An Illinois man is accusing the headphone giant Bose of collecting and sharing its users’ listening data in secret.
Fortune first reported on the lawsuit.
Kyle Zak filed the complaint in federal court in Chicago on Tuesday night. At the center of the lawsuit is Bose’s Connect app, which is marketed as an optional companion to a handful of the headphone maker’s newer headphones and speakers, including its acclaimed QuietComfort 35 noise-cancelling headphones.
Bose says the Connect app is meant to adjust noise-cancellation, more quickly manage connected audio devices, and view other settings.
But Zak and the Chicago-based law firm Edelson PC, which specializes in cases involving technology and consumer privacy, say the Connect app also “intercepted and collected all available media information” from Zak’s smartphone every time it was opened after Zak paired the app with his QuietComfort 35s.
Zak says Bose collected the titles and general info for every song, podcast, or other audio file he listened to when he paired with the app, then transmitted that data to "third parties." The lawsuit specifically mentions Segment, a Bay Area software company that collects customer data and helps route it for analytics and marketing firms, as a recipient of the information he says the Connect app takes.
The lawsuit claims Bose did not inform Zak that it would collect and share such data. The Connect app's latest license agreement does say it "may collect, transmit, and store" various pieces of customer data on "servers operated by third parties on behalf of Bose," but it does not specifically mention the collection of audio file data.
The app's privacy policy gets a little more specific, saying Bose "may partner with certain third parties" to collect "non-personal information" and "to engage in analysis, auditing, research, and reporting." Bose mentions Segment in the privacy policy and says partnering with such companies allows it to "better control data from the app and direct it to third-party analytics providers."
The privacy policy is vague about the potential collection of a user's audio file data, however, and it doesn't specify if it would consider such data "non-personal" information - though it says Bose's third-party partners "may use SDKs or other tracking mechanisms to collect information from the app and from your device."
The lawsuit says that tracking a user's listening habits could enable Bose to create "detailed profiles" of its users, since it could feasibly collect their names and email addresses during sign-up and tie that information to a product's serial number.
"For example, a person that listens to Muslim prayer services through his headphones or speakers is very likely a Muslim, a person that listens to the 'Ashamed, Confused, and in the Closet' podcast is very likely a homosexual in need of a support system, and a person that listens to 'The Body's HIV/AIDS' podcast is very likely an individual that has been diagnosed and is living with HIV or AIDS," the lawsuit says.
The Connect app's privacy policy says that data collected through the app "is not used to create user profiles for behavioral advertising or similar purposes."
The lawsuit says the "amount in controversy" exceeds $5 million, but it does not give an exact amount Zak is seeking in damages. If the complaint is certified as a class action, it would apply to all users who may have had their data collected by the Connect app. Zak is seeking to end any collection by saying it violates the federal Wiretap Act, along with a variety of Illinois privacy laws.
Neither Bose nor Segment responded to requests for comment.
The lawsuit does not say how Zak found that the Connect app was collecting such listening data, nor does it say how much data Bose provides Segment.
Christopher Dore, an Edelson lawyer representing Zak, told Business Insider that the firm had "computer forensics experts" look into and discover the matter. Dore said Bose was the first headphone company Edelson has found to collect such data. He also said the firm did not reach out to Bose or Edelson before filing the lawsuit.
The lawsuit is the latest in a string of privacy-related legal complaints in an increasingly connected tech landscape. Those concerns may intensify when it comes to headphones, a market that's expected to integrate more and more "smart" data-processing features in the coming years.
The lawsuit also comes a month after another lawsuit accused Bose of engaging in duplicitous business practices with the California headphone startup Doppler Labs.
Bose, a privately held company, had annual revenues of $3.5 billion in 2015, according to Forbes.
Here's the full complaint: