Oracle America, Inc., the Austin, Texas-based database and cloud computing giant, secretly built detailed digital dossiers on an estimated 220 million U.S. residents and sold that data to advertisers without consent. That is the core allegation in Katz-Lacabe et al. v. Oracle America, Inc., a class action filed in August 2022 in the U.S. District Court for the Northern District of California. Oracle denied wrongdoing throughout the litigation.
The case settled in July 2024 for $115 million — one of the largest consumer data privacy settlements in U.S. history. U.S. District Judge Richard Seeborg granted final approval on November 15, 2024. Two objectors appealed. A three-judge panel of the Ninth Circuit Court of Appeals affirmed the settlement on February 13, 2026, and denied rehearing on April 1, 2026. The mandate was filed March 31, 2026. Payments to class members are pending as the settlement moves toward its effective date.
- What: Class action alleging Oracle illegally collected, compiled, and sold personal data on millions of Americans without consent
- Who: All U.S. residents whose data Oracle collected via its advertising technologies since August 19, 2018 — estimated 220 million people
- Status: Settled — $115 million fund approved; Ninth Circuit affirmed February 2026; payouts pending
- Injuries: Privacy violations, unauthorized data profiling, sale of personal information to third parties
- Settlement: $115 million total fund; pro rata distribution to valid claimants after attorney fees and costs
- Eligibility: U.S. residents whose personal data Oracle collected or sold via ID Graph, Data Marketplace, or any Oracle Advertising product from August 19, 2018 onward
- Key date: Claim deadline was October 17, 2024 — now closed; payments pending effective date
Oracle America Lawsuit Timeline and Updates
2014–2016 — Oracle Builds an Ad Tech Empire Through Acquisitions
Oracle assembled its advertising technology business through a series of acquisitions. In 2014, Oracle acquired BlueKai — a data management platform specializing in collecting and analyzing consumer data for targeted advertising. In 2016, Oracle acquired AddThis, a web tracking technology embedded in millions of websites worldwide.
These acquisitions gave Oracle the infrastructure to track users across the web, combine online behavioral data with offline purchase and location data, and sell that combined intelligence to marketers. The business had a name: Oracle Data Cloud. The products had reach few consumers understood.
August 2022 — Class Action Filed in Northern District of California
Privacy advocates Michael Katz-Lacabe, executive director of The Center for Human Rights and Privacy, and Dr. Jennifer Golbeck, a University of Maryland professor specializing in social media and privacy, filed a class action complaint against Oracle America in the U.S. District Court for the Northern District of California. Case number: 3:22-cv-04792-RS, assigned to Chief U.S. District Judge Richard Seeborg.
The complaint alleged Oracle tracked users across the internet using cookies, device identifiers, and embedded widgets, then combined that behavioral data with information purchased from outside data brokers. The result was a product Oracle internally called an “ID Graph” — a cross-device, cross-channel profile of real individuals, built without their knowledge or consent.
2022–2024 — Oracle Files Motions to Dismiss; Claims Narrowed
Oracle moved to dismiss multiple claims. The court largely allowed the litigation to proceed. The Electronic Communications Privacy Act claim was dismissed with prejudice in April 2024. Claims under California’s Constitution, California’s Invasion of Privacy Act (CIPA), the Florida Security of Communications Act (FSCA), and common law intrusion upon seclusion survived and moved toward trial.
Discovery was extensive. Oracle produced over 160,000 pages of documents and electronically stored information, plus approximately 173 hours of video recordings related to its data collection and monetization practices. Plaintiffs’ technical experts analyzed this material to build their case on how Oracle’s systems actually operated.
June 11, 2024 — Oracle Shuts Down Its Entire Ad Tech Business
Oracle announced on June 11, 2024, that it would exit the advertising technology business entirely. The company cited falling revenues as its reason. Industry observers and legal analysts noted the timing: the announcement came weeks before the lawsuit settled, and months after major regulatory and litigation pressure had mounted against data brokers across the United States and Europe.
The shutdown eliminated Oracle Data Cloud, ID Graph, and Data Marketplace — the precise products at the center of this lawsuit. No warning labels. No regulatory mandate. No congressional order. Oracle simply closed the operation.
July 19, 2024 — Oracle Agrees to $115 Million Settlement
Oracle agreed to a $115 million settlement on July 19, 2024. The settlement was filed as a preliminary agreement in San Francisco federal court and required judicial approval. Oracle denied all wrongdoing as part of the agreement.
