BlueKai

BlueKai is a cloud-based big data platform that enables companies to personalize online, offline, and mobile marketing campaigns.[1] BlueKai was created in 2008 by Omar Tawakol, Alexander Hooshmand, and Grant Ries, as a marketing tech start-up based in Cupertino, California. It was acquired by Oracle on February 24, 2014, for approximately $400 million.[2]

The company offers third party data collecting services. BlueKai collects PC & smartphone users' data to enhance ad marketing for their clients, and as of 2015 had about 700 million actionable profiles.[3] BlueKai has worked with companies like Twitter and Facebook to ensure relevancy in the ads that appear for those companies' users. As a third party data collection company, they gather information on users surfing the web, though BlueKai claims not to collect sensitive financial details, adult material, or health issues.[4] However, the company has received criticism because users feel the services they do provide are an invasion of privacy.[5]

Other clients and sites using BlueKai's services have included Live.com, Huffingtonpost.com, Walmart.com, Vimeo.com, Microsoft.com, and eBay.com.[6]

In June 2020, TechCrunch reported that security researcher Anurag Sen had found an unsecured BlueKai database accessible on the open Internet. The database held billions of records containing names, home addresses, email addresses, and web browsing activity like purchases and newsletter unsubscribes. TechCrunch reported that under California state law companies are required to publicly disclose data security incidents, but that Oracle had not done so at the date of the story.[7] Until Oracle acquired BlueKai in 2014, BlueKai had remained an anonymous data company. All first and third party data collected by BlueKai was legally and technically limited to anonymous data. Specifically, BlueKai, did not accept data that contained a person’s name, address, phone number, email or other similar data that could specifically identified an individual. That approach mitigated the extent of harm of BlueKai having data breaches (and indeed until the time of the acquisition by Oracle no significant data breaches were known to have occurred).

The use of anonymous cookie data was part of the initial privacy design of the company and that approach remained until the acquisition by Oracle. After the acquisition of BlueKai by Oracle, Oracle acquired other data companies like DataLogix, AddThis, CrossWise, Moat, etc. Some of those companies contained very large PII data assets (the type of PII data containing names and addresses cited in the breach below). After the acquisition, Oracle initially stopped broadly using the BlueKai brand name. But recently, Oracle started to reuse the Brand BlueKai more broadly in its marketing of some data assets more broadly than just BlueKai[8]