Google has agreed to pay US$1.375 billion to settle data privacy allegations from Texas. The settlement resolves two lawsuits claiming the company misused data through products like Incognito mode and Location History.

Google did not admit wrongdoing as part of the agreement.

Texas Attorney General Ken Paxton accused Google of collecting facial geometry and voiceprints without consent.

He also alleged the company tracked locations even when users thought the feature was disabled, and misled users about Incognito mode’s privacy. These allegations stemmed from lawsuits filed in 2022.

Google said the settlement addresses issues related to updated product policies but does not require changes to its current products. The allocation of the settlement funds has not been disclosed.

🔗 Source: Reuters

🧠 Food for thought

1️⃣ State attorneys general are driving unprecedented privacy enforcement

The $1.375 billion Google settlement represents a dramatic escalation in how state authorities are holding tech companies accountable for privacy violations, far beyond previous regulatory actions.

This Texas settlement dwarfs previous state-level privacy penalties against Google, with the next highest being just $93 million1, demonstrating how individual states are establishing themselves as powerful privacy enforcers.

Texas Attorney General Ken Paxton has now secured two of the largest privacy settlements in U.S. history within a year, following a $1.4 billion settlement with Meta in 2024 over facial recognition violations2.

These state-led actions significantly outpace federal enforcement, as evidenced by the FTC’s $170 million settlement with Google in 2019 over YouTube’s children’s privacy violations3, which was considered record-breaking at the time.

The trend shows states taking increasingly assertive roles in defining privacy standards and penalties, creating a complex regulatory landscape for tech companies where individual state actions can have billion-dollar consequences.

2️⃣ Financial penalties are replacing product changes in privacy enforcement

The Google settlement highlights how monetary penalties are becoming the primary enforcement mechanism in privacy cases, rather than mandated product changes or operational restrictions.

Despite the unprecedented financial penalty, this settlement “does not require Google to make changes to its existing products or policies”45, suggesting regulators are focusing on punitive damages rather than structural reforms.

Recent Google developments