Google's Privacy Slip Ups Could Cost Them $5 Billion
3 min read

Google's Privacy Slip Ups Could Cost Them $5 Billion

How one judge thinks the tech giant hasn't been entirely truthful with their users about surveillance
Google's Privacy Slip Ups Could Cost Them $5 Billion

Photo by Kai Wenzel on Unsplash

Prefer audio? Subscribe to the podcast!


A lawsuit filed in June, Brown et al v Google et al, seeks class action status and alleges damages of at least $5 billion under California privacy and federal wiretapping laws. At the center of the lawsuit is Google's Chrome browser, and its private browsing features branded as "Incognito Mode." The original complaint, as reported by Reuters alleges that users are led to believe that Google is not tracking their browsing activities when employing incognito mode, but they indeed are via Google Analytics, Google Ad Manager, and an array of other applications Google offers web developers to better target their ads.

According to Ars Technica, the case really boils down to this quote from the original complaint:

'Google promises consumers that they can 'browse the web privately' and stay in 'control of what information [users] share with Google.' To prevent information from being shared with Google, Google recommends that its consumers need only launch a browser such as Google Chrome, Safari, Microsoft Edge, or Firefox in 'private browsing mode.' Both statements are untrue. When users undertake either—or both—of the aforementioned steps, Google continues to track, collect, and identify their browsing data in real time, in contravention of federal and state laws on wiretapping and in violation of consumers’ rights to privacy."

The complaint seeks at least $5 billion, or $5,000 per violation against all users, which the plaintiffs allege to be "likely . . . millions of individuals."

In Google's response to the complaint, they claim that "Google . . . makes clear that ‘Incognito’ does not mean ‘invisible,’ and that the user’s activity during that session may be visible to websites they visit, and any third-party analytics or ads services the visited websites use." Google subsequently moved to dismiss the case.

However, as Bloomberg reports, U.S. District Judge Lucy Koh in San Jose, Califronia ruled last Friday that, "Google did not notify users that Google engages in the alleged data collection while the user is in private browsing mode."

Jude Koh's ruling contains this screenshot of what users are presented with once they open an incognito tab.

Screenshot included in Judge Koh's ruling.

She specifically notes three things about the screenshot that are misrepresentative to users about incognito mode's actual behavior. She first notes that Google omits themselves from the list of parties the user's activities "might still be visible to," listing "websites you visit," "your employer or school," and "your internet service provider." This is important because the tools mentioned earlier not only allow the websites a user visits to track them, but also Google.

Secondly, the splash screen reads, "Now you can browse privately, and other people who use this device won't see your activity." Google argued in their motion to dismiss that line clearly leads a user to believe that incognito mode only protects them from their browsing history being saved on the device they're using. But Judge Koh says "that a reasonable user could have read the two phrases as being independent of each other." In other words, the Judge argues that "Now you can browse privately" and "Other people who use this device won't see your activity" can stand on their own and the former could reasonably lead a user to believe they're browsing behavior is not being tracked.

Third, in the splash screen Google tells the user that Chrome won't save "browsing history," "cookies and site data," and "information entered in forms." In the original complaint, the plaintiffs refuted these claims saying that browsing history and cookies are still stored by Google. Google claims that the statement is accurate because the browser itself does not store these things, but rather Google does on their servers. Judge Koh stated:

". . . the Court concludes that a reasonable user could read this statement to mean that their browsing history and cookies and site data would not be saved. Moreover, the Court notes that a user might reasonably associate Chrome with Google because Chrome is Google’s browser."

There are many more arguments made by the Judge in her her 41 page ruling. These are just some that stood out to me.

The ruling comes as Google faces an antitrust lawsuit in the Eastern District of Texas filed by 15 U.S. state Attorneys General. Their most recent filing, a 166 page amended complaint, also takes direct aim at Google Chrome's privacy claims, as reported by the Verge.

Enjoying Surveillance Today? Subscribe and get every post directly to your inbox.


Comments

Sign in or subscribe to join the conversation.
Just enter your email below to get a link to log in.