Judge advances most claims in Chrome incognito mode privacy case

SAN FRANCISCO (CN) — A federal judge declined Wednesday to dismiss the majority of claims brought by Google Chrome users who claim the tech giant collected their personal information without permission, even after they chose not to sync their browser with their Google accounts.

U.S. District Judge Yvonne Gonzalez Rogers denied Google’s motion to dismiss four of the six claims brought against the company, including violations of the Wiretap Act and California Comprehensive Computer Data Access and Fraud Act, invasion of privacy and declaratory relief.

Rogers, a Barack Obama appointee, rejected all three of Google’s arguments against the plaintiffs’ wiretap claims, frequently citing past rulings by U.S. District Court Judge Lucy Koh, a fellow Obama appointee, who oversaw the case before being elevated to the Ninth Circuit Court of Appeals in late 2021.

Previously, Google argued website developers “plainly consented” to Google receiving plaintiffs’ data because they intentionally installed the Google code that sends the plaintiffs’ data to Google.

“First, Judge Koh already rejected a similar argument from Google in the first round of motion to dismiss briefing in this case,” Rogers said. “ … Without additional factual allegations that demonstrate actual consent, the court will not depart from Judge Koh’s sound reasoning.”

As for Google’s claim that it received the plaintiffs’ data in the “ordinary court of business,” Rogers relied on Koh’s previous rulings in Brown v. Google LLC, a separate but similar case involving the company tracking users despite the use of incognito mode.

“Judge Koh reasoned that ‘Google’s argument to the contrary would vastly expand the ordinary course of business exception by permitting electronic communication services to claim that an interception is in the ordinary course of business when it facilitates another, unrelated communication.’” Rogers said.

Rogers also cited Koh’s rulings in Brown when declining to dismiss plaintiffs’ claims under the  CDAFA, finding that plaintiffs’ sufficiently claimed Google acted without permission, accessed plaintiffs’ computers, and that they suffered damage.

She additionally echoed Koh in finding the plaintiffs had a reasonable expectation of privacy in assuming Google did not have access to their data unless they turned on sync, as well as that Google’s actions were serious or highly offensive.

“Here again, Judge Koh rejected Google’s argument that its interceptions were routine and consistent with tracking practices and thus could not satisfy the element. The court concluded that while ’tracking cookies are routine,’ ‘[b]ased on the pled facts, a reasonable factfinder could indeed deem Google’s conduct ‘highly offensive,’" Rogers said.

The judge also tossed out Google’s argument that it did not intercept users’ “intended messages” but rather just generalized information about their computers and browsing activity, finding that communications like full-string URLs were enough to satisfy an intended message under the Wiretap Act.

The judge further denied Google’s request to dismiss the claim for declaratory relief, but opted to dismiss claims of quasi-contract and punitive damages.

She directed Google to file an answer to the claims within 10 days.

Representatives for either party did not respond immediately to a request for comment.

The plaintiffs originally sued in 2020. In their complaint, they claim they believed their choice not to sync Chrome with their Google accounts meant that certain personal information would not be collected and used by Google. They claimed Google sends personal information, including browsing history, cookies and IP addresses, whether a user elects to sync or even has a Google account.

Google did not deny collecting the plaintiffs’ data while using Chrome in an un-synced mode. Instead, it asserted that they consented to this data collection when they agreed to Google’s privacy policy.

The federal court agreed, ruling that the at-issue data collection was not specific to Chrome but was browser-agnostic — meaning Google would have collected the data regardless of which browser was used. The federal court ruled in favor of Google in 2022, saying the tech giant’s general policies applied.

The plaintiffs then appealed to the Ninth Circuit, where a panel of appeals judges unanimously overturned the lower court’s ruling and remanded the case, finding that the court’s “browser agnostic” ruling was irrelevant because the lower court should have used the reasonable person test instead.

Follow @mhattridge_