By Drew Apperson
Internet users may sometimes wish to browse private or sensitive content and keep their activity secret, such as when planning a vacation, reading political news, or assessing medical conditions. But is it possible to be online without websites tracking users’ activity and collecting their data? A private browsing feature like Google’s Incognito mode may come to mind. However, the U.S. District Court for the Northern District of California is considering claims that even in Incognito mode, Google has been collecting personal and identifying data, regardless of users’ internet browsers, search engines, or other cautionary steps taken to safeguard online privacy.[1] The plaintiffs in the case claim that Google does so for anyone who searches via Google, uses Google Chrome, or so much as views a website that has a Google advertising service, which allegedly includes over 70% of websites.[2]
The court found that the claims have weight, too: Judge Koh signed an order on March 12, 2021 denying Google’s motion to dismiss any of the plaintiffs’ allegations.[3] The court found that the plaintiffs have adequately alleged: (1) that neither users nor third-party websites consented to Google’s data collection;[4] (2) that Google’s actions constituted fraudulent concealment;[5] and (3) that Google’s actions violate the Wiretap Act, California Invasion of Privacy Act, and California Comprehensive Computer Data Access and Fraud Act (CDAFA).[6] Maybe the most noteworthy of the claims withstanding the motion to dismiss are those of intrusion upon seclusion and invasion of privacy,[7] especially given Facebook’s recent history.
In July of 2019, The Federal Trade Commission imposed a $5-billion penalty for Facebook implementing and monetizing deceptive data collection methods.[8] The FTC reported that the penalty “is the largest ever imposed on any company for violating consumers’ privacy and almost 20 times greater than the largest privacy or data security penalty ever imposed worldwide. It is one of the largest penalties ever assessed by the U.S. government for any violation.”[9] The FTC explained that “[t]he magnitude of this penalty resets the baseline for privacy cases . . . and sends a strong message to every company in America that collects consumers’ data: where the FTC has the authority to seek penalties, it will use that authority aggressively.”[10] Then last April, the Ninth Circuit, which has appellate jurisdiction over this case, ruled against Facebook concerning its data collection program that continued tracking users’ activity after they had logged out of their accounts.[11]
One might think that every website within U.S. jurisdiction would have revised its data collection scheme accordingly. Yet, the court here found significant similarities between Google’s alleged data collection and that by Facebook, noting that Google’s “vast amount of data was collected secretly, without any notice to users,” and that “internal Google communications show that the company’s employees recognized that its privacy disclosures were problematic.”[12] Furthermore, the court highlighted Google’s concession to the significant similarity between the cases.”[13]
The court went further than just equating Google’s data to Facebook’s, though: Judge Koh stated that the “allegations regarding the sensitivity of the data collected are arguably even stronger in the instant case,” and that there is “an even stronger argument that Google’s intrusion was highly offensive because, at the time Google collected the data, [the plaintiffs] were using private browsing mode, which is often used to prevent others from learning the user’s most private and personal interests.”[14]
The order only denied a motion to dismiss, though, so Google still has a chance. However, the court’s attitude may be foreshadowing an enhanced burden on Google. Furthermore, the FTC will likely not be pleased that its penalties on Facebook apparently did not resonate as much as it had hoped.[15] So how should internet users proceed in the meantime when browsing private or sensitive content? They may well assume that Incognito mode or any other private browsing mode is not actually private at all.
[1] Brown v. Google LLC, No. 20-CV-03664, 2021 U.S. Dist. LEXIS 48380, at *3–9 (N.D. Cal. Mar. 12, 2021) (order denying motion to dismiss).
[2] Id.
[3] Id. at *67.
[4] Id. at *31, 34.
[5] Id. at *41.
[6] Id. at *47, 51, 53.
[7] Id. at *67.
[8] FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook, Fed. Trade Comm’n (July 24, 2019) https://www.ftc.gov/news-events/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions.
[9] Id.
[10] Fed. Trade Comm’n, Statement of Chairman Joe Simons and Commissioners Noah Joshua Phillips and Christine S. Wilson Regarding the Matter of Facebook, Inc., at 2 (July 24, 2019), https://www.ftc.gov/system/files/documents/public_statements/1536946/092_3184_facebook_majority_statement_7-24-19.pdf.
[11] See Davis v. Facebook, Inc. (In re Facebook Inc. Internet Tracking Litig.), 956 F.3d 589 (9th Cir. 2020), cert. denied, 2021 U.S. LEXIS 1480 (U.S., Mar. 22, 2021) (No. 20-727).
[12] Brown, 2021 U.S. Dist. LEXIS 484380, at *60, 65–66.
[13] Id. at *59.
[14] Id. at *59–60, 65.
[15] See Fed. Trade Comm’n, supra note 10.
Image Source: “Is your boss spying on you” by topgold is licensed underCC BY 2.0