The settlement fund was structured as non-reversionary: no portion would return to Oracle regardless of how many valid claims were submitted. After court-approved attorneys’ fees, administrative costs, and service awards, the remaining net fund would be distributed equally among all valid claimants on a pro rata basis.
August 2024 — Preliminary Approval and Class Notice
Judge Seeborg granted preliminary approval of the settlement on August 9, 2024. The settlement administrator, Angeion Group LLC, began notifying potential class members on August 29, 2024. Claim forms were made available online at KatzPrivacySettlement.com and by mail.
Class Counsel, the law firm Lieff Cabraser Heimann & Bernstein, LLP, requested attorneys’ fees of up to 25% of the settlement fund — up to $28.75 million — plus up to $225,000 in litigation expenses, and service awards of up to $10,000 each for the two named plaintiffs.
October 17, 2024 — Claim Deadline Closes
The deadline to submit a valid claim passed on October 17, 2024. Class members could file online or by mail. No additional proof was required: claimants attested under penalty of perjury that they resided in the U.S. during the relevant period and that Oracle collected their data without consent. The settlement administrator estimated claims rates of 1.5% to 2.5% of the total class — meaning the vast majority of the 220 million potentially affected Americans did not file.
November 15, 2024 — Final Approval Granted
Judge Seeborg held the final approval hearing on November 14, 2024 and granted final approval on November 15, 2024. One objector, Sarah Feldman, had challenged the settlement terms — arguing that the claims could have been worth up to $100 billion and that claimants from states with stronger privacy laws should receive larger shares than those from states with weaker ones. Seeborg overruled her objections and approved the equal distribution plan.
December 13, 2024 — Two Appeals Filed
Two appeals of the final approval order were filed on December 13, 2024. The appeals froze distribution. Settlement funds could not be released until all appeals were fully resolved. Claimants who had submitted valid claims entered a waiting period with no confirmed payout date.
February 13, 2026 — Ninth Circuit Affirms Settlement
A three-judge panel of the Ninth Circuit Court of Appeals, comprising Circuit Judges Gould, Friedland, and Miller, issued a memorandum disposition on February 13, 2026 affirming the settlement. The panel found that Judge Seeborg did not abuse his discretion in approving the settlement as fair, reasonable, and adequate under Federal Rule of Civil Procedure 23(e). The panel specifically upheld the equal pro rata distribution plan, rejecting Feldman’s argument that claimants from states with stronger privacy statutes deserved larger shares.
March 31 — April 1, 2026 — Rehearing Denied; Mandate Filed
On April 1, 2026, the Ninth Circuit panel unanimously denied the objector’s petition for rehearing en banc. No judge requested a vote after the full court was advised of the petition. The Mandate was filed on March 31, 2026. Class Counsel anticipated the settlement’s effective date would occur within the following months. Payments to valid claimants remain pending as of June 2026.
What Oracle Actually Did: ID Graph, Data Marketplace, and AddThis
The complaint’s technical allegations are worth understanding. Oracle did not simply collect data on its own users. It built a surveillance infrastructure spanning the entire commercial internet.
AddThis was the entry point. Acquired in 2016, AddThis provided social sharing buttons and content recommendation widgets embedded in millions of third-party websites. When a user visited any site running AddThis code, Oracle collected data about that visit — regardless of whether the user had ever interacted with Oracle or agreed to any Oracle terms of service.
BlueKai, acquired in 2014, operated as a data management platform where Oracle aggregated this web activity data and combined it with data purchased from outside brokers. Those brokers supplied offline behavioral data: purchase histories, loyalty card records, location data from mobile devices, financial information.
The ID Graph was Oracle’s synthesis product. It connected a person’s data across devices, browsers, and channels — linking a phone, a laptop, a tablet, and a desktop back to a single individual. Oracle then sold access to this cross-channel profile through its Data Marketplace to advertisers and marketers.
The plaintiffs argued this entire chain operated without the knowledge or meaningful consent of the people being profiled. Users visiting websites that ran AddThis had no idea Oracle was collecting their data. They had no relationship with Oracle. They had agreed to nothing. Oracle built dossiers on them anyway.
- AddThis: Widgets embedded in millions of websites — collected browsing behavior across the web
- BlueKai: Data management platform — aggregated web data and combined it with offline data broker purchases
- ID Graph: Cross-device identity resolution — linked a single person across all their devices and channels
- Data Marketplace: The monetization product — sold access to consumer profiles to advertisers
The Legal Claims Oracle Faced
The complaint asserted six categories of legal violations. Each targeted a different aspect of Oracle’s data operation.
