• by Wendy Davis  @wendyndavis, April 30, 2024

Google account holders have asked a federal appellate court to decide whether they can proceed with a class-action privacy claims stemming from the company's real-time bidding system.

U.S. District Court Judge Yvonne Gonzalez Rogers in the Northern District of California recently said the users couldn't seek monetary damages on a class-wide basis because their privacy claims would turn on whether they consented to Google's practices. Questions about consent would require the kind of case-by-case analysis that's inconsistent with class-action lawsuits, Rogers ruled.

That decision “effectively foreclosed use of the class-action device in data-privacy cases,” counsel for the users argued in a motion asking the 9th Circuit Court of Appeals to hear an immediate appeal.

While Rogers' ruling doesn't prevent individual users from attempting to sue Google, doing so can be prohibitively expensive.

Google on Monday asked the 9th Circuit to reject the account holders' request, arguing that the case doesn't present the kinds of “exceptional circumstances” that would justify an immediate appeal.

The company adds that Rogers “carefully weighed and credited significant evidence” supporting its argument that questions about users' consent were critical, and required individualized evaluation.

The privacy battle dates to 2021, when Missouri resident Kimberley Woodruff and other users alleged the company's real-time bidding ad system violates people's privacy by sharing their personal information with “thousands” of outside companies. Other Google users, including California and out-of-state residents, later joined in the complaint.

Among other claims, the users said Google violated promises that it wouldn't share people's personal information.

Two years ago, Rogers rejected Google's request to throw out the lawsuit at an early stage of the proceeding. She said at the time that the allegations in the complaint, if proven true, could show that Google violated federal and California privacy laws, as well as promises to avoid sharing personal information.

The users recently urged Rogers to certify a class of all Google account holders whose personal information was sold or shared by Google through real-time bidding after June 28, 2016 -- the date Google revised its privacy policy in a way that allowed the company to combine data about pseudonymous web-browsing activity with personally identifiable information.

Google opposed class-certification, arguing that key questions about users' consent to data sharing couldn't be answered on a class-wide basis.

Rogers agreed that claims for monetary damages would require individual evaluation and rejected the motion for class-certification with prejudice regarding those claims. She also rejected the class-certification motion for purposes of obtaining an injunction against Google, but without prejudice -- meaning the plaintiffs could gather more evidence and renew their attempt to obtain an injunction.

“The injunctive relief sought would be an important step toward choice, accountability, and transparency,” she wrote.