Google ordered to pay $425m in privacy class action lawsuit

A federal jury in San Francisco has ordered Google to pay US$425 million in a class action lawsuit over privacy violations.

The case involved allegations that Google collected and used data from millions of users who had disabled a tracking feature in their accounts over an eight-year period.

The jury found Google liable on two out of three privacy claims but did not award punitive damages, saying the company had not acted with malice.

Google plans to appeal, arguing that the data was encrypted and not linked to individual users.

The lawsuit covers around 98 million users and 174 million devices. Users had sought more than US$31 billion in damages.

Google has faced other privacy lawsuits, including a US$1.4 billion settlement with Texas and an April 2024 agreement to delete billions of private browsing records.

🔗 Source: Reuters

🧠 Food for thought

1️⃣ Google’s privacy penalties show escalating pattern over more than a decade

The $425 million verdict represents the latest in a series of privacy-related penalties that have grown substantially over time.

Google previously paid $170 million in 2019 for violating children’s privacy laws on YouTube1, $39.5 million for cookie placement violations2, and $22.5 million in 2012 for misleading Safari users about tracking practices3.

This progression from $22.5 million to $425 million over 13 years suggests that regulatory enforcement is becoming more aggressive, even as Google’s practices have continued to raise privacy concerns.

The pattern spans multiple jurisdictions and violation types, from children’s data collection to location tracking to web browsing surveillance, indicating these aren’t isolated incidents but part of broader data collection practices.

2️⃣ User control settings create widespread confusion about actual data collection

The current case highlights a fundamental disconnect between what users believe privacy settings accomplish versus what actually happens behind the scenes.

Similar confusion emerged in Google’s Australian case, where the ACCC alleged users believed turning off “Location History” would stop all location data collection, when in fact both “Location History” and “Web & App Activity” settings needed to be disabled4.