Challenges to Google's Collection of Web Browsing Data Survive Motion to Dismiss
A class action lawsuit will proceed against Google over its collection of data from users browsing in "incognito mode," as District Judge Lucy Koh denied Google's motion to dismiss on March 12, 2021. In Brown v. Google, Judge Koh found that the plaintiffs adequately alleged that they had a reasonable expectation of privacy in their data, despite Google's arguments that it disclosed and the plaintiffs consented to Google's data collection practices.
The ruling may have broad implications for those websites that use Google Analytics or Google Ad Manager, but do not explicitly include in their privacy policies that users could be tracked while browsing in incognito mode.
Allegations
As DWT previously reported, plaintiffs allege that Google did not explain to its users the nature of the private browsing mode, what data is saved, and what data is used by Google. When a user browses in "incognito mode," according to Google's motion to dismiss, their activities are not saved in Chrome's browsing or cookie history on the device in which the individual is operating.
However, plaintiffs allege that when they were in "incognito mode" visiting websites that deployed Google cookies (such as Google Analytics), Google nonetheless tracked their activity on those sites. According to the plaintiffs, "[m]ore than 70% of all online publishers (websites) use" Google Analytics or Google Ad Manager.
The putative class action, filed in the Northern District of California in June 2020, alleged that Google's collection of data concerning users activating "incognito mode" constitute violations of the federal Wiretap Act, the California Computer Data Access and Fraud Act (CDAFA), and the California Invasion of Privacy Act (CIPA), as well as an invasion of privacy and intrusion upon seclusion.
Google moved to dismiss the suit in October, arguing that it alerted users upon activation of incognito mode that their browsing data could still be tracked by the company or third-party analytics providers, and that plaintiffs consented to Google's practices by agreeing to its privacy policy when they signed up for Google accounts.
Holding
Judge Koh held that plaintiffs could have reasonably believed, based on Google's representations, that Google would not have access to their browsing activity while they were in incognito mode.
Plaintiffs alleged that users enable private browsing mode "to visit especially sensitive" websites, which could reveal "a user's dating history, a user's sexual interests and/or orientation, a user's political or religious views, a user's travel plans, [or] a user's private plans for the future (e.g., purchasing of an engagement ring)." Judge Koh found this factor dispositive because the plaintiffs used the incognito mode to prevent others from discovering what they were viewing on the internet, as opposed to other privacy suits involving email messages that, by their very nature, are sent to another person "who may then easily transmit the communication to anyone else who has access to the Internet or print the communications."
As for Google's representation regarding the incognito mode, Judge Koh noted that the Splash Screen discloses that a user's activity may still be visible to websites visited or other third parties, but omits that Google receives this information. Judge Koh also pointed out that Google's privacy policy does not mention anything about Google's collection or use of data while users navigate to websites in private browsing mode.
Judge Koh further rejected Google's argument that the Wiretap Act claim should be dismissed because users and third-party websites consented to its receipt of data. After questioning whether Google adequately notified users of its practices to establish consent, she held that consent is not a defense where a defendant acts with the purpose of committing tortious injury (in this case, invasion of privacy and inclusion upon seclusion) or violating other laws (in this case, CDAFA).
Implications
Brown is one of a series of lawsuits that have been filed against Google challenging its data collection practices, both when individuals use Google products and through third-party websites that embed Google code. Historically, plaintiffs have had limited success with claims that technology companies' or website publishers' collection of information from consumers violates consumer protection and anti-wiretap or interception statutes.
The Brown lawsuit—perhaps regardless of the outcome—could force Google to make changes in the options it provides to users for data collection by its advertising and analytics cookies, which in turn could lead to increased opt-outs and less collection of data. This will impact not just Google but potentially any website that relies on embedded code to understand individual use of their websites, target advertising, and understand whether advertising efforts successfully drove sales.
The lawsuit also comes amid a heavy push by now-former California Attorney General Xavier Becerra to promote the use and recognition of browser-based privacy controls, which would enable individuals to signal, based on one setting in a browser or on a device, that they do not wish to be tracked. In addition to issuing several regulations to push the recognition of the Do Not Track signals, Becerra recently expressed support for Global Privacy Control, a proposed specification that would allow individuals to notify businesses of their privacy preferences via their browsers.
The complaint also demonstrates the difficulty of providing transparency and offering consumer choice in the technically complex Internet ecosystem. The data collection at issue in Brown occurred where plaintiffs were using a Google product (Chrome) but visiting websites not controlled by Google that embedded Google code—but also set their own collection practices. Even if Google were to change how incognito mode operates, the website could still deploy other analytics or advertising cookies that collect consumer data; or if consumers used other browsers to visit websites that embed Google code, their preferences as set in Chrome would not be recognized.
As new privacy laws in California and Virginia will require additional changes to privacy notices, businesses will have to think carefully about how to convey a large volume of information—including information about the third parties they work with—in a manner that can be understood by their consumers.