In a clear win for privacy, a federal jury earlier this month decided that Google must pay $425 million for violating California privacy laws (for eight years!) when it collected data on 98 million users even after they had turned off tracking.
The decision was in answer to a class action suit filed in 2020, but covered the period between 2016 and 2024.
Google’s position has been that it did nothing wrong and that the company has given users privacy controls to opt out of tracking, controls Google says it respects. “This decision misunderstands how our products work,” Google spokesperson Jose Castaneda told Reuters. “Our privacy tools give people control over their data, and when they turn off personalization, we honor that choice.”
So, it comes as no surprise that Google plans to appeal the decision. For now, though, privacy and security experts are celebrating a victory, even if it may be short-lived.
“This class action lawsuit is a win for people’s privacy as today user data is valuable information that drives sales and investments in projects,” said Nivedita Murthy, senior staff consultant at Black Duck.
Users should be in full control of how their data is used, she says. But Google argues that its users were indeed in control, noting the privacy controls. The company did admit, though, that even when users turn off the Web & App Activity function, businesses like Uber and Amazon that use Google Analytics could collect data but only about how the customer uses those apps.
Google characterized the data that could still be collected as “nonpersonal, pseudonymous, and stored in segregated, secured and encrypted locations.”
The plaintiffs alleged that Google’s collection practices extended to hundreds of thousands of smartphone apps, including those for ride-hailing companies Uber and Lyft, e-commerce giants Alibaba and Amazon, and Meta’s social networks Instagram and Facebook.
Regulators and the courts are getting tougher on Google and other companies. Regulations and legislation like GDPR and California Privacy Law “have pushed organizations to make sure the data they collect on user behavior is stored based on the preference of the user and illustrate that there are serious repercussions to not following the laws,” says Murthy.
Google is feeling that heat. Early in September, it was also fined $379 million by the Commission Nationale de l’informatique et des Libertés (CNIL) for failing to get user consent to use advertising cookies to track them online.
The agency said an investigation showed “that users of the Gmail messaging service were offered the option of activating ‘smart features’ to organise their inbox into three tabs — Primary, Promotions and Social.”
Those users who activated the “setting saw advertising messages in the form of emails inserted between their private emails in their inbox, in the ‘Promotions’ and ‘Social’ tabs, without their consent,” CNIL said.
The agency gave Google six months to implement measures to stop displaying ads “between emails in the Gmail service users’ mailboxes without prior consent and to ensure valid consent from users for the placement of advertising cookies when creating a Google account.”
Perhaps that will be enough to persuade Google to fall in line. Regardless, though, Murthy cautions users to be proactive. “At the same time, users should be aware and keep an eye out for privacy check popups that ask them to accept cookies or terms and conditions, for example, every time they access a new website or an application,” she says.
Recent Articles By Author