First: invasion of privacy under the California Constitution. California’s constitution contains an explicit right to privacy, enforceable against private parties. Plaintiffs argued Oracle’s secret data collection violated that right.
Second: intrusion upon seclusion under California common law. This tort requires showing that the defendant intentionally intruded into a private sphere and that the intrusion would be highly offensive to a reasonable person. Plaintiffs argued that secretly profiling someone’s financial behavior, health-related searches, and location history meets that standard.
Third: violation of the California Invasion of Privacy Act. CIPA prohibits unauthorized interception of electronic communications. The plaintiffs argued Oracle’s AddThis tracking intercepted communications between users and third-party websites without consent.
Fourth: violation of the Florida Security of Communications Act. The FSCA imposes similar restrictions on electronic interception, with damages of up to $1,000 per violation. Florida class members were included in the complaint.
Fifth: unjust enrichment. Oracle profited from selling data it had no right to collect. The plaintiffs argued Oracle should disgorge those profits.
Sixth: violation of the federal Electronic Communications Privacy Act. This claim was dismissed with prejudice in April 2024 — the court found it did not fit the facts of how Oracle’s tracking operated.
The surviving claims proceeded into settlement negotiations. The scale of potential statutory damages under CIPA and FSCA — the objector argued the total could reach $100 billion — gave both sides strong incentive to resolve.
Settlement Details: Who Qualifies and What the $115 Million Covers
The settlement class includes all natural persons residing in the United States whose personal information, or data derived from their personal information, was acquired, captured, or otherwise collected by Oracle Advertising technologies, or made available through Oracle’s ID Graph, Data Marketplace, or any other Oracle Advertising product or service, from August 19, 2018 through the date of final judgment.
That definition covers nearly every American adult who used the internet during that period. The settlement administrator estimated the class at approximately 220 million U.S. residents.
The claim deadline was October 17, 2024 and is now closed. Claimants who submitted valid forms before that date are in line for payment. Those who did not file cannot now claim compensation.
| Settlement Component | Amount / Detail |
|---|---|
| Total Settlement Fund | $115,000,000 (non-reversionary) |
| Attorneys’ Fees (requested) | Up to $28.75 million (25% of fund) |
| Litigation Expenses | Up to $225,000 |
| Service Awards (2 plaintiffs) | Up to $10,000 each |
| Net Distribution to Claimants | Pro rata; depends on valid claim count |
| Payment Methods | Zelle, Venmo, ACH, virtual prepaid card, paper check |
| Claim Deadline | October 17, 2024 — now closed |
The Injunctive Relief: What Oracle Agreed to Stop Doing
Money was not the only term of the settlement. Oracle also agreed to non-monetary relief that governs its conduct going forward — though the context makes this largely symbolic.
Oracle agreed it will not capture user-generated information from referrer URLs (the URL of a previously visited page) associated with a website user. It also agreed not to capture text entered by users into online web forms, except on Oracle’s own websites. And it committed to implementing an audit program to review customer compliance with contractual consumer privacy obligations.
Here is where the context matters. Oracle announced on June 11, 2024, that it was exiting the ad tech business entirely. The products these injunctive terms govern — AddThis, BlueKai, ID Graph, Data Marketplace — no longer operate. Oracle shut them down. The injunctive relief binds a company that has already abandoned the conduct it promised to stop.
That timing tells a story. Oracle killed its data broker operation weeks before settling the lawsuit that challenged that operation. Whether the lawsuit caused the shutdown, or the shutdown was already planned, the public record does not confirm. What it does confirm: the infrastructure that allegedly harmed 220 million Americans no longer exists.
The Objector Argument: Was $115 Million Enough?
The settlement faced one serious challenge before the Ninth Circuit. Objector Sarah Feldman argued that the $115 million figure dramatically undervalued the class’s claims. Her lawyers calculated potential statutory damages under CIPA and FSCA at up to $100 billion. She argued the settlement was worth only a fraction of what a successful trial could have yielded.
She also argued the equal distribution plan was unfair. California and Florida plaintiffs had stronger statutory claims — claims with larger per-violation damages — than plaintiffs from other states. An equal pro rata distribution, she argued, diluted the California and Florida members’ recoveries to subsidize plaintiffs with weaker legal positions.
