Google privacy lawsuit Google loses in court, faces trial for collecting data on users who opted out Judge: Reasonable juror may find Google profited from misappropriation of data. Jon Brodkin Jan 9, 2025 3:06 pm | 4 Credit: Getty Images | Josh Edelson Credit: Getty Images | Josh Edelson Story textSizeSmallStandardLargeWidth *StandardWideLinksStandardOrange* Subscribers only Learn moreA federal judge this week rejected Google's motion to throw out a class-action lawsuit alleging that it invaded the privacy of users who opted out of functionality that records a users' web and app activities. A jury trial is scheduled for August 2025 in US District Court in San Francisco.The lawsuit concerns Google's Web & App Activity (WAA) settings, with the lead plaintiff representing two subclasses of people with Android and non-Android phones who opted out of tracking. "The WAA button is a Google account setting that purports to give users privacy control of Google's data logging of the user's web app and activity, such as a user's searches and activity from other Google services, information associated with the user's activity, and information about the user's location and device," wrote US District Judge Richard Seeborg, the chief judge in the Northern District Of California.Google says that Web & App Activity "saves your activity on Google sites and apps, including associated info like location, to give you faster searches, better recommendations, and more personalized experiences in Maps, Search, and other Google services." Google also has a supplemental Web App and Activity setting that the judge's ruling refers to as "(s)WAA.""The (s)WAA button, which can only be switched on if WAA is also switched on, governs information regarding a user's '[Google] Chrome history and activity from sites, apps, and devices that use Google services.' Disabling WAA also disables the (s)WAA button," Seeborg wrote.Google sends data to developersBut data is still sent to third-party app developers through the Google Analytics for Firebase (GA4F), "a free analytical tool that takes user data from the Firebase kit and provides app developers with insight on app usage and user engagement," the ruling said. GA4F "is integrated in 60 percent of the top apps" and "works by automatically sending to Google a user's ad interactions and certain identifiers regardless of a user's (s)WAA settings, and Google will, in turn, provide analysis of that data back to the app developer."Plaintiffs have brought claims of privacy invasion under California law. Plaintiffs "present evidence that their data has economic value," and "a reasonable juror could find that Plaintiffs suffered damage or loss because Google profited from the misappropriation of their data," Seeborg wrote.The lawsuit was filed in July 2020. The judge notes that summary judgment can be granted when "there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." Google hasn't met that standard, he ruled.In a statement provided to Ars, Google said that "privacy controls have long been built into our service and the allegations here are a deliberate attempt to mischaracterize the way our products work. We will continue to make our case in court against these patently false claims."In a proposed settlement of a different lawsuit, Google last year agreed to delete records reflecting users' private browsing activities in Chrome's Incognito mode.Google disclosures are ambiguous, judge saysGoogle claimed that the "undisputed facts" show its collection of "data was lawful and consistent with its representations to class members," Seeborg wrote. But in the judge's view, the "various interpretations of these disclosures render them ambiguous such that a reasonable user would expect the WAA and (s)WAA settings to control Google's collection of a user's web app and activity on products using Google's services."Google contends that its system is harmless to users. "Google argues that its sole purpose for collecting (s)WAA-off data is to provide these analytic services to app developers. This data, per Google, consists only of non-personally identifiable information and is unrelated (or, at least, not directly related) to any profit-making objectives," Seeborg wrote.On the other side, plaintiffs say that Google's tracking contradicts its "representations to users because it gathers exactly the data Google denies saving and collecting about (s)WAA-off users," Seeborg wrote. "Moreover, Plaintiffs insist that Google's practices allow it to personalize ads by linking user ad interactions to any later related behaviorinformation advertisers are likely to find valuableleading to Google's lucrative advertising enterprise built, in part, on (s)WAA-off data unlawfully retrieved."Plaintiffs contend that "Google should be disgorged of all its profits derived from serving any ads to (s)WAA-off users. Google "denies that any (s)WAA-off data is saved to a user's marketing profile, which precludes it from personalizing advertising to a WAA-off users." Google says the data is "intended to be shared with only developers through GA4F for their own analysis."Jury can evaluate Googles pseudonymous claimsGoogle, as the judge writes, purports to treat user data as pseudonymous by creating a randomly generated identifier that "permits Google to recognize the particular device and its later ad-related behavior... Google insists that it has created technical barriers to ensure, for (s)WAA-off users, that pseudonymous data is delinked to a user's identity by first performing a 'consent check' to determine a user's (s)WAA settings."Whether this counts as personal information under the law is a question for a jury, the judge wrote. Seeborg pointed to California law that defines personal information to include data that "is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Given the legal definition, "a reasonable juror could view the (s)WAA-off data Google collected via GA4F, including a user's unique device identifiers, as comprising a user's personal information," he wrote.As Seeborg wrote, "Google insists that users knew and consented to its tracking practices," specifically the collection of pseudonymous data. Seeborg rejected this claim. To a reasonable user reading Google's disclosures, "it is unclear Plaintiffs were consenting to the data collection at issue," he wrote.Another argument from Google is that plaintiffs have no reasonable expectation of privacy in anonymized, aggregate data. But information doesn't have to be personally identifying in order to be private, and "whether the data collected by Google constitutes personal information is not, as Google suggests, a foregone conclusion," Seeborg wrote.Jon BrodkinSenior IT ReporterJon BrodkinSenior IT Reporter Jon is a Senior IT Reporter for Ars Technica. He covers the telecom industry, Federal Communications Commission rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry. 4 Comments