Speculating, but TOS generally say that you're not allowed to share your password with anyone. Assuming that's true for the AA site, AA might argue that TPG is encouraging users to break their TOS ("tortious interference").

Though if app doesn't actually share the password with TPG and just uses it locally there may well be a question of whether entering your password into a third-party app actually counts as sharing it with that party. How exactly would this be different logging in from a web browser? It's just a different kind of user agent. Are Google, Mozilla, Microsoft, and Apple guilty of tortious interference simply because the software they release has access to your passwords on your own machine and could report them back? (For that matter, they even store the synced passwords on their servers, though in principle those are supposed to be private.)

Of course there could also be specific terms in the TOS against accessing the service with unapproved user agents, independent of any prohibition on sharing credentials.

1. Breach of Contract 2. Tortious Interference with a Contract 3. Unfair Competition by Misappropriation 4. Trespass 5. Trademark infringement 6. Dilution 7. Dilution under Texas State Law 8. False Designation of Origin 9. Copyright Infringement 10. CFAA 11. Violation of Texas Harmful Access by Computer Act 12. Unjust Enrichment

AA presents an argument for the ToS binding TPG as a party.

From the AA website: "By logging in, you accept the AAdvantage terms and conditions"

AA provides a number of arguments against that. That's part of the dispute.

They specifically claim it's presenting something that is intentionally confusingly similar to an official AA logon screen using copyrighted and trademarked AA content to harvest customer username and password info, does not prominently note it's nonaffiliation with AA, and directly violates the TOS itself, as well as arguing tortious interference, copyright infringement, trademark infringement, trademark dilution, and violation of the CFAA and the Texas equivalent.

They also note a similar dispute settled with a separate firm owned by the same parent before TPG tried to negotiate a deal with AA for permission to access customer data for this purpose and was turned down.

edit: No it doesn't, brain fart.

Contractual restrictions on speech are enforceable.

That they're stealing AA's opportunity for, ahem, "customer engagement".

They may have a case for tortious interference, I think? It does seem like an uphill climb. The strategy might just be to punish TPG with attorneys' fees and discourage this practice in the future.

In this case an individual customer authorized the access and only their data was affected. This is a pretty common use case for a large category of apps – think Mint, Plaid, all wallet apps which organize and track different accounts.

Edit: typo. I wrote „pwn“ instead of „own“. But then I thought about it and somehow it feels appropriate.

The issue isn’t whether or not it’s what the customers wanted. The issue is that TPG wasn’t the party that entered into the agreement with AA when creating the account.

I’m not suggesting it’s right or wrong, but that’s the issue.

So here we are. It should be fascinating to see where this goes.

Respondeat superior lets you sue the principal for torts of an agent committed in the scope of their agency, but it doesn't eliminate the liability of the agent for their own torts.

You typically want to sue the principal when the agent is less able to pay, less willing to settle, or one of many easily replaceable agents employed by the principal for the same purpose.

When the first and third of those are reversed and the second is unclear (which seems to be the case here), you want to focus on the agent. You could sue the multitude of principals, too, but that's just a lot more cost for little additional benefit (and possibly sympathy backfire in a jury trial.)

“how does filing a lawsuit against this party improve my expected resolution to whatever problem motivated the lawsuit, and is that worth the added cost of pursuing that party” should be part of your calculus. That's not to say the merits of the case don't figure in, but a meritorious case against someone who even the best possible outcome won't do anything to improve your condition is just a way to waste your money and time, and the courts.

As the great Professor Hecker repeated so often in Business Associations - “The tortfeasor is always liable.” E.g. when you get hit by the Dominoes delivery driver, you can sue the delivery driver.

These things get ridiculously specific.

Also, the law around real property including leases is different and more involved than straightforward contractual relationships.

Move Reader to iCloud proxy and I think it becomes almost identical?

I think these principles have served us pretty well despite the violations of human dignity like not being able to check your AA points from the TPG app.

Yes, and AA servers, copyrights, and trademarks are all, under the law, it's property, of which it is master.

That's kind of the whole basis of the lawsuit.

They think the data belongs to them. They think they own the consumers and all the data they generate. To them, it's their consumer data, something they abuse to get consumers to log in and look at ads, and they'll be damned if they let some random software have access to it no matter what the user wants.

GDPR makes it clear that personal data belongs to the person, these companies are just middle men who are temporarily processing it. Cases like this perfectly illustrate why such a change in perspective is necessary. Access to this data is a privilege and it can be revoked.

>Let's create a crappy experience that the user has to put up with, to squeeze a few extra cents per year.