A privacy class action against Google that was dismissed in 2022 has been given new life by an appeals court, potentially impacting Chrome users dating back to 2016. The suit was brought by users who say that the Chrome Sync feature collected personal information from those that chose to opt out of it, ignoring their preference to separate their Google accounts from their activity in the Chrome browser.
Chrome Sync at center of new privacy controversy
The privacy class action was initially heard by U.S. District Judge Yvonne Gonzalez Rogers in Oakland, California, who dismissed it in December 2022 on the grounds that Google’s general privacy policy was sufficient to inform users of the possibility that the company might collect their information from any web browser. Judge Milan Smith of the 9th U.S. Circuit Court of Appeals in San Francisco said that the focus of that decision was “misplaced” and that the ruling should have hinged on whether or not a reasonable user would assume their information was not being shared upon opting out of Chrome Sync.
The privacy class action covers Chrome users since July 27, 2016 that opted not to use the Chrome Sync feature, a decision that should have kept their Google accounts separate from their activity while using the web browser. The appeals court noted that Google’s marketing of the feature appeared to promise that personal information would not be collected if it was disabled. The suit claims that Google collected browsing history, IP addresses, persistent cookie identifiers, and unique browser identifiers from Chrome browsing sessions without informing users or obtaining their express consent.
The ultimate outcome of the privacy class action will now likely hinge on what a jury views as a “reasonable” level of knowledge and expectation of privacy when Google assures users that they are not being tracked. In this way, the Chrome Sync case has parallels to the suit the company recently settled involving the browser’s “Incognito” mode. That case was also first filed in 2020 and alleged that Chrome users were lulled into believing that information about them was not being collected when the supposed “private browsing” mode was enabled, unaware that other tracking elements that Google has scattered throughout the web as pieces of its sprawling advertising network were continuing to collect their data. Google ended up settling that case for $5 billion last year.
Privacy class action could be informed by prior decision
Google’s defense of Chrome Sync has centered on a concept of “browser agnosticism,” or that any privacy promises it makes are only within the context of that specific browser function. The Ninth Circuit shot this down entirely, calling the whole concept irrelevant to the case. Google settled the Incognito privacy class action for a staggering amount of money out of belief that no one would find it reasonable that a feature advertised as “private browsing” would not actually be private, and that result points to a similar course of action unfolding with the Chrome Sync case.
While Google did settle that prior privacy class action, it was able to do so in a way that requires impacted class members to proactively file their own claim in their state court. That is a much more time-consuming and complex process than obtaining the usual settlement check, in which the attorneys for the plaintiffs generally try to contact class members and offer them a simple form to fill out to receive a check. However, that settlement also requires the company to delete records of personal information that date back to June 2016. Google also agreed to allow users to block third-party cookies while in Incognito mode (though it is deep into the process of eliminating cookies from Chrome) and to be more transparent about exactly what it is collecting while the browser is being used.
All of this comes as a federal judge has ruled that Google’s app store has an unfair competitive advantage and must have serious measures applied to address the issue, and the DOJ has decided that the company’s online search component is also a monopoly that may have to be broken up. Both of these decisions are relatively new and the involved agencies are still determining exactly what steps to take, but one possible outcome is that Chrome (among other products) is broken off and forced to operate independently. Its assorted ad business components (AdNetwork, Ads Hub, Analytics) might meet the same fate. There has been some talk about breaking up parent company Alphabet as a whole, which could have the same level of impact to American markets and technological development as the “Ma Bell” breakup of 1984.
