Twilio is being sued for allegedly using its Segment SDK software to collect data without customer consent.
The case, which was filed in federal court in San Francisco, claims that Twilio’s solution violates America's Wiretap Act, the California Wiretap Act, and California's Comprehensive Computer Data Access and Fraud Act (CDAFA).
Segment SDK is used by mobile apps to collect and analyze user data. However, the lawsuit alleges that Twilio’s tool has been “surreptitiously” accessing and harvesting information outside of this remit, including search terms, keystrokes, search results, button and menu interactions, and requested pages.
Indeed, the official complaint states as follows:
Twilio surreptitiously collects sensitive data from consumers through its SDK in real-time.
“Twilio collects identity information such as the consumer’s name and email address, mobile advertising IDs (MAIDs), the mobile app name, and device fingerprint data (which includes the consumer’s device make and model, operating system version, and cell phone carrier name among other information).”
Keeping Calm
The specific application referenced in the suit is the meditation and sleep app, Calm, which reportedly currently has 4.5 million users and has been downloaded by over 100 million people.
The fact that Calm is an app targeted at providing users with mental-health support was also discussed in the complaint, with the lawsuit arguing that this made the data that Twilio was accessing “incredibly sensitive,” as it involved areas such as stress, anxiety, and depression.
While Calm’s privacy policy does mention extensive data collection and sharing, it does not specify Twilio or its Segment SDK software.
"The problem with Twilio is that consumers do not know that by interacting with an app which has embedded the Segment SDK that their sensitive data is being surreptitiously siphoned off by an unknown third party," the complaint claims.
Consumers are never informed about the Segment SDK being embedded into the app, they never consent to Twilio’s data collection practices, nor are they allowed to opt-in or opt-out of Twilio’s data collection practices – if they even know who or what Twilio and Segment are.
A Litigious Trend
The Twilio/Calm case echoes another recent California lawsuit involving Talkdesk and Patagonia, where again, customer consent was at the heart of the issue.
In mid-July Patagonia was accused of violating California privacy law by recording and analyzing customer communications without permission.
The company used Talkdesk's CCaaS services to manage customer interactions, with the lawsuit claimed that Talkdesk intercepted, recorded, and analyzed all communications between Patagonia and its customers.
The recorded information was accessible to Patagonia and was sent in real-time to Talkdesk's servers, where it was transcribed and analyzed by AI for insights into customer queries and emotions.
