Data collection despite incognito mode: Google must go to court

Even when Google users surf "incognito," Google collects data. A US lawsuit wants to change that. Google has tried to avoid the lawsuit - in vain.

Google is facing another US court case regarding data protection. Some users have sued Google because the company collects data even when users use the incognito mode of the Chrome browser. Google thus illegally invaded the privacy of millions of users. Google filed the usual motion to dismiss the case in the USA. However, the federal judge in charge, Lucy Koh, has now rejected this request.

The parties to the lawsuit can now prepare for the main trial. The core of the case is that Google collects data for user profiles via its own websites and countless third-party websites, even when users have activated the incognito mode. It does not help against this form of data collection. Google's position is that this is clear from the incognito start screen as well as the privacy conditions. The users would therefore have consented.

Neither users nor website operators have consented

Judge Koh is not convinced: contrary to its own assertion, Google has not shown that users have consented to the data collection. The notices in the Chrome browser's opening screen were misleading. Even if the users had consented, this would be ineffective because the data collection violates other laws, according to the lawsuit. Whether laws were actually violated is to be clarified in the main proceedings.

Also with regard to the website operators, Google had not shown, contrary to its claim, that they had implicitly consented to the data collection with incognito browsers by inserting Google code into their websites. It remains to be clarified whether Google has sufficiently informed the operators - because Google does not disclose in the description of the incognito mode that it itself continues to collect data. Implicit consent is not sufficient here either, because according to the lawsuit, Google collects the data in order to combine it into user profiles, and that would be illegal anyway.

Billions at stake

Google's argument that the accusations are time-barred is also rejected by the judge. Each interception of data is a separate offense and triggers a new statute of limitations. Moreover, the statute of limitations does not apply to fraudulent concealment. Finally, Google's claim that the plaintiffs did not make sufficiently specific allegations also falls flat. In her decision, the judge lists four concrete allegations against which Google will now have to defend itself in the main proceedings.

The plaintiffs assume that millions of Google users are affected by the possible violation of privacy. They set a damages claim of 5000 US dollars per user, which could ultimately add up to 5 billion US dollars. Google denies all the allegations made.

The mills grind slowly

Whether the proceedings can be conducted as a class action for all relevantly affected Americans, as desired by the plaintiffs, is still open. A hearing on the matter is scheduled for January 20, 2022. The case is called Brown et al v. Google et al and is pending in the U.S. District Court for the Northern California under Case No. 5:20-cv-03664.

The case is not to be confused with Anibal Rodriguez et al v. Google et al (ref. 5:20-cv-04688), also filed against Google by the same law firm in the same court. There, too, it is a matter of allegations of misleading privacy settings made against Google, albeit in the case of apps. Google also denies these allegations.