Federal judge won't dismiss Google privacy suit over misleading data collection practices on Androids

SAN FRANCISCO (CN) — A federal judge rejected Google’s motion to toss a lawsuit from a class of plaintiffs who claim that the tech giant collected their data on Android devices without permission.

The class plaintiffs sued in 2020. At issue in the case is the Web and App Activity toggle in an Android device’s settings. Turning the toggle off prevents future web and app activity being saved to a user’s Google account.

The plaintiffs claim that Google invaded their privacy when it continued to collect their data even though they turned the Web and Activity toggle off on their Android devices, and that the toggle gives users the false impression that they can “opt out” of sharing all data with Google and third-party developers.

At a motion for summary judgment hearing before U.S. Chief District Judge Richard Seeborg in July, Google said the suit was meaningless because it only collects pooled, anonymized data to help app developers understand how consumers use their apps, not personalized, identifiable data, and that Google disclosed that to users that it did so.

Seeborg, a Barack Obama appointee, called Google’s argument “unconvincing” and denied summary judgment to Google, writing in a 20-page ruling issued late Tuesday night that the class complaint has plausibly claimed that Google’s practices go beyond basic record keeping, that reasonable users would be confused and that there are questions regarding damages and losses that preclude summary judgment.

“From the perspective of a reasonable user, it is unclear plaintiffs were consenting to the data collection at issue,” Seeborg wrote, adding that it was also not a foregone conclusion that the data collected by Google was not personalized, identifiable data, as Google had argued.

To back up his point, Seeborg pointed to internal Google communications between 2017 and 2020 where Google employees raised concerns that the purpose of the Web and Activity toggle was confusing to users.

“The concerns raised by Google employees are relevant, however, at the very least for tending to show that the WAA disclosures are subject to multiple interpretations. What is more, the remarks and Google’s internal statements reflect a conscious decision to keep the WAA disclosures vague, which could suggest that Google acted in a highly offensive manner, thereby satisfying the intent element of the tort claim,” Seeborg wrote.

Though Google maintains the explanation and purpose of the toggle is straightforward, Seeborg says the Android users’ California Comprehensive Computer Data Access and Fraud Act claims survive at this point because it is disputed at this point if Google knew or should have known that the plaintiffs revoked permission for Google to use any of their data when they turned the Web and Activity toggle off, Seeborg said.

Seeborg wrote, “As explained above, evidence produced by Google during discovery, including deposition testimony by Google employees, indicates that the description of WAA was ambiguous. Although Google disputes the applicability of that evidence, a reasonable juror could be convinced by either party’s argument regarding the WAA setting and Google’s [privacy policy].”

Google contended that even if it did not obtain direct permission to collect data from users, third-party app developers obtained permission as a condition of Google Analytics, allowing Google to collect the data because it was acting as a vendor to those third-party apps and permission granted by users to a technology company extends to vendors who process such data.

“Even assuming Google acted as a vendor, no court has endorsed the position that when one technology company acts as a vendor for another, consent for the purposes of CDAFA analysis is coextensive with the party that obtained it,” Seeborg wrote.

Neither counsel for the class plaintiffs or Google and its counsel immediately responded to requests for comment.