On Monday, a California judge denied Google’s request for summary judgment in a lawsuit filed by users alleging the company illegally invaded the privacy of millions of people. The people suing Google say that occurred because Google’s cookies, analytics, and tools in apps continued to track internet browsing activity even after users activated Incognito mode Chrome, or other similar features like Safari’s private browsing expecting a certain level of privacy. However, the truth is, as we wrote in 2018, “What isn’t private: private browsing mode.”
Judge Yvonne Gonzalez-Rogers pointed to statements in the Chrome privacy notice, Privacy Policy, Incognito Splash Screen, and Search & Browse Privately Help page about how incognito mode limits the information stored or how people can control the information they share, writing, “Taken as a whole, a triable issue exists as to whether these writings created an enforceable promise that Google would not collect users’ data while they browsed privately.”
….Because Google never explicitly told users that it does so, the Court cannot find as a matter of law that users explicitly consented to the at-issue data collection.”
— Mike Swift (@Swiftstories) August 8, 2023
Another issue against Google’s arguments that the judge mentioned is that the plaintiffs have evidence Google “stores users’ regular and private browsing data in the same logs; it uses those mixed logs to send users personalized ads; and, even if the individual data points gathered are anonymous by themselves, when aggregated, Google can use them to ‘uniquely identify a user with a high probability of success.’”
She also responded to a Google argument that the plaintiffs didn’t suffer economic injury, writing that “Plaintiffs have shown that there is a market for their browsing data and Google’s alleged surreptitious collection of the data inhibited plaintiffs’ ability to participate in that market… Finally, given the nature of Google’s data collection, the Court is satisfied that money damages alone are not an adequate remedy. Injunctive relief is necessary to address Google’s ongoing collection of users’ private browsing data.”
The lawsuit was filed in 2020, seeking “at least” $5 billion in damages, and as reported by Mike Swift for MLex, the ruling was not entirely surprising, as the judge had indicated she’d do so, but it is a big one as it moves the case closer toward settlement or a trial.