The audio maker Bose, whose wireless headphones sell for up to $350, uses an app to collect the listening habits of its customers and provide that information to third parties—all without the knowledge and permission of the users, according to a lawsuit filed in Chicago on Tuesday.
The complaint accuses Boston-based Bose of violating the WireTap Act and a variety of state privacy laws, adding that a person’s audio history can include a window into a person’s life and views.
“Indeed, one’s personal audio selections – including music, radio broadcast, Podcast, and lecture choices – provide an incredible amount of insight into his or her personality, behavior, political views, and personal identity,” says the complaint, noting a person’s audio history may contain files like LGBT podcasts or Muslim call-to-prayer recordings.
The lead plaintiff in the lawsuit is a man named Kyle Zak, who claims he followed the company’s suggestion to “get the most out of your headphones” by downloading the Bose Connect app, and supplying information such as his name, phone number and email address.
Zak is seeking to represent other headphone owners over allegations of illegal data mining. According to the complaint, Bose created detailed profiles of customers’ listening histories and habits, and shared it with marketing companies, including a San Francisco firm called Segment whose website offers to “collect all or your customer customer data and send it anywhere.”
Get Data Sheet, Fortune’s technology newsletter.
The lawsuit says the case is worth more than $5 million but doesn’t specify damages. Bose, whose wireless QuietComfort 35 headphones have received enthusiastic reviews, disputed the allegations.
“[W]e’ll fight the inflammatory, misleading allegations made against us through the legal system,” said a company spokesperson, adding that Bose had reached out to its customers to reassure them.
While Bose customers can use the headphones without the smartphone app (simply connect using Bluetooth settings or the audio cable), the app provides more options to use the device—and opened the door for data collecting.
In addition to the QuietComfort 35 headphones, the other Bose products cited in the complaint are the SoundSport Wireless, Sound Sport Pulse Wireless, QuietControl 30, SoundLink Around-Ear Wireless Headphones II, and SoundLink Color II.
If the allegations are true, the Bose case is just the latest privacy incident involving the so-called “Internet of things” in which more companies and devices that are connected to the web can’t resist the temptation of harvesting the consumer data they throw off.
Last month, for instance, a “smart sex toy” maker called We-Vibe agreed to pay around $3.75 million to settle claims its app had illegally collected information about how its customers used the product.
According to Jay Edelson, the privacy lawyer who filed the Bose lawsuit, companies should not be able to help themselves to consumer data just because they can.
“Companies need to be transparent about the data they take and what they are doing with it, and get consent from their customers before monetizing their personal information,” said Edelson.
The complaint, which you can read for yourself here, also accuses Bose of unjust enrichment and “intrusion upon seclusion.” It also seeks an injunction to force Bose to stop the alleged data collection.
This story was updated on Thursday evening to add Bose’s response.
