Google: “Privacy breach is not harm” – US court disagrees

Google: “Privacy breach is not harm” – US court disagrees

Despite the browser’s incognito mode, Google monitors Internet users, creates profiles and uses the data collected in the process. Some of those affected have been trying to get Google to stop doing this in court for three years. The data company defends itself tooth and nail. First, Google tried to have the lawsuit dismissed as inadmissible and unfounded, which was not heard by the court in 2021. Then, using similar arguments, Google applied for a summary judgment in its favour: those affected were not allowed to complain at all, and they had also given their unequivocal and express consent to the surveillance. They can sue, and the court says they probably didn’t agree. There is no quick judgement, Google should face a process; then a jury will decide what really matters.

Advertisement

Half of the proceedings are being conducted as class action lawsuits, the other half are not: in addition to damages, the five plaintiffs are also demanding that Google stop monitoring in the browser’s incognito mode. The stumbling blocks are various Google programs for website operators, including Ad Manager and Google Analytics, which, according to a court decision, run on over 70 percent of all websites. These Google programs instruct browsers that call up the website to send certain information directly from the user’s device to Google – even if the browser is running in incognito mode.

This data includes the IP address of the end device, the address called up (URL), the referrer address (from which other page the user surfed to the website), the user agent of the browser, which contains information about the operating system and browser , Event information, such as what ads were presented to the user or what videos were played, any search terms, and, if available, the user’s location. Both Google’s market-leading Chrome browser and other browsers are affected.

Basic facts are not disputed

With regard to Chrome, the company has promised from 2016 that it will not collect data in incognito mode. At the same time, Google refrains from informing those webmasters about the secret data collection who build code for Google Analytics, the Ad Manager or comparable offers into their websites. The data collected allows Google to tailor ad placements more precisely to users, which earns Google more money. This fact is not disputed.

By collecting and evaluating data, Google prevents users from using their data for their own profit, according to the responsible federal district. Google itself has proven that this is possible: as part of a field test, Google paid participants three dollars a week for their browser data. In addition, it has already been decided in proceedings against Facebook for secret user tracking that browser histories have financial value.

Half class action

Advertisement

The court only partially approved the application to conduct the proceedings as a class action: the action for injunctive relief is being conducted as a class action for all affected US netizens; the request for damages, on the other hand, must be sued by each person concerned, because the circumstances and thus the amount of damages are too individual. This means that there will probably not be a verdict in the billions in this case. But even an obligation to refrain from monitoring in incognito mode would reduce Google’s revenues by billions.

Google argued that one of the prerequisites for the allegation of breach of contract was concrete damage (concrete harm), which was not the case. However, the court considers the breach of contract alleged by the plaintiffs to be sufficient. As far as the allegation of invasion of privacy is concerned, the plaintiffs are also entitled to sue. Because, contrary to Google’s representation, the data collection is not anonymous: Although the individual data points are not identified by name, Google creates profiles from them – and these are very likely to be assigned to individual users. The data also has market value, and each of the five plaintiffs is seeking damages. In addition, they may sue for injunctive relief because Google has not given any indication of changing its behavior.

Many unanswered questions prevent quick judgment

Google also claims that users have explicitly consented to data collection in incognito mode by accepting the privacy policy. However, the text of the contract only mentions incognito mode once, and that in connection with the management of privacy by the user himself. In addition, the plaintiffs have presented evidence that Google’s own employees knew that users overestimated the privacy effects of incognito mode. As a result, it was not clear that the users had expressly consented to the collection of data. So there can be no quick judgment in favor of Google here either.

It is also disputed which Google texts are part of the contracts concluded between Google and end users, which of Google’s commitments are legally binding and enforceable, whether the website operators have consented to the data collection, whether user monitoring is necessary for the operation of the websites, which data is tapped are to be considered as content or as metadata, which data transmitted to Google is legally protected at all, whether the data transmissions triggered by Google’s code can be attributed to Google or the website operators, whether the data have value and whether the users are specifically harmed in the sense of different laws, and whether users should have expected data protection at all or whether Google’s behavior should be classified as disreputable (highly offensive). Because none of this clearly speaks in favor of Google, the court decided that no quick judgment can be made for Google.

So the jury will have a lot to decide. The case is Brown et al v Google et al and is pending in the United States District Court for Northern California under Case No. 20-cv-03664.

(ds)

Go to homepage
#Google #Privacy #breach #harm #court #disagrees