It’s a feeling that most people have had: going into their Google account settings, turning off “Web & App Activity,” and then feeling… relieved. It felt like you got a little bit of yourself back from the machine. For millions of people, that relief was in the wrong place.
In September of last year, a federal jury in California found Google guilty of two counts of privacy violations. The jury found that the company continued to collect user data even after users turned off data-tracking settings in their accounts. Google will have to pay $425 million. The case, Rodriguez v. Google LLC, was first filed in July 2020 and involves about 98 million users. This number alone shows how big the plaintiffs say what they say was going on behind the scenes of everyday internet use was.
The main charge isn’t hard to understand, but the legal language around it is. Someone turned off a setting. The jury said that Google kept collecting anyway. The lawsuit says that Google was getting into people’s phones to see what they were doing in non-Google apps that had Google’s own software code built into them. That is, it wasn’t just about Google Mail or Maps. It was about what was hidden inside the products of other companies.
Some of the story can be told from the numbers in Google Analytics. You can get a count of 44 million to a lot more websites that use Google’s analytics tools from different sources. The plaintiffs said that this tracking infrastructure is on 70% of websites. That number is hard to confirm independently, but the main point is still valid. In today’s internet world, it’s pretty much impossible to avoid Google Analytics unless you’re ready to give up the internet completely.
Google, for its part, says none of it is true. Their lawyers said that the privacy notices were clear and that the “Web & App Activity” setting was never meant to mean that all data collection permissions were taken away, not just for Google Analytics. The defendants said that the reading was meant to be vague. On two of the three counts, the jury leaned toward the plaintiffs. However, they did not find Google guilty of malice or fraud, which would have meant taking away the money it made from that data. Because of this, the plaintiffs had asked for a $2.36 billion payment. In January, that motion was turned down.
Now all that’s needed is a final judgment that keeps the $425 million amount in place, plus interest that has been building up since the verdict in September. Google has made an appeal, and if it is successful, the whole payout might not happen. The date for any individual distributions to class members is still not known. It’s still not clear if most of the 98 million people who are part of the lawsuit will ever get any money from it.
No matter what happens with the appeal, this case makes it clear that something is wrong with the way online privacy works right now. The settings are there. The language around them is often meant to be broad. There’s also a good chance that data is still being collected through code in third-party apps and websites even after users take the steps that seem like they should work. That isn’t being paranoid. What a federal jury thought after hearing the evidence was that.
People have long thought that if a company gives you a privacy setting and you use it, the company will respect it. This case seems to break that belief. In a strange way, Google’s legal defense shows that the setting users relied on never really did what they thought it would do. From a different point of view, that may be either a legal defense or an admission of something more troubling.
