Ninth Circuit revives Google Chrome data collection class action

SAN FRANCISCO (CN) — A proposed class of Google Chrome users who said Google collected their personal information without permission even after the users chose not to sync their browser with their Google accounts will have a second chance in court after a Ninth Circuit Court of Appeals panel ruled Tuesday to resurrect their lawsuit.

In a unanimous decision, the panel in San Francisco ruled that a federal court improperly entered summary judgment in Google’s favor because it should have reviewed the terms of Google’s various disclosures and decided whether a reasonable user reading them would think that he or she was consenting to the data collection.

U.S. Circuit Judge Milan Smith Jr., a George W. Bush appointee, wrote in a 23-page order that the federal court’s “browser agnostic” — meaning Google would have collected the data regardless of which browser was used — ruling was irrelevant because the lower court should have used the reasonable person test instead.

“By focusing on ‘browser agnosticism’ instead of conducting the reasonable person inquiry, the district court failed to apply the correct standard, despite its recitation of it. Viewing this in the light most favorable to plaintiffs, browser agnosticism is irrelevant because nothing in Google’s disclosures is tied to what other browsers do,” Smith wrote. “And that is because the governing standard is what a ‘reasonable user’ of a service would understand they were consenting to, not what a technical expert would.”

The plaintiffs originally sued in 2020. In their complaint, they claim that they believed that their choice not to sync Chrome with their Google accounts meant that certain personal information would not be collected and used by Google. They claimed Google sends personal information, including browsing history, cookies and IP addresses, whether a user elects to sync or even has a Google account.

Google did not deny collecting the plaintiffs’ data while using Chrome in an un-synced mode. Instead, it asserted that they consented to this data collection when they agreed to Google’s privacy policy.

The federal court agreed, ruling that the at-issue data collection was not specific to Chrome but was browser agnostic. The federal court ruled n favor of Google in 2022, saying that the tech giant’s general policies applied. The plaintiffs then appealed.

The plaintiffs also argued that Google’s Chrome privacy notice made representations about data collection beyond sync-enabled data.

For example, the Chrome privacy notice states that “You don’t need to provide any personal information to use Chrome” and that “Privacy practices are different depending on the mode you’re using.”  Smith wrote that this language could also confuse a reasonable user reading them about what data Google collects.

“Although Google argues that the reference to ‘personal information’ is sufficient to indicate which subset of data the Notice controls, together, these statements could suggest that the ‘personal information’ the Chrome Privacy Notice addresses includes cookies and IP addresses,” Smith wrote. “Based on these arguments, the district court should have reviewed the terms of the various disclosures and decided whether a reasonable user reading them would think that he or she was consenting to the data collection, which collection Google has not disputed.”

Because applying the correct standard reveals disputes of material fact regarding whether a reasonable user of Google Chrome consented to Google’s data collection, the panel remanded the case to federal court for a possible trial, assuming a plaintiff class is certified.

Neither Google nor its lawyers responded to requests for comment before this story was published. Lead counsel for the plaintiffs did not respond before deadline.