Application for class action against insurance companies, banks, and credit card companies alleging covert tracking of customers via email

Applications for approval of class actions were filed against the insurance companies Menora Mivtachim, The Phoenix, and Clal Insurance, and against banks and credit card companies, alleging covert tracking of email recipients using tracking pixels and tracking links embedded in messages on their behalf. In the application to the Tel Aviv District Court, it was stated that examinations identified Click tracking and Open tracking mechanisms in the messages. These mechanisms make it possible to measure message loading and clicks on links, and to associate these events with a mailing record or a specific recipient. These mechanisms may also enable the collection of information regarding opening times and frequency, IP, estimated location, device type, and usage environment. The applications state that commercial mailing systems offer tracking capabilities, including classifying recipients according to opening messages (or not opening them), clicks on links (or lack thereof), and using information for segmentation, personalization, and tailoring of messages. One of the mailing providers even describes this in the words “Spy on your subscribes”. It is alleged that sending the email message and tracking its use are technologically separate actions, and the former can be carried out without the latter. According to the applicants, processing personal information that is not required for sending emails gives rise to three separate and cumulative duties: The duty of notification – to provide the recipient with clear information regarding the tracking, the types of information collected, the purposes of use, and the identity of the entities processing it. The duty of informed consent – to obtain informed consent of free will for activating the tracking and for its purposes, instead of relying on general consent to receive marketing mailings. The duty of revoking consent – to allow the recipient to refuse tracking, to change preferences, or to revoke consent, while continuing to receive email messages. In this matter, the applicants emphasize that the mere provision of an email address, registration for mailing, opening a message, or clicking a link do not constitute consent to tracking its use. According to the applicants, the findings regarding the respondents indicate covert tracking, without the customers’ knowledge and consent. The respondents’ privacy policies do not clearly disclose the monitoring of openings and clicks at the recipient level. In the messages examined, no disclosure or possibility of stopping the tracking while continuing to receive messages was found. According to the applicants, activating tracking by default, without active action on the part of the recipient and without the possibility of refusing it or stopping it, illustrates the use of dark design patterns. The severity of the matters is amplified given the status of banks and insurance companies as financial corporations holding sensitive personal and economic information, and the power gaps between them and their customers. In the application to the court, it was stated that the described practice establishes causes of action under the Protection of Privacy Law, contract law, and tort law, and breaches the heightened duties of disclosure, fairness, fiduciary duty, and good faith applicable to the respondents. Therefore, the court is requested to order them to cease operating tracking without lawful notification and consent, and to allow consenting to tracking, refusing it, and revoking consent that was given. Clal Insurance and Finance stated: “The application has not yet been received by the company. When received, we will study it and respond through the customary judicial instances.” Menora and The Phoenix did not respond.