Both arguments failed. The Ninth Circuit panel found that Judge Seeborg adequately evaluated the risks of continued litigation. The $100 billion figure assumed perfect outcomes across every claim, against every class member, with no defenses sustained. Real litigation does not work that way. Seeborg’s approval reflected the actual range of likely outcomes, not the theoretical maximum. The panel also found no abuse of discretion in the equal distribution plan. Complexity in allocation does not require allocation by state law strength.
What this objection revealed, however, is important context. The gap between the theoretical claim value and the settlement amount is enormous. Consumers received a fraction of what Oracle allegedly made from their data, and a fraction of the statutory penalties the law authorized. Similar to how the Perplexity AI lawsuit raised questions about corporate accountability for data exploitation, this case exposes how civil litigation — even when it wins — often delivers outcomes calibrated to settlement risk rather than corporate harm.
What Oracle Knew and When: The Regulatory Trail
Oracle’s data practices did not emerge from a regulatory vacuum. The Federal Trade Commission had been scrutinizing data brokers for years before this lawsuit was filed. In 2014, the FTC published a major report on data brokers, specifically criticizing the lack of consumer notice and opt-out mechanisms in the industry. Oracle’s BlueKai acquisition occurred that same year.
Europe moved first with binding law. The General Data Protection Regulation, which took effect in May 2018, required explicit consent for data collection and gave European citizens the right to access and delete their personal data. Oracle’s settlement class period begins August 19, 2018 — three months after GDPR took effect.
California followed with the California Consumer Privacy Act of 2018, which gave California residents new rights over their personal data beginning January 2020. Oracle’s advertising products continued operating during this period. The alleged data collection that forms the basis of this lawsuit occurred throughout the CCPA’s early implementation years.
The timeline tells a different story than Oracle’s public messaging. The company operated its data broker business for years after regulators made clear the legal and ethical problems with unconsented data collection. It exited only after facing a lawsuit that survived motions to dismiss and was heading toward trial with class certification intact.
When Will Claimants Get Paid?
As of June 2026, no payments have been distributed. The settlement official website confirms the Ninth Circuit issued its affirmance order on February 13, 2026, and the mandate was filed March 31, 2026. Class Counsel anticipates the effective date — which triggers the payment timeline — will occur within months of the mandate filing.
The exact payout per claimant remains unknown. It depends on how many valid claims were submitted before the October 17, 2024 deadline. Settlement administrators estimated claims rates of 1.5% to 2.5% of the class. If 220 million people are in the class and 2% filed claims, that is approximately 4.4 million claimants. After deducting up to $29 million in attorney fees and costs from the $115 million fund, the net distributable amount would be approximately $86 million — or roughly $20 per valid claimant at that claims rate. The actual figure will differ based on the real number of claims received.
Note: Estimates after deducting ~$29M in fees and costs from $115M fund. Actual amounts depend on valid claim count.
What the Oracle Case Means for the Data Broker Industry
Oracle was not a small company running a side project. It was one of the largest enterprise technology companies in the world, operating one of the most sophisticated consumer data broker businesses in the industry. The Katz-Lacabe lawsuit named that business explicitly and forced it into court.
The result: Oracle shut down its ad tech operation and paid $115 million to settle. That outcome will register across the data broker industry. Companies that quietly collect, aggregate, and sell consumer data without explicit consent now have a clearer picture of the legal exposure. The settlement amount — while well below theoretical statutory damages — still represents one of the largest data privacy class action resolutions in U.S. history.
The case also demonstrated that standing is achievable in data privacy litigation even when harm is diffuse and indirect. Courts have historically struggled with whether data collection, absent a specific data breach or measurable financial injury, constitutes a cognizable legal harm. The Northern District of California allowed this case to proceed on that theory. The Ninth Circuit affirmed the resulting settlement. That precedent matters.
Similar data privacy class actions against major tech companies are already working through the courts. The Oracle settlement provides a benchmark for how courts value privacy violations at scale, and what defendants with deep pockets are willing to pay to avoid trial. The Ed Sheeran copyright lawsuit showed how much legal outcomes depend on what evidence survives — the Oracle case shows how much class action settlements depend on what risks defendants are willing to accept.
What This Lawsuit Teaches Consumers
The Oracle America lawsuit is a rare case where the litigation actually forced accountability at scale. A company built a surveillance business, someone sued, and the business no longer exists. That is not the typical outcome of consumer data litigation.
What it should teach is structural. Most Americans had no idea Oracle had profiled them. No website asked for permission to share data with Oracle’s ID Graph. No banner notification explained that clicking a social sharing button fed behavioral data into a commercial database. The data collection was, by design, invisible.
