Google agrees to delete billions of data points about private browsing activity in class action settlement

Google told users they could “browse the web privately” using Chrome browser’s Incognito mode. A group of plaintiffs showed how Google collected data about those users’ online activity via its own tracking tools.  

To settle a lawsuit lasting nearly four years, Google has agreed to delete “billions” of records about people’s private browsing activity and make substantial changes to Incognito mode. This article explains how three plaintiffs successfully fought Google’s allegedly misleading privacy claims and practices. 

Background to the settlement 

The plaintiffs in this case submitted their initial complaint to the North California District Court in June 2020, alleging that “Google tracks and collects consumer browsing history and other web activity data no matter what safeguards consumers undertake to protect their data privacy.” 

The complaint showed that Google still dropped cookies on a user’s device via its tracking software, Google Analytics and Google Ad Manager, even when the user visited a website using Chrome’s supposedly private “Incognito mode.” 

The plaintiffs argued that such tracking contradicted Google’s claims on the Incognito mode “splash screen—displayed when opening a new private tab—which told users that the feature could enable them to “browse the web privately” and “stay in control” of the information they share with Google.” 

Despite these assurances, Google allegedly collected data about people’s browsing history, shopping habits, friendship networks, and personalities—creating what the plaintiffs described as “an unaccountable trove of information so detailed and expansive that George Orwell could never have dreamed it.” 

Anonymized and aggregate data? 

Incognito mode prevents Chrome from updating its “history” feature to show the sites the user recently visited, does not save searches, and deletes certain browser cookies after a user closes the Incognito window. 

However, at the time, certain Google products such as Google Analytics—which the plaintiffs claimed was used by “over 70% of websites”—still collected data about the online activity of users employing Incognito mode. 

The plaintiffs argued that Google’s actions violated the federal Wiretap Act and the California Invasion of Privacy Act (CIPA) and violated the torts of “invasion of privacy” and “intrusion upon seclusion”. 

Google fought back against the allegations, unsuccessfully asking the court to dismiss the complaint (twice) on the basis that it only collected “anonymized and aggregate” data via Google Analytics and thus was not risking causing consumers any harm. 

The court also sanctioned Google (twice) during the course of the lawsuit, ordering the company to pay the plaintiffs $1 million after failing to produce evidence that it tracked users’ private browsing status. 

How the case changes Incognito mode 

The lawsuit’s drawn-out discovery process revealed some important information about Google’s tracking of Incognito Chrome users. 

• First, Google used “private browsing detection bits” to identify whether users were browsing the web privately and to tag the associated data as private. As part of the settlement, Google has agreed to delete these detection bits, along with “billions of event-level records” tied to the class represented by the plaintiffs. 
• Second, Google employees had been concerned about the language used to describe Incognito mode for many years, describing claims about the feature as “effectively a lie,” a “problem of professional ethics and basic honesty,” and a “confusing mess.” Google has already made changes to the Incognito mode “splash screen”. 
• Third, while many people knew that Incognito mode did not disable tracking via Google’s web products, the case arguably undermined public confidence in the effectiveness of Chrome’s privacy protections. Under this settlement, Google will disable third-party cookies in Incognito mode by default. 

The settlement doesn’t include any payment of damages to the plaintiffs or the class of Chrome users they represent. However, Google failed to prevent class members or other Chrome users from bringing individual claims for damages in future. Indeed, a similar lawsuit remains underway in Texas.  

So, while Google escapes the multi-billion dollar payment initially sought by the plaintiffs in this class action case, the company might continue dealing with the fallout of its allegedly misleading privacy disclosures for many years.