Google’s Trial Loss Shows Distaste of Complicated Privacy Terms

Google LLC’s loss in one of the first major privacy trials against the search giant resulting in a $425.7 million penalty signals the public’s distaste for the long and complicated privacy policies used by tech platforms that often obscure how the data of a consumer is used.

But that damages award—a fraction of the $31 billion the plaintiffs asked for—may not ultimately be sufficient to create industry-wide change in how tech companies present their privacy policies to users.

Google earlier this year agreed to settle a pair of privacy cases for $1.4 billion from the Texas attorney general over personal location tracking and facial recognition data.

An eight-person jury determined after 10 hours of deliberation in a San Francisco federal court that Google had invaded the privacy of 98 million users who turned off a switch in their account settings, known as Web & App Activity, that purportedly stopped the company from tracking their data, when it actually continued to do so.

The jury in the US District Court for the Northern District of California rejected Google’s defense that the users had actually consented to the tracking because the company’s privacy policies stated that turning off the toggle would still allow collection of anonymized data.

Jury foreperson Michael Bowman told attorneys and journalists after the verdict was announced that a key point for the jury was Google’s consent language, which he said “should be a little more obvious” to users.

“The average user is probably not a reader, the average user is probably a skimmer,” he said. “We tried to put ourselves in the shoes of an average user.”

Privacy groups applauded the verdict. F. Mario Trujillo, a staff attorney at the digital rights organization Electronic Frontier Foundation, said the case is unique in that consumer privacy cases rarely reach a trial.

“The outcome shows that juries made up of regular people understand privacy harm better than most lawyers,” he said. “That said, it will take a lot more than $425 million for a giant company like Google to completely change.”

Google said after the verdict that it plans to appeal the decision, and that the verdict misunderstands how its products work.

Privacy Toggle

At the center of the almost three-week trial is the nature of Google’s Web & App Activity account setting that users can toggle on and off.

The plaintiffs argued that from 2016 through 2024, Google had deceived users into believing that toggling off the setting would prevent the company from tracking their activity across third-party apps that used Google’s back end data analytics services.

During opening and closing statements at the trial, plaintiffs’ attorney David Boies of Boies Schiller Flexner LLP directed the jury to a number of internal emails from Google software engineers saying the company’s privacy policy language and Web & App Activity terms appeared misleading.

Boies compared that to 2018 Congressional testimony of Google CEO Sundar Pichai who said users would have almost complete control over what data Google collects.

Google’s defense relied in large part on language in the Web & App Activity setting, including an “Are You Sure?” window that popped up as soon as a user turned off the setting. It stated that users who’ve turned off the setting can “learn about the data Google continues to collect and why” by clicking on an additional link that goes to a separate website.

The click-throughs and length of Google’s various policies were unconvincing to the jury.

“How can we honestly expect any individual, ordinary user to click on however many buttons that they need to and then read a multi-1,000 word privacy policy and then interpret that legalese written privacy policy,” said Ari Waldman, a privacy law professor at the University of California Irvine School of Law. “That’s just not how humans work.”

Even if Google were to rework the language of its privacy disclosures and consent policies to be more comprehensible to the average user, the user still needs to find and read the policy, Waldman said.

“If we’re thinking about how the average user behaves, as opposed to how the average user could comprehend a privacy policy, those are two very different things,” he said.

Although the jury determined Google’s lack of transparency over the toggle was “offensive conduct” under the California Constitution’s invasion of privacy and intrusion upon seclusion standards, it declined to award punitive damages.

The case is among a trio of privacy-related cases brought in California federal court against Google.

The company last year settled a class action involving claims that it misled users about the privacy of the Incognito mode on its Chrome web browser, resulting in data deletion and internal policy changes but no monetary awards.

In another case, plaintiffs revived their lawsuit alleging Google continued to track their data even when they didn’t “sync” their Google account to Chrome, with the Ninth Circuit reasoning that an average user likely didn’t understand what data they were giving up. But a trial judge this year declined to certify the case as a class action.

The $425 million compensatory damages award was also far less than the $31 billion the plaintiffs requested at the end of the trial. But the case could provide a signal that goes beyond the monetary awards.

“A verdict like this is an anchoring point that could affect negotiations in active privacy cases,” said Alan Butler, president of the Electronic Privacy Information Center. “It’s a baseline for a privacy case of this scale, in terms of the number of users impacted, that I think will definitely affect other cases.”