Unlawful sharing of personal information, weak security controls, and collection practices that stretch beyond what users were told to expect. We examine whether exposure is systemic enough to support a class.