OAKLAND, Calif. (CN) — Google largely failed Tuesday to dismiss a class action that says the company is illegally selling users’ personal information in auctions for ad space.
U.S. District Judge Yvonne Gonzalez Rogers denied all but one of Google’s motions to dismiss claims it faces from a large group of account holders. The customers accused the company of having violated state and federal law by promising that it does not sell account holders' personal information to third parties, while repeatedly selling the data through real-time bidding auctions to advertisers.
Google has faced class action lawsuits before over location sharing without permission, although a judge has sided with the Silicon Valley giant before when dismissing claims that the business surreptitiously seized users’ data.
The plaintiffs allege Google solicits participants to bid on sending an ad to people, using data about each person in a bid request provided to the auction. This includes data that identifies people through device identifiers, geolocation and IP address and highly detailed personal profile information about peoples’ interests, race, religion, sexual orientation and health.
Auction participants receive information about users and compete for space to send advertisements, with the winning bidder paying Google. Even participants who do not win or place a bid collect the personal data. Google also allows “surveillance participants” who have no interest in filling an ad space but participate in auctions to get access to users’ personal information. The plaintiffs argued all of these practices earn revenue for Google and that the company does not disclose the auction practice or obtain consent from account holders.
Gonzalez Rogers granted dismissal of only one count against Google, a breach of covenant claim that she found the plaintiffs had failed to substantiate. The judge agreed that plaintiffs did not adequately allege that the disclosure and sale of their personal information was prompted by bad faith or that claims go beyond the breach of contract claims.
But the judge denied all of Google’s other reasons to dismiss the case. She said the group sufficiently alleged injury due to the company’s practices and plausibly argued a breach of contract, based on Google’s sharing and selling of plaintiffs’ personal information as part of real time bidding. She also stated the plaintiffs provided enough information to show that the company’s disclosure and sale of information to thousands of bidders without users’ prior knowledge or consent is sufficient.
The judge agreed with plaintiffs citing the language found in Google’s privacy policy, which states “we don’t share information that personally identifies you with advertisers” as well as a “How Our Business Works” page which makes the promise that Google never sells personal information.
Google also said no actual breach of the privacy policy can be alleged because plaintiffs do not allege that Google shared any information. But Gonzalez Rogers wrote “Not so,” saying the plaintiffs “have alleged enough facts to draw a reasonable inference that their personal information had been shared by Google by way of the RTB process.” She added the information in the case falls within the definition of personal information defined by state law and Google’s privacy policy.
Gonzalez Rogers also said the class action did successfully claim that plaintiffs have a reasonable expectation of privacy. When Google argued that such information is routinely shared, she rejected their stance on two grounds.
“First, such information is personal information under California law and parties generally maintain a reasonable expectation in their personal information,” Gonzalez Rogers wrote. She also cited the Ninth Circuit’s decision in Facebook Tracking that plaintiffs adequately alleged a reasonable expectation of privacy when Facebook allegedly collected and created “highly personalized profiles from [plaintiffs’] sensitive browsing histories and habits.”
The judge also said the plaintiffs gave evidence that Google sold and disclosed confidential information like their internet communications, which fall within the definition of content protected from being intercepted or disclosed under the Wiretap Act.
“With respect to consent, Google repeats its argument that plaintiffs were provided sufficient notice of the challenged conduct and were told that they could opt out of personalized ads but chose not to do so. Again, these arguments fail,” the judge wrote.
Google has 21 days to respond to the order. The company’s legal counsel was not available to comment. The next case management conference is set for Aug. 22.
Follow @nhanson_reports
Subscribe to Closing Arguments
Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.
