Google's Data Collection Practices Face Scrutiny in Recent Lawsuits

Google has recently been named in three lawsuits that challenge how it collects users' personal information and whether users can opt out of the collection. Each of these cases raises important issues relating to notice and user consent, as well as the ability of end users, as plaintiffs, to limit data collection by leveraging consumer protection statutes.

Arizona AG Challenges Google's Location Tracking Methods

In May, the Arizona Attorney General sued Google under his state's Consumer Fraud Act alleging that Google makes it "impractical if not impossible" for users to opt-out of Google's collection of location information.¹ The Arizona AG alleges that Google tracks consumer location at the account, device, and application level, and that Google does so even where consumers believe they have turned off location tracking.

Google allegedly continues to harvest location data through its Web & App Activity setting, preloaded mobile device applications such as YouTube, Maps, Chrome, or Search, or through settings on the devices themselves in cases where users have failed to uniformly turn off location tracking across all of their Google linked devices.

Google moved to dismiss the complaint, arguing principally that:

• (1) The Arizona Consumer Fraud Act requires a sale, and the account and app level services are provided free; and
• (2) The complaint fails to identify any fraudulent advertising or representations.

On September 25, 2020, the trial court denied Google's motion to dismiss, finding that the AG adequately pled deceptive practices under the Consumer Fraud Act, but with a heavy dose of skepticism, commenting that Google made "convincing arguments" and observing that "[t]here appears to be, at best, a tenuous nexus between the purported deception of the Arizona consumer and the sale of advertising to third parties," "between the false representations at issue and the sale of" Google devices, and between "the general advertisement of Google products" and the purported fraudulent or deceitful conduct.

The AG is seeking civil penalties of $10,000 per violation, disgorgement, restitution, injunctive relief, and attorneys' fees.

Location Tracking Civil Suit Revived

Interestingly, the Arizona case may have breathed new life into another action that has been pending in the Northern District of California since 2018. As in the Arizona matter, the plaintiffs in a set of consolidated cases have alleged that Google continues to track users' locations even after they have switched off the location history feature on their smartphones.² 

Unlike in the Arizona case, the plaintiffs in the consolidated class action did not have the benefit of the Attorney General's subpoena power to assist with pre-filing investigation. Instead, they relied on news stories and Congressional hearing testimony relating to Google's collection of geolocation history to allege intrusion upon seclusion, unjust enrichment, and violations of California's constitutional right to privacy.

The district court initially dismissed the case because the plaintiffs had agreed to Google's Terms of Service and Privacy Policies (under which all Google users consent to having their geolocation data tracked and stored when using a Google application), and because plaintiffs had not alleged that any specific location data had been collected. Plaintiffs have since amended their complaint, and Google has again moved to dismiss.

The next hearing in this case is scheduled for November 5, 2020, and will address that motion—including consideration of whether the plaintiffs may rely on documents from the Arizona case to support their opposition to the motion to dismiss, and to support a motion seeking additional discovery.

Incognito Mode Alleged to Be Misleading

In June, plaintiffs filed a class action in the Northern District of California, alleging that Google continues collecting data while users are browsing in "Incognito" mode and asserting that this conduct violates the federal Wiretap Act, California's Invasion of Privacy Act (CIPA) and California's constitutional right of privacy, and constitutes the tort of intrusion upon seclusion.³

Google moved to dismiss, arguing that its disclosures relating to Incognito mode clearly stated that, while the user's activity would not be saved in Chrome's browsing or cookie history, it would still be subject to Google's data collection policies and visible to outside websites and ISPs. The hearing on Google's motion to dismiss is scheduled for December 4, 2020.

Consumer Class Action in Northern California Alleges Similar User Activity Tracking Issues

In July, plaintiffs (represented by the same firm as in Brown) filed a class action challenging Google's continued tracking of user activity data through applications developed with Google's Firebase software development kits.⁴ Plaintiffs allege that Google continues to track user activity data through applications that use the Firebase SDK even when the Web & App Activity setting is turned off. Plaintiffs allege violations of the federal Wiretap Act, CIPA, California's Comprehensive Computer Data Access and Fraud Act, and for invasion of privacy.

On October 13, 2020, Google moved to dismiss, arguing principally that each of the claims fails because:

• (1) Users consent to data collection when they agree to the applications' terms of service; and
• (2) The applications are contractually required to collect and share with Google only anonymized data.

Google further argued that Firebase has its own, separate terms of service that requires apps that integrate Firebase to disclose Firebase's information collection to users and obtain consent as necessary. The hearing is scheduled for December 17, 2020.

Takeaway

Historically, plaintiffs have had limited success with claims that technology companies' or website publishers' collection of information from consumers violates consumer protection and anti-wiretap or interception statutes. If plaintiffs in these cases are successful, that could not only open the door to additional lawsuits, but also trigger a rapid evolution of how companies provide users with notice and obtain their consent.

Businesses cannot ignore the importance of giving consumers clear notice that they can opt-out of collection and tracking, providing reasonably straightforward means of doing so, and also ensuring that their agreements with vendors articulate the scope of data the vendors will collect, and also explain and how vendors will communicate to, and obtain consent from, consumers, for those data collection policies.

FOOTNOTES

1  State of Arizona v. Google, LLC, Maricopa County Superior Court Case No. CV 2020-006219.
2  In re Google Location History Litigation, Case No. 18-cv-05062.
3  Brown v. Google LLC, Case No. 20-cv-03664.
4  Rodriguez v. Google LLC, Case No. 20-cv-04688 (N.D. Cal.).