Google Chrome Settles Suit for Tracking Chrome Users in Incognito Mode

Google recently resolved its fourth case in four months, agreeing to delete billions of data records it compiled about millions of Chrome browser users, according to a legal filing. The suit, Chasom Brown, et al. v. Google, said the company had misled users by tracking their online activity in Chrome’s Incognito mode, which they believed would be private. Relevant here, individual plaintiffs brought this suit on behalf of two classes: Class 1, for Incognito users, and Class 2, for users of other private browsing modes. The grounds being invasion of privacy, unauthorized interception under the Wiretap Act; violation of CIPA; violation of CDAFA and intrusion upon seclusion.

Since December, Google has spent well over $1 billion to settle lawsuits as it prepares to fight the Justice Department, which has targeted Google’s search engine and its advertising business in a pair of lawsuits.

In December, Google resolved a suit with dozens of attorneys general claiming it strong-armed app makers into paying high fees. Six weeks later, the company settled a case that accused it of improperly sharing users’ private information from its defunct social media site, Google+. And in March, Google agreed to pay a Massachusetts company, Singular Computing, an undisclosed sum after being accused of stealing patent designs — a claim that Google denies.

To bring an end to the Incognito mode claims, Google committed “to rewrite its disclosures to inform users that Google collects private browsing data,” said the settlement, which was filed on Monday with the U.S. District Court for the Northern District of California. Users are already able to see the disclosure on the landing page when they open Incognito mode.

Google agreed, for the next five years, to maintain a change to Incognito mode that blocks third-party cookies by default, which limits how much web users can be tracked by sites.

“This requirement ensures additional privacy for Incognito users going forward, while limiting the amount of data Google collects from them,” the plaintiffs’ lawyers, led by David Boies, the high-profile attorney, said in the filing.

Google will also stop using technology that detects when users enable private browsing, so it can no longer track people’s choice to use Incognito mode. While Google will not pay plaintiffs as part of the settlement, individuals have the option of suing the company for damages.

Google said in a statement that the suit had been meritless.

A trial was scheduled to start in early February, though the parties said in December that they had agreed to settle.

“The settlement stops Google from surreptitiously collecting user data worth, by Google’s own estimates, billions of dollars,” Mr. Boies said.

The Law

CDAFA

The California Comprehensive Computer Data Access and Fraud Act is in §502 of the California Penal Code. According to the State Administrative Manual of California, the purposes is as follows:

The Comprehensive Computer Data Access and Fraud Act (Penal Code Section 502) affords protection to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems. It allows for civil action against any person convicted of violating the criminal provisions for compensatory damages.Intrusion on seclusion is one of the four privacy torts created under U.S. common law.

Intrusion on seclusion is commonly thought to be the bread-and-butter claim for an "invasion of privacy." Seclusion is defined as the state of being private and away from people.

CIPA

The Children's Internet Protection Act (CIPA) was enacted by Congress in 2000 to address concerns about children's access to obscene or harmful content over the Internet. CIPA imposes certain requirements on schools or libraries that receive discounts for Internet access or internal connections through the E-rate program – a program that makes certain communications services and products more affordable for eligible schools and libraries. In early 2001, the FCC issued rules implementing CIPA and provided updates to those rules in 2011.

Violation of UCL

California’s Unfair Competition Law (UCL) is one of the most important consumer protection laws in the country. California courts tend to interpret the UCL broadly so that it applies to a wide range of unethical business practices. The statute explicitly prohibits companies from engaging in unlawful, unfair, or fraudulent business actions. It also prohibits companies from using false advertising. Businesses that violate the UCL may be subject to penalties that include financial compensation, monetary fines, and injunctions to stop committing certain acts. This means that consumers who purchase a product or service from a business that violates the UCL may be able to have an experienced California consumer fraud lawyer file a lawsuit and seek financial restitution.

Unauthorized interception under the Wiretap Act -18 U.S. Code § 2511 - Interception and disclosure of wire, oral, or electronic communications prohibited

The Electronic Communications Privacy Act (“ECPA”) was passed in 1986 to expand and revise federal wiretapping and electronic eavesdropping provisions. It was enacted to create promote ” the privacy expectations of citizens and the legitimate needs of law enforcement.” Congress also sought to support the creation of new technologies by assuring consumers that their personal information would remain safe.

Individuals who violate ECPA face up to five years in prison and fines up to $250,000. Victims are also entitled to bring civil suits and recover actual damages, in addition to punitive damages and attorney’s fees, for violations. The United States itself cannot be sued under ECPA, but evidence that is gathered illegally cannot be introduced in court.