Federal Lawsuit Filed Against AOL Over Privacy Policy Changes
Richards v. AOL Media LLC — Eastern District of Virginia (Alexandria Division)
On December 23, 2025, Thomas Richards filed a federal lawsuit against AOL Media LLC challenging the company's new Terms of Service and Privacy Policy set to take effect January 2, 2026.
The Core Issue
AOL notified users on Thanksgiving Day 2025 that it would implement sweeping new privacy terms. Under the new policy, AOL claims the right to read, analyze, and share users' private email communications with third parties -- including advertisers, data brokers, "AI Providers," and law enforcement -- all under the guise of "legitimate interest" that requires no user consent.
Richards, a 25-year AOL user, never agreed to allow AOL to read his emails. He intentionally declined to accept AOL's 2018 unified terms and was never locked out of his account. AOL's own FAQ confirms that users who declined those terms "remain under the legacy AOL Terms and Privacy Policy" -- which explicitly stated: "Oath does not read your private online communications without your consent."
Now AOL is forcing users to accept the new surveillance terms or forfeit their accounts entirely.
The Claims
The complaint alleges violations of:
- Stored Communications Act (18 U.S.C. §§ 2701-2712)
- Electronic Communications Privacy Act (18 U.S.C. § 2511)
- Virginia Consumer Protection Act
- Breach of Implied Covenant of Good Faith and Fair Dealing
- Unconscionability
- Promissory Estoppel
Emergency Relief Requested
Richards filed an emergency motion for a temporary restraining order to prevent AOL from enforcing the new terms before the January 2 deadline.
Evidence Destruction?
In a troubling development, Richards also filed an emergency motion for spoliation sanctions. The legacy privacy policy pages -- which contained the "does not read" promise -- were publicly accessible until AOL was served with this lawsuit. Within days of service, AOL blocked access to those pages, returning "403 Forbidden" errors. The pages remain indexed in search engines, but clicking the links now leads to access denied messages.
What This Means
This case raises fundamental questions about digital privacy, coerced consent, and whether email providers can unilaterally strip away privacy protections that users relied upon for decades.
Court Documents:
No comments:
Post a Comment