Google to Settle $5 Billion Lawsuit for Allegedly Tracking Users in ‘Incognito’ Mode

The company is alleged to have collected an individual’s IP address, geolocation, browser and device platform details, and search queries.

A picture taken on November 20, 2017 shows logos of US multinational technology company Google displayed on computers' screens. / AFP PHOTO / LOIC VENANCE Photo credit should read LOIC VENANCE/AFP via Getty Images

Google agreed to settle a potentially $5 billion lawsuit alleging that the tech giant collected data of internet users when they browsed in “private” mode on Google’s Chrome or other browsers.

The class-action lawsuit was filed in 2020 by five plaintiffs, covering millions of Google users. It accused the company of tracking user activity even after they set Google’s Chrome browser to “Incognito” mode. The complaint alleged that this tracking was also done when using the “private” browsing mode in other browsers. As such, when a user visits a website containing Google’s Analytics or other codes via any browser, the tech company collects private information like IP address and location data despite being on “private” browsing, the lawsuit alleged.

The complaint insisted that Google violated California’s privacy laws as well as federal wire-tapping regulations. It demanded a minimum of $5,000 in damages per affected user, with the total amount of the lawsuit amounting to at least $5 billion.

On Tuesday, Google and the lawsuit plaintiffs submitted a notice in the U.S. District Court of the Northern District of California, agreeing to a deal that would “resolve the claims in this litigation” provided the court approves it.

The parties asked the court to stay the litigation “in its entirety” and vacate the trial date so they could “focus their efforts entirely on finalizing the settlement.”

A trial date on the case was scheduled for Feb. 5, 2024. But the U.S. District Judge Yvonne Gonzalez Rogers put the trial date on hold on Thursday. The settlement terms were not revealed.

However, lawyers claimed to have agreed upon a binding term sheet, which is a nonbinding agreement outlining the basic terms and conditions of a deal. The two sides are expected to present a formal settlement agreement for court approval by Feb. 24, according to Reuters.

Google tried to have the case dismissed. In August, Judge Rogers rejected the company’s bid for a summary judgment—a judgment entered by the court for a party against another party without conducting a full trial.

The Complaint

“Since June 1, 2016, Google represented to plaintiffs it would not collect their information while they browsed privately,” Judge Rogers said in her ruling denying the company’s summary judgment request.

However, “it did so anyway, collecting, aggregating, and selling plaintiffs’ private browsing data without their consent.”

When a user visits a website running Google services like Analytics and Ad Manager, the company’s software “directs the user’s browser to send a separate communication to Google,” which happens even when the user is in private browsing mode. This is unknown to the user or the website developers, the ruling stated.

Google then collects private information about the user, including the individual’s IP address, geolocation, browser and device platform details, how the person interacts with a website, and search queries on the site.

Plaintiffs argued that Google uses this private browsing history to build up user profiles, allowing the company to display better-targeted advertisements.

“This is at the core of Google’s business: the bulk of Google’s hundreds of billions of dollars in revenue comes from selling targeted advertisements to other companies,” the ruling said.

“By selling users’ information, Google prevents users from monetizing their own data. The value of this data can be quantified: for example, Google itself has piloted a program to pay users $3.00 per week to track them.”

Judgment

Google argued in court that the plaintiffs’ claim of the company violating Section 632 of the California Invasion of Privacy Act (CIPA) does not stand as the communications, which are the core issue of the case, are not confidential.

Section 632 provides liability against “every person who, intentionally and without the consent of all parties to a confidential communication, by means of any electronic amplifying or recording device, eavesdrops upon or records the confidential communication.”

In her ruling, Judge Rogers noted that when users choose the Incognito mode in a Chrome browser, they are presented with a splash screen that says:

• They can “browse privately, and other people who use this device won’t see your activity.”
• Their activity “might still be visible to” websites they visit, their employer or school, or their internet service provider.

“Notably absent from that list is Google itself,” the judge notes.

Google argued that the Incognito Splash screen makes it clear that privacy has its limits. It insisted that since plaintiffs agreed that they could be “overheard” by someone else, they should have no expectation of privacy, even against Google.

But the judge pointed out that “plaintiffs had an expectation of privacy against Google even if they knew others could be listening in.”

“Sufficient evidence exists that plaintiffs have suffered an injury in fact. Plaintiffs have shown that there is a market for their browsing data, and Google’s alleged surreptitious collection of the data inhibited plaintiffs’ ability to participate in that market.”

The $5 billion potential deal is the latest settlement Google has agreed to.

Last week, Google announced it would pay $700 million to settle a lawsuit filed by multiple U.S. states that accused the company of running a monopoly on its Play Store. The complaint alleged that Google used the Play Store monopoly to inflate prices for the paid apps.