IE 11 is not supported. For an optimal experience visit our site on another browser.

Bose Headphones Accused in Lawsuit of Spying on Listeners

Data mining lawsuits are on the rise as a variety of electronic devices gather more and more information about users.
Developers And Coders Attend The  TechCrunch Disrupt London 2015 Hackathon
An attendee wearing Bose headphones works on a laptop computer at a hackathon in London in December 2015.Luke MacGregor / Bloomberg via Getty Images file

A new class-action lawsuit claims high-end headphone company Bose has been tracking and distributing customers' data without telling them.

According to the complaint, filed late Tuesday in the U.S. District Court in Chicago, the headphone company's Bose Connect app does more than just pair wireless headphones with the music in their devices — it also connects the user's entire listening history with third-party data mining companies.

A person's music and podcast listening history can likely reveal personal and identifying details, the lawsuit says. For example, if a user listens to a Muslim prayer service, it is likely the individual is Muslim, the suit notes. Other potentially revealing information such as sexual orientation or health concerns could also be gleaned from the data, the suit says.

Developers And Coders Attend The  TechCrunch Disrupt London 2015 Hackathon
An attendee wearing Bose headphones works on a laptop computer at a hackathon in London in December 2015.Luke MacGregor / Bloomberg via Getty Images file

Attorney Chris Dore, whose firm Edelson PC is representing main plaintiff Kyle Zak, who paid $350 for his headphones, in the class-action suit, told NBC News that Bose never informed customers about the data mining.

"One of the issues raised by this lawsuit is that it's not clear what's happening," said Dore. "The danger with undisclosed and unexplained data collection is, the world is open to these companies to do what they want."

Dore said Bose Connect does have a privacy policy, but users aren't required to view or agree: "The user does not interact with it in any way when signing up for the app. It also doesn't disclose this data collection."

The lawsuit alleges Bose broke a handful of federal and state laws including the Federal Wiretap Act, the Illinois Eavesdropping Statute, and consumer fraud and invasion of privacy laws. Zak and Edelson are demanding that Bose destroy all of the user data it has collected so far, and the lawsuit says that damages likely exceed $5 million.

Bose did not immediately return requests for comment. The company's website offers several regulatory and compliance documents, but does not appear to refer to the Bose Connect app.

There have been a numerous data-mining lawsuits of late as more and more companies have access to intimate user data through websites, apps, and Bluetooth-enabled devices — sometimes referred to as the Internet of Things.

In January, the Mississippi Attorney General sued Google over "unclear" policies regarding collecting the personal information and search histories of students. Even sex toy companies have been hit with lawsuits over user privacy: Edelson also sued adult product manufacturer Standard Innovation in 2016 over allegations that the company's We-Vibe app collected especially sensitive user data.

Dore said data mining lawsuits are "something you're going to see a lot more of."

"Some devices are more obvious than others about data collection, but your headphone is not an obvious concern," said Dore. "You're sitting in your house listening to a podcast about politics or religion, and you don't think that information is going to leave your headphones and go to a third party."

According to the lawsuit, the Bose Connect app shares user listening information with Segment, a data collection and analysis firm. Segment's website features the phrase "Collect all of your customer data and send it anywhere" prominently on its main page.

Segment's legal team did not immediately respond to a request for comment.

Dore told NBC News that corporate mining of user data can be exploited; once a user clicks "agree" on a lengthy, complex form with fine print that says the company can share or sell user data, it's hard to tell how many times, and with whom, that data will be shared.

"Data collection is a relative black hole at this point," Dore said. "Once you lose control of it, it can go to ten more companies and you won't know."