The data analysis company, San Francisco-based Coremetrics, has said the information sent to it by clients such as Toysrus.com is used to prepare Web-site usage reports that aren't made available to other companies. Coremetrics argued that it's merely acting as an outsourcing subcontractor to the Web sites that sign up for its analysis service.
"Our client believes that her personally identifiable information has been shared with a third party in violation of Toys R Us policy," said Shannon Keniry, an attorney at Kinkelstein, Thompson & Loughran, a Washington-based law firm that filed a suit in U.S. District Court in New Jersey on Wednesday on behalf of a California resident.
The aggregated data may be shared with prospective business partners and advertisers but "does not contain any information that could identify an individual [user of the site]", according to the Toysrus.com policy. The policy adds that Toysrus.com doesn't sell or rent the personally identifiable information it collects from online shoppers.
Emily Brady, a Coremetrics spokeswoman, said the lawsuits are based on a "complete misunderstanding" of what the data analysis company does. "We capture data for our customers, and they specify to us the type of information we should capture," Brady said. "We don't own the data, we don't resell the data. It's not ours."
Coremetrics said it had received legal documents on a total of three claims that had been filed in California courts in relation to its analysis service. The company said the cases have no merit and vowed to "vigorously defend" itself against any allegations that are directed at the service, which was launched in April.
Milberg Weiss Bershan Hynes & Lerach, a San Diego-based law firm, filed a suit against Toys R Us similar to the New Jersey one in U.S. District Court in San Francisco. Lawyers at the San Diego firm didn't return a call seeking comment.
The controversy over Coremetrics began when Interhack, a company that develops security and privacy tools, posted a report on its Web site claiming that Toysrus.com and three other online retailers were sending personal information to the analysis company without notifying consumers and despite having policies that promise they won't share such data with third parties.
Coremetrics has posted a response on its Web site saying that Interhack's allegations are "based entirely on the erroneous assumption that Coremetrics collects data across multiple sites with the intention of reselling it to third parties." In addition, two of the four online retailers mentioned by Interhack -- Lucy.com, and Fusion.com -- have added mentions of their relationships with Coremetrics to the privacy policies on their Web sites.