Google faces privacy lawsuit as judge highlights data governance concerns

A federal judge in San Francisco has ruled that a privacy lawsuit against Google, alleging the company improperly collected personal data from mobile devices, can proceed.

Chief Judge Richard Seeborg dismissed Google’s argument that it had sufficiently informed users about its Web & App Activity settings and obtained their consent for tracking, paving the way for a possible trial in August.

The lawsuit accuses Google of intercepting and saving browsing histories without user consent, even after tracking settings were disabled.

Judge Seeborg noted that reasonable users could view Google’s data practices as “highly offensive,” given the ambiguity in its disclosures and internal employee concerns about how the settings were communicated.

“Internal Google communications also indicate that Google knew it was being ‘intentionally vague’ about the technical distinction between data collected within a Google account and that which is collected outside of it because the truth ‘could sound alarming to users’,” Seeborg wrote.

The Judge noted that Google defended its practices by downplaying internal employee comments cited in the lawsuit, arguing they were focused on identifying technical improvements rather than raising privacy concerns. The company also said that some employees involved in these discussions lacked familiarity with the Web & App Activity (WAA) settings.

“The concerns raised by Google employees are relevant, however, at the very least for tending to show that the WAA disclosures are subject to multiple interpretations,” Seeborg added. “What is more, the remarks and Google’s internal statements reflect a conscious decision to keep the WAA disclosures vague, which could suggest that Google acted in a highly offensive manner, thereby satisfying the intent element of the tort claim.” 

Broader implications of the case

The legal battle against Google could have far-reaching implications for enterprise data governance, particularly in how companies handle user consent and transparency.

The case raises questions about whether current data collection practices align with user expectations and legal requirements, especially in an era where trust in technology firms is under heightened scrutiny.

“Enterprise data policies have typically assumed that vendors are not saving personal information unless there is some sort of opt-in policy,” said Hyoun Park, CEO and chief analyst at Amalgam Insights. “In particular, the argument that data capture ‘doesn’t hurt anyone’ is a red herring compared to the actual requirement for governance.”

However, while Google’s defense focuses on its own practices, the outcome of the case could drive the industry toward better transparency and accountability.

“Google obviously has to defend its actions and perspective, but my hope is that this finding leads to greater transparency,” Park added. “Obviously, one of the challenges of any complex data service, such as Google or Microsoft or Amazon, is the complexity of governance and administration associated with the data environment and the complicity of tracking the data and activity associated with any sort of service.”

The rise of artificial intelligence is adding complexity to data governance and privacy issues.

While the case focuses on the straightforward matter of capturing personal browsing data, the broader challenge lies in managing the tracking and governance of data-related activities, Park added.

Google’s legal woes continue

Google faces mounting legal challenges as scrutiny over its data practices and market dominance intensifies.

In August 2024, a US District Court ruled Google held a monopoly in online search, accusing the tech giant of using its market dominance to stifle competition.

In September, the European Union’s Data Protection Commission opened an inquiry into the company’s use of personal data.

However, analysts say Google may be able to limit reputational damage and bolster its standing with corporate clients with efforts to enhance privacy measures.

“This case underscores the growing scrutiny of Big Tech’s data practices and the increasing demand for transparency,” said Thomas George, president of Cybermedia Research. “How Google and other major tech companies respond to these expectations remains to be seen, as they strive to balance competitiveness with maintaining the trust of users and partners.”

Google has not responded to requests for comment.