Google Users Lose Appeal to Sue as a Class Over “Incognito” Data Collection
A number of Google users attempted to bring a class action asserting that the tech giant’s Chrome browser collects their data unlawfully. The plaintiffs lost an early appeal to seek damages as a class, severely undercutting their chances at a substantial damages award.
The case arose in 2020. Several plaintiffs filed a lawsuit against Google claiming that the tech mogul continued to collect data from Chrome users even while they were utilizing Chrome’s private-browsing “Incognito” mode. The users filed claims seeking upwards of $5 billion in damages.
Google’s support website promises that while you are using Incognito mode, “none of your browsing history, cookies and site data, or information entered in forms are saved on your device. This means your activity doesn’t show up in your Chrome browser history, so people who also use your device won’t see your activity.” Google asserts that, upon closing all Incognito windows, Chrome “discards any site data and cookies associated with that browsing session.”
According to the plaintiffs, despite Google’s promises, Chrome collects and retains a variety of user data, even during private browsing. User data collected includes:
- “The ‘GET request’ sent from the user’s computer to the website.”
- “The IP address of the user’s connection to the internet.”
- “Information identifying the browser software that the user is using, including any ‘fingerprint’ data.”
- “Any ‘user-ID’ issued by the website to the user, if available.”
- “Geolocation of the user, if available.”
- “Information contained in ‘Google cookies,’ which were saved by the user’s web browser on the user’s device at any time prior.”
Plaintiffs sought to sue for injunctive relief and damages on behalf of affected Chrome browser users across the country as well as users of other browsers with a Google account whose data privacy was breached while utilizing similar private browsing modes. The claims would cover Google’s data collection from June 2016 through the date of the lawsuit for tens of millions of Google users.
Ultimately, the trial court ruled that the class could be certified as to injunctive relief, but the plaintiffs could not seek damages as a class. The court found that damages would be impracticable to pursue on a class level because each user’s experience and expectations differ too greatly; many users do not know or care whether Google collects their data whether inside or outside of private browsing modes, many gave implied or explicit consent to such data collection, etc. Each user’s experience, knowledge, and expectations go directly to the damages they would be eligible to collect, and those individual issues predominate over the class-wide common issues.
The court did rule that the plaintiffs could proceed with their claims for injunctive relief on a class level. The injunctive relief sought--preventing Google from collecting data under appropriate circumstances--is common to the class.
Denial of class certification is a death knell for any hope of a meaningful financial award or action that could force Google to make changes. In theory, class actions are meant precisely for cases like this one, where each plaintiff’s damages are too small to pursue individually, but as a collective, they could seek true justice and real reform, along with a fair amount of compensation. While the plaintiffs would surely like to see Google stop its alleged wrongful conduct, it’s difficult to hold big businesses accountable without attacking their bottom line.
Plaintiffs sought to immediately appeal the denial of class certification for damages. The Ninth Circuit Court of Appeals rejected their plea. The plaintiffs can still seek to appeal the class cert denial at a later date.
