Google will delete billions of records it scooped from “Incognito” mode web browsing of about 136 million U.S. users but will continue to collect data through the not-so-private browser setting — it just has to disclose the grab.
That’s the result of a settlement in a long-running, bitterly fought class-action lawsuit that saw Google, according to a new court filing, sanctioned repeatedly by a federal court judge for hiding information from the other side’s lawyers.
Three Californians and two others sued the Mountain View internet-search and digital-advertising giant in 2020, alleging that through Incognito data gobbling it knew “the most intimate and potentially embarrassing things you browse on the internet — regardless of whether you follow Google’s advice to keep your activities ‘private.’ ”
George Orwell, the lawsuit said, “could never have dreamed it.”
Judge Yvonne Gonzalez Rogers in an order last year agreed with the plaintiffs that anyone using Incognito on Google’s Chrome browser could reasonably deduce from the opening screen that Google would not take their data.
The plaintiffs sought $5 billion in damages on behalf of affected users estimated to amount to about 40% of the U.S. population. Google said Tuesday that it did not agree to pay anything.
According to the settlement terms outlined in a court filing Monday by the plaintiffs’ lawyers, Google must delete or anonymize billions of user records that it was alleged to have grabbed deceptively. It does not have to stop hoovering up the data but must change the language on the opening screen of an Incognito browser window and in its privacy policy to make clear what it is taking. Already, the company has altered the screen, replacing the words “now you can browse privately” with “you can browse more privately.”
Central to the lawsuit was the plaintiffs’ claim that although Google told Chrome users that in Incognito it would not save browsing history or website-visit data, it kept tracking them via the vast number of websites using Google’s advertising technology.
Gonzalez Rogers, in an order in August rejecting Google’s bid to throw out the case, cited the company’s “failure to explicitly notify users it would be among the third parties recording their communications with other websites.”
The settlement “squarely addresses that failure,” said the plaintiffs’ notice of the settlement terms, filed Monday in Oakland U.S. District Court. The Incognito opening screen previously warned that “Your activity might still be visible to websites you visit.” Now, under a change made by Google to comply with the settlement, it has added that using the mode “won’t change how data is collected by websites you visit and the services they use, including Google.”
Google’s privacy policy, under the settlement, must disclose that when people use Incognito, third-party websites and apps using Google services may share data with Google.
The lawsuit claimed Google’s data collection, including via Incognito, allowed it to create a “cradle-to-grave profile” of any user. “Google’s ability to associate a particular user’s online activity with his identity … is unquestionable,” the lawsuit said.
The company insisted Tuesday that it does not link Incognito mode data to particular people.
“We never associate data with users when they use Incognito mode,” company spokesman José Castañeda said in a statement. “We are happy to delete old technical data that was never associated with an individual and was never used for any form of personalization.”
The plaintiffs’ notice alleged that Google had been able to identify Incognito users with high probability by combining browser data with the internet-protocol addresses that identify devices on the internet or local networks. Under the deal, Google will partially redact IP addresses it collects and alter the way it gathers browser information, the notice said.
Bitterness over the contentious legal action was evident from both sides this week.
“Google not only resisted disclosure of key evidence but also engaged in (legal) misconduct,” said the plaintiffs’ notice. “The efforts to obtain this evidence and hold Google accountable was a trial unto itself.”
A judge sanctioned Google several times for violating court orders and breaking document-production rules, the notice said, citing court orders that remain sealed from public view.
Google, in responding to the settlement terms, called the lawsuit meritless. “The plaintiffs originally wanted $5 billion and are receiving zero,” spokesman Castañeda said.
According to the plaintiffs’ notice, every class member retains the right to sue the company.
The plaintiffs’ notice said Google employees sought for years to simplify the disclosures on Incognito’s opening screen to prevent users from arriving at “incorrect conclusions.”
“Google’s executives at the highest levels were aware of these concerns, but nothing changed,” the notice said.
Google and plaintiffs Chasom Brown, Christopher Castillo and Monique Trujill,o of California, William Byatt, of Florida, and Jeremy Davis, of Arkansas, said in a December court filing they had reached a deal but did not disclose details. A judge must approve the settlement.