Saturday, June 10, 2023 | Back issues
Courthouse News Service Courthouse News Service

Google Must Face Claims on Third-Party Data Access

(CN) - Disgruntled Android users may advance claims that Google collected and distributed their personal data, a federal judge ruled.

Consolidated last year in San Francisco, the class action claims that Google "gained and allowed third parties to have unauthorized access to, and engaged in unauthorized use of" mobile devices that used the Android operating system.

Applications such as Foursquare, Groupon, Advanced Task Killer, Angry Birds and Pandora allegedly "collected personal data from their Android mobile phones and shared this data with" Google.

Users say they were "unaware of and did not knowingly consent to collection of the data," which included "class members' home and workplace locations and current whereabouts; several universally unique device identifiers assigned to plaintiffs' Android mobile phones; other device-specific data that was useful to Google and third parties for purposes of 'device-fingerprinting' (i.e., the creation of a back-up unique identifier to engage in tracking of a particular device); along with personal information about plaintiffs such as their gender and age, what functions plaintiffs performed on apps, search terms entered, and selections of movies, songs, or restaurants."

Google has said users had to "opt-in" to location tracking, but the plaintiffs claimed that the company continually stored location data transmitted to the company each time location services were enabled - exposing users to data overage charges and decreased battery life.

U.S. District Judge White refused to dismiss certain claims Wednesday, finding that, though Google may not have manufactured the mobile devices that allegedly suffered impaired-battery performance, users "alleged sufficient facts to show that they suffered an injury," which "is fairly traceable to Google's conduct."

The class failed, however, to show that they incurred a damage or loss under the Computer Fraud and Abuse Act (CFAA), according to the unpublished ruling.

"In order to pursue a civil action under the CFAA, plaintiffs also must show economic damage or loss in the amount $5,000," White wrote. "Plaintiffs allege that a new battery could cost $70. However, none of the plaintiffs allege that they did purchase new batteries because of Google's conduct. The court concludes that the allegations regarding diminished battery life still are insufficient to allege that the economic damage or loss - even if aggregated - would reach the $5,000 threshold required by the CFAA."

The plaintiffs "rely on allegations that they paid for their data plans, and that Google 'used or allowed the use of a finite amount of' their data plans," White added. "Again, none of the named plaintiffs alleged that they incurred any overage charges. Rather, they only allege that they were 'potentially' exposed to overage charges. The court concludes that the allegations regarding 'loss' based on 'data plan utilization' are insufficient to allege that the economic damage or loss - even if aggregated - would reach the $5,000 threshold required by the CFAA."

Though Google had wanted to dismiss non-California plaintiffs, White said the company presented "no argument" as to why Texas and Alabama law would conflict with California law. He also preserved a claim for restitution after finding that the users may be able to show an ownership interest in Google's profits.

The company fared better, however, in dismissing claims under the unlawful prong of the California unfair competition, but it failed to upend the the unfair and fraudulent prongs.

White scheduled a case management conference for April 18. The parties' joint case management statement must be filed by April 11.


Read the Top 8

Sign up for the Top 8, a roundup of the day's top stories delivered directly to your inbox Monday through Friday.