Popular Retailers Accused Of Using AI To Illegally Record Customers

Can chatbots keep a secret? That’s the question at the heart of a California class action lawsuit against Old Navy alleging the clothing retailer recorded the actions of visitors to its website and shared them with a third party.

The case is one of at least 100 lawsuits in the state targeting businesses such as Home Depot, JCPenney, Ford and General Motors, according to reports.

“When I first learned about this, I thought chatbots were so innocuous, who cares?” Robert Tauler, who has filed multiple lawsuits and believes such data can be exploited commercially, told Reuters. “But the technology is staggering.”

The Old Navy complaint, filed in 2022, details how plaintiff Miguel Licea communicated with what he believed to be a customer service representative but what was actually a sophisticated chatbot.

“That program convincingly impersonates an actual human that encourages consumers to share their personal information,” the complaint said.

The San Francisco-based company also used monitoring software to secretly intercept and record keystrokes and mouse clicks without informing visitors or seeking their consent, according to the complaint. The retailer recorded website visits via a replay program that captured a video reproduction of the user’s experience, the document said.

The chatbot and replay technology were both created by third-party providers with whom Old Navy regularly shares its website communications for storage and data harvesting, according to the complaint.

In April, Judge Sunshine Sykes dismissed Licea’s argument that Old Navy wiretapped website visitors because one participant in a conversation — the retailer — cannot wiretap another — the visitor — under the California Invasion of Privacy Act, according to a court order.

Sykes also dismissed with leave to amend Licea’s case that Old Navy aided and abetted at least one third party in eavesdropping, calling for proof that the third party recorded information for any use beyond giving it back to the retailer, the order said.

The judge did allow for a claim under a different section of the act that website visitors had a reasonable expectation of privacy and rejected an argument from Old Navy that Licea had consented to any recording, according to the order.

Old Navy's parent company, Gap, did not immediately respond to a request for comment Wednesday.

“When it comes to regulations about AI, and online interactions more generally, the U.S. is behind Europe and Canada, a fact highlighted by the Old Navy lawsuit,” according to a recent report from CNBC. “It’s based on a wiretapping law from the 1960s when the chief concern was potential privacy violations over rotary phones.”

California did recently pass the Delete Act, allowing residents to ask data brokers in a single request to delete their personal information and forbid it from being sold or shared, CNBC reported, adding state authorities must determine how to facilitate the act by 2026.

But it’s not clear if companies can delete information, since large language models are unable to modify training data, according to CNBC.

“You know it’s a robot," Matthew Kenefick, who represents clients in chatbot privacy claims, told Reuters. "Do you really have an expectation of privacy?”