Google must face a class action lawsuit accusing the tech company of violating privacy laws by allegedly collecting personal information about users, even after they declined to sync their Google profiles to their Google-supported Chrome browser when online, a federal appeals court has ruled.
In the ruling, a three-judge panel of the U.S. Ninth Circuit Court of Appeals rebooted the legal action, saying an Oakland federal judge applied the wrong legal standard when allowing Google to pull the plug on the case.
The case was first dialed up in federal court in 2020, when a collection of prominent class action plaintiffs' firms filed suits in the Northern District of California federal courts on behalf of Google customers.
The lawsuits all accused Google of violating state and federal privacy laws by surreptitiously recording users' online activities, when the customers had allegedly not given Google explicit permission to do so.
Particularly, the Google users say they had intentionally elected not to sync their Google Chrome browsers with their individual Google account, allegedly believing this would prevent Google from tracking and logging their activities.
Specifically, they said Google had collected their "unique, persistent cookie identifiers;" their browsing history; certain kinds of online communications; and a combination of their IP address and other identifying information, which they said "uniquely identifies every individual downloaded version of the Chrome browser."
In response to the lawsuits, Google did not specifically deny collecting the information.
Rather, the company asserted the users had actually consented to the collection by agreeing to Google's Chrome-specific and general privacy terms and agreements in their Google user agreements.
In Oakland federal court in 2022, U.S. District Judge Yvonne Gonzalez Rogers had sided with Google, granting the company summary judgment, which is a ruling that ends a case in one party's favor before a trial.
In that ruling, Rogers agreed with Google that, under the law, the users had consented under Google's general privacy terms and conditions because the collection of the data was "browser agnostic" - meaning, Google could have collected the information from the users whether they were using Google's Chrome browser or any other.
The Chrome users appealed, however, and the Ninth Circuit panel of judges said Rogers got the case wrong.
In this case, the appellate judges said Rogers overly relied on the question of "browser agnosticism."
Rather, the appellate judges said Rogers should have applied the standard which asks whether a "reasonable user" would have understood they had consented to the data collection.
The appellate decision was authored by Ninth Circuit Judge Milan D. Smith Jr. Judges Mark J. Bennett and Anthony D. Johnstone concurred in the ruling.
"By focusing on 'browser agnosticism' instead of conducting the reasonable person inquiry, the district court failed to apply the correct standard, despite its recitation of it," Judge Smith wrote. "Viewing this in the light most favorable to Plaintiffs, browser agnosticism is irrelevant because nothing in Google’s disclosures is tied to what other browsers do.
"And that is because the governing standard is what a 'reasonable user' of a service would understand they were consenting to,not what a technical expert would."
The judges noted Rogers' ruling in the Chrome Sync data collection case runs counter to a decision reached in the same district court in 2023 in a case against Google over its similarly allegedly surreptitious collection of data from Chrome users who had their browsers set to "icognito mode."
In that case, Google has also argued its general privacy terms should apply because of "browser agnosticism." But in that case, the court had rejected those arguments, because the judge said a "reasonable user" would have believed their data was not being collected, based on Google's assurances.
"Here, Google had a general privacy disclosure yet promoted Chrome by suggesting that certain information would not be sent to Google unless a user turned on sync," Judge Smith wrote in the appellate opinion.
"Thus, 'Google itself created a situation where there is a dispute as to whether users’ consent of Google’s data collection generally is ‘substantially the same’ as their consent to the collection of their [non-synced] data in particular,'" Smith said, citing the lower court's decision in the "icognito" privacy case.
"Whether a 'reasonable' user of Google’s computer software at issue in this case consented to a particular data collection practice is not to be determined by attributing to that user the skill of an experienced business lawyer or someone who is able to easily ferret through a labyrinth of legal jargon to understand what he or she is consenting to.
"Instead, a determination of what a 'reasonable' user would have understood must take into account the level of sophistication attributable to the general public, which uses Google’s services."
The appellate panel remanded the case to the Northern District of California for further proceedings.
Plaintiffs have been represented by attorneys Matthew W.H. Wessler and Neil K. Sawhney, of Gupta Wessler LLP, of Washington, D.C., and San Francisco; Jason O. Barnes, Eric S. Johnson, Jennifer M. Paulson, Vinh Truong and Thien An, of Simmons Hanly Conroy, of St. Louis, Missouri; Alton, Illinois; and New York;
Amy E. Keller, Adam J. Levitt, Adam Prom, Corban S. Rhodes and David A. Straite, of DiCello Levitt LLP, of Chicago and New York; and Lesley Weaver, of Bleichmar Fonti & Auld LLP, of Oakland.
Google has been represented by attorneys Andrew H. Schapiro, Joseph H. Margolies, Stephen Broome, Diane Doolittle, Alyssa Olson, Viola Trebicka and Christopher G. Michel, of Quinn Emanuel Urquhart & Sullivan LLP, of Chicago, New York, New York, Redwood Shores, Los Angeles, and Washington, D.C.; and Jeffrey M. Gutkin, of Cooley LLP, of San Francisco.