according to the filing.

The class action lawsuit says Noom partners with FullStory, a marketing analytics company that provides software as a service, to catalogue and track customers with this data.

The two named plaintiffs in the filing, California residents Audra Graham and Stacy Moise, describe these breaches of California privacy law on the Noom website as “wiretaps.”

These “wiretaps” are “embedded in the computer code on the Website” and  “are used by Defendants to secretly observe and record website visitors’ keystrokes, mouse clicks, and other electronic communications, including the entry of Personally Identifiable Information,” the class action lawsuit claims. 

Plaintiffs point specifically to a feature FullStory offers its clients known as “Session Replay” in court documents. These “snippets of code” allow the Noom website to watch “mouse movements, clicks, typing, scrolling, swiping” and “tapping” of customers “live” as they happen. 

FullStory’s promotional material on their “Session Replay” feature is cited in the class action lawsuit, describing a hypothetical user named Daniel “flipping through” online content. “Notice how you can see interactions, mouse movements, clicks, interactions with overlays, and more,” FullStory touts in one video. 

“Crucially, … Noom does not ask users, including Plaintiffs, whether they consent to being wiretapped by FullStory. Users are never actively told that their electronic communications are being wiretapped by FullStory,” the plaintiffs said. 

The class action lawsuit argues privacy policies on the Noom website aren’t given until after the information was obtained and are not prominently displayed in a way that is self-evident. 

“Users are never given the option to accept the Privacy Policy by clicking a button, are told that by clicking ‘See My Result,’ they accept the Privacy Policy, or are otherwise told how to accept the Privacy Policy,” according to court documents. 

“The hyperlink to the Privacy Policy is in the smallest text on the screen, not underlined, is not the typical color for a hyperlink, is not in all caps, and is surrounded by much more obvious and distracting features,” the plaintiffs added. 

Furthermore, customers are never advised of the “Session Replay” recording in those links, so the full scope of the captured data is not disclosed, the class action lawsuit alleges. 

Even more, the plaintiffs contend this kind of information collecting without consumers knowing is “dangerous.” 

Graham and Moise cite a 2017 Princeton University study that found these types of “session replays” use “insecure practices” leaving passwords and credit cards “vulnerable to data leaks.” 

These so-called wiretaps, also known as digital trackers, exist on at least 87% of the internet’s domains, according to Markup, a non-profit watchdog group. 

So-called “session replays,” also known as “session recorders,” exist on an estimated 15% of all websites online, according to The Washington Post. 

“I think this is just a reflection of how business operates when it goes unchecked,” Blacklight founder Surya Mattu told The Washington Post. “I don’t think there is some super-evil person sitting somewhere trying to collect everyone’s information. There is economic incentive for having this data, and over the last 15 years that incentive has only increased.”

California’s Assembly passed the first laws protecting consumer privacy in 1967 that have since expanded to include aspects of video and audio recordings. 

The plaintiffs are seeking “to represent a [C]lass of all California residents who visited Noom.com.”

Formally, the class action lawsuit is accusing Noom and FullStory with violations of California’s Privacy Act and California’s Constitution. The plaintiffs are seeking compensatory, punitive and statutory damages as well as injunctive relief. 

Are you a resident of California who has used the Noom website? Let us know in the comments below. 

Counsel representing the plaintiffs in this class action lawsuit are L. Timothy Fisher and Joel D. Smith of Bursor & Fisher, P.A.

The Noom Website California Privacy Law Class Action Lawsuit is Graham, et al. v. Noom Inc., et al., Case No. 3:20-cv-06903-LB, in the U.S. District Court for the Northern District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

173 Catholic Priests Have Been Named in Western New York Child Victims Act Lawsuits

What Are the Zantac Side Effects?

Cars.com Class Action Lawsuit Alleges Violation of California Privacy Law, Secretly Records Visitors

Google Says Class Action Lawsuit Plaintiffs Consented to Data Collection