The settlement delivers at most a few dozen dollars per claimant. Oracle’s advertising business reportedly generated far more than $115 million in revenue from the data it collected. The math does not balance. What the settlement did achieve is behavioral: Oracle exited the business, committed to not resuming certain collection practices, and created a public record that data brokers face real legal exposure under existing U.S. law.
Consumers who want to protect themselves going forward have limited options under current U.S. law compared to European counterparts operating under GDPR. California residents have the strongest protections. The California Consumer Privacy Act gives residents the right to know what data companies have collected, to request deletion, and to opt out of the sale of their data. Using those rights requires action. The Oracle case is a reminder that the default, for most data brokers, is collection — and that the burden of opting out falls entirely on the consumer.
Read These
- Sutter Health premium lawsuit
- TruLife Distribution lawsuit
- Ziploc microplastics lawsuit
- Jon Gruden NFL lawsuit
- Dairy Queen labor lawsuit
Frequently Asked Questions
What is the Oracle America lawsuit about?
Katz-Lacabe v. Oracle America alleges Oracle secretly collected personal data on 220 million U.S. residents via its advertising technologies — ID Graph, Data Marketplace, AddThis, and BlueKai — and sold it to third parties without consent, violating California, Florida, and federal privacy laws.
Has the Oracle data privacy settlement been approved?
Yes. U.S. District Judge Richard Seeborg granted final approval on November 15, 2024. The Ninth Circuit affirmed the settlement on February 13, 2026, and denied rehearing on April 1, 2026. The mandate was filed March 31, 2026. Payments are pending.
How much will I receive from the Oracle settlement?
The exact amount is unknown and depends on the number of valid claims filed. After deducting attorney fees (~$29M), the net fund of ~$86M is distributed pro rata among all valid claimants. Estimates range from roughly $13 to $39 per claimant depending on claims rate.
Can I still file a claim in the Oracle settlement?
No. The claim deadline was October 17, 2024, and is now closed. Only individuals who submitted a valid claim form before that date are eligible for payment.
Who qualifies as a class member in the Oracle settlement?
All U.S. residents whose personal information Oracle collected or sold via its advertising products — including ID Graph, Data Marketplace, AddThis, or BlueKai — from August 19, 2018 through the date of final judgment. The class is estimated at 220 million people.
Why did Oracle exit the ad tech business?
Oracle announced on June 11, 2024 — weeks before settling this lawsuit — that it was shutting down its advertising technology division, citing falling revenues. Analysts noted the timing coincided with mounting privacy litigation and regulatory pressure. Oracle has not publicly confirmed the lawsuit drove the decision.
What did Oracle actually do with people’s data?
Oracle allegedly used AddThis widgets embedded across millions of websites to track browsing behavior, combined that data with offline purchase and location data bought from third-party brokers, then sold cross-device consumer profiles to advertisers through its ID Graph and Data Marketplace products.
What is a non-reversionary settlement fund?
A non-reversionary fund means Oracle cannot get any of the $115 million back regardless of how many claims are filed. All unclaimed funds are redistributed among valid claimants or donated to cy pres recipients — they do not revert to Oracle.
What is the difference between CIPA and CCPA in this case?
CIPA — the California Invasion of Privacy Act — was the primary wiretapping statute at issue here, prohibiting unauthorized interception of electronic communications. CCPA — the California Consumer Privacy Act — is a separate law giving consumers rights over their data. CCPA was not the basis for this lawsuit.
Why was the $100 billion figure rejected by the Ninth Circuit?
Objector Sarah Feldman argued CIPA and FSCA statutory damages could total $100 billion across the class. The Ninth Circuit found the district court properly weighed litigation risks — including uncertain class certification, possible Daubert challenges to expert testimony, and Oracle’s available defenses — against that theoretical maximum.
Are settlement payments from the Oracle case taxable?
Payments for physical injuries are generally not taxable, but privacy violation settlements typically are. The IRS treats most class action settlement payments as ordinary income unless they compensate for a physical injury. Claimants should consult a tax professional about their specific situation.
Will Oracle face any additional consequences beyond the settlement?
As of June 2026, no. The settlement resolved all civil claims by class members. No criminal charges have been filed related to Oracle’s data practices. The FTC has not announced separate enforcement action tied to this conduct. The non-monetary injunctive terms bind Oracle going forward, but the ad tech business those terms govern no longer operates.
Leave a Reply