Credit Union Discreetly Uses Real-Time Tracking to Record Loan Seekers' PII: Suit

Pentagon Federal Credit Union, Verisk Analytics and Lead Intelligence record visitors’ electronic communications activities on PenFed’s website without their consent, said a Friday class action (docket 2:23-cv-04785) in U.S. District Court for Central California in Los Angeles.

Plaintiff James Miller of Burbank, California, used the PenFed website to apply for a home loan and entered his personally identifiable information (PII) and other sensitive, private information on the online forms. During each visit, the defendants intercepted the data, including first and last name, email address, loan type, property use, purchase price, home buyer status and credit score, without Miller’s consent, in violation of the California Invasion of Privacy Act (CIPA), said the complaint.

Verisk and Lead Intelligence provide “real time” products under the business name Jornaya for companies that generate online leads or engage in telemarketing, the complaint said. One of their products, LeadiD, is an identifier “that’s generated the moment a customer lands on a webpage where [the] script is installed,” the complaint said.

LeadiD advertises it provides “qualified leads that are prime to convert” by witnessing customer interactions and collecting data related to their experience, the complaint said. The Jornaya website advertises real-time data points that LeadiD can acquire, including the website from which a user navigated, the time it took to fill out the form and the number of competitors that also received the lead, it said. When the LeadiD script is added, Verisk and Lead Intelligence “automatically capture the information submitted in the respective forms and otherwise observed from users’ sessions,” and provide that data to their clients, it said.

Jornaya marketing materials tell mortgage industry clients, “What if you could know the behavior and intent behind every Refi lead you buy?” or “the moment when an existing customer enters the market” for a new mortgage, said the complaint. The recording of keystrokes, mouse clicks, data entry, and other electronic communications and actions begins the moment a user accesses or interacts with a webpage using LeadiD, it said.

Ordinary consumers would not be able to tell that their answers to PII prompts “are being recorded or shared with a third party,” said the complaint. “At no point is a user asked or required to consent to a Privacy Policy or any other type of disclosure before providing PII,” it said. Only after a consumer has provided PII and other sensitive information to defendants, which has been recorded in real time, does PenFed prompt the consumer to accept the privacy policy, it said.

The privacy policy “does not sufficiently disclose Verisk’s and Lead Intelligence’s real-time interception and recording of visitors’ website sessions,” the complaint said. “Even if a user reaches the point where PenFed asks for consent and chooses not to agree and leave the website, his or her information has already been captured and intercepted in real time,” it said.

During Miller’s visit, the Jornaya LeadiD feature created a video capturing his keystrokes, mouse clicks, and other “substantive” communications provided, said the complaint. Verisk and Lead Intelligence also captured the date and time of each visit, the duration of the visit, Miller’s IP address, his location at the time of the visit, browser type and the operating system on his device, without giving him notice or securing his consent, it said.

In addition to CIPA violations, Miller is asserting a claim of invasion of privacy under the California constitution. He seeks appropriate injunctive relief; compensatory, statutory or punitive damages, or restitution; pre- and post-judgment relief; and attorneys' fees and legal costs.