Judge advances privacy claims over Chrome ‘incognito’ mode
SAN JOSE, Calif. (CN) — For the second time, a federal judge denied Google’s bid to dismiss a class action case where users of its Chrome internet browser claim they were being tracked while in private browsing mode despite the company’s claims to the contrary.
U.S. District Court Judge Lucy Koh, in likely one of her last rulings before moving to the Ninth Circuit, said if Google did track people and sell their data while they were in incognito mode, then the company breached its contract with users.
“A reasonable user could conclude that plaintiffs’ contract with Google incorporated the Incognito splash screen,” Koh wrote in a 31-page order denying the motion to dismiss. “Google’s privacy policy, which Google concedes was part of the contract, expressly stated in an ‘Introduction’ section that plaintiffs could ‘choose to browse the web privately using Chrome in Incognito mode.’”
The order came down late Wednesday and expands a previous denial issued by Koh this past March. After that order, the plaintiffs added a breach of contract claim and said Google also violated California’s state law governing unfair competition. Google then filed a motion to dismiss related to those two claims specifically, and Koh ruled both should advance.
Regarding the unfair competition claim, Koh said the case could go forward because plaintiffs have plausibly lost money or property as a result of Google’s use of the data collected despite the use of incognito mode.
Google argued the plaintiffs did not suffer an injury because they could not plausibly sell their individual data on the open market, but the California Supreme Court recently ruled individual data has value and that plaintiffs should have standing if technology companies use theirs without permission.
“A company called Brave now offers a web browser which “will pay users to watch online targeted ads, while blocking out everything else,” Koh wrote. “Several other companies, including a company called Killi, have launched exchange platforms that allow individuals to sell their data to third-party applications and websites.”
Due to the existence of these platforms, plaintiffs can argue they have lost their ability to sell their individual data because Google took it from them despite assurances in its privacy policy that users would not be tracked while using incognito mode on the Chrome browser.
The ruling is bad news for Google and other technology companies that use data collection and targeted advertising as their primary means of revenue generation. Previous arguments about the commercial viability of individual data mean technology companies could escape these types of unfair competition claims.
However, Google can still argue the merits of the case and prevail as Wednesday’s decision only means the plaintiffs’ case can move forward to the discovery phase.
Previously, plaintiffs said Google violated the federal Wiretap Act along with the recently enacted California Invasion of Privacy Act along with two other privacy-related laws. Google tried to dismiss those claims, but Koh denied the request in her March order.
Besides claiming they are inappropriately tracked for targeted advertising purposes, the plaintiffs claim they followed a specific process for protecting their privacy, namely not turning on the sync option, but Google tracked their web surfing despite assurances to the contrary.
Google argued during a contentious hearing this past February that the plaintiffs consented to have their data collected when they agreed to the terms of service.
“Each one of these people signed something saying the data they are now complaining about being collected is being collected,” Andrew Schapiro, an attorney for Google, said during last month’s hearing.
But Koh dismissed this argument in her March ruling and then again on Wednesday.
“First, Google cannot demonstrate that plaintiffs expressly consented because Google did not notify users that it would be engaging in the alleged data collection while Plaintiffs were in private browsing mode,” the judge wrote. “Google’s privacy policy does not disclose Google’s alleged data collection while Plaintiffs were in private browsing mode.”
Google argued it couldn’t be held liable under the Wiretap Act, because the law carves out exceptions for users who consent to have their data intercepted. But plaintiffs say they never consented.
“Google told users it would protect their privacy as long as they don’t do certain things and they break that promise every day,” said Jay Barnes, attorney for the plaintiffs, at the February hearing. “They are promising consumers their browser is a safe place to go, while at the same time, the advertising division is hacking their way around privacy provisions in the Chrome contract.”
The judge said Google users have a reasonable expectation of privacy when they are in private browsing mode, or in incognito, and therefore were entitled to seek invasion of privacy claims when it turned out the company was still tracking their website browsing history.
Specifically, Koh pointed to how Google advertised its incognito mode feature on its Chrome browser.
“Now you can browse privately, and other people who use this device won’t see your activity,” the company stated while explaining the feature to potential customers.
Google may try and settle the case to stave off discovery, otherwise the case heads toward motion for summary judgment, which means the parties agree on the facts but diverge on the legal implications of those facts, or trial.