(CN) – A British appeals court ushered forward a class action Wednesday alleging that Google secretly tracked the internet activity of more than 4 million users of Apple iPhones for six months.
Though the Queens Bench refused to let consumer rights activist Richard Lloyd serve the Delaware-based Google outside its jurisdiction, the United Kingdom’s Court of Appeal says Lloyd and fellow iPhone need not show that Google actually used the data it mined to claim damages.
The Queen’s Bench had dismissed the application for failing to show either that the tracking activity caused damage or that members of the class could be said to have a common interest.
Sir Geoffrey Vos, chancellor of the High Court, wrote for a unanimous three-judge panel today, however, that the lawsuit could “call Google to account for its allegedly wholesale and deliberate misuse of personal data without consent.”
The complaint sprouted from Google’s assurance to users of its web browser Safari that third-party text files known as cookies are blocked automatically, and that iPhone browser settings did not need to be changed to protect privacy.
Lloyd contends that, in breach of these promises, Google circumvented Safari’s cookie-blocking settings between August 2011 and February 2012 to track iPhone users’ online surfing activity, as well as demographic information, through Safari.
The information allegedly helped Google herd its users in such groups as “football lovers” or “current affairs enthusiasts” so that its subscribing advertisers could take their pick.
For Wednesday’s appellate panel, internet cookies have economic value because they can be sold to advertisers.
“The underlying reality of this case is that Google was able to sell BGI collected from numerous individuals to advertisers who wished to target them with their advertising,” Vos wrote. “That confirms that such data, and consent to its use, has an economic value.”
Vos also emphasized that this was not just a case of one-off data breaches quickly remedied but a systematic violation of privacy. “On the case pleaded, every member of the represented calss has had their data deliberately and unlawfully misused, for Google’s commercial purposes, without their consent and in violation of their established right to privacy,” Vos wrote.
The court stopped short, however, of deciding the exact kinds of damages Lloyd and the iPhone users could recover.
In a tweet, Lloyd — the former CEO of the international watchdog group Consumer International — called the ruling a “landmark win.”
Google said it will appeal. “Protecting the privacy and security of our users has always been our number one priority,” the company said in a statement. “This case relates to events that took place nearly a decade ago and that we addressed at the time. We believe it has no merit and should be dismissed.”
In August 2012, Google paid a $22.5 million fine to the U.S. Federal Trade Commission over the data breach, which was noted as the largest FTC fine at the time for a violation of a commission order.