• by Wendy Davis  @wendyndavis, August 8, 2023

Siding against Google, a federal judge has refused to throw out claims that the company wrongly collects data about users who attempt to keep their web activity confidential by using Chrome's “incognito mode,” or a comparable setting on other browsers.

In a decision denying Google's motion for summary judgment, U.S. District Court Judge Yvonne Gonzalez Rogers rejected the company' argument that incognito users consented to data collection.

“Google’s motion hinges on the idea that plaintiffs consented to Google collecting their data while they were browsing in private mode,” Rogers wrote in an opinion issued Monday. “Because Google never explicitly told users that it does so, the Court cannot find as a matter of law that users explicitly consented to the at-issue data collection.”

A Google spokesperson says the company disputes the claims and will defend itself.

“Incognito mode in Chrome gives you the choice to browse the internet without your activity being saved to your browser or device,” the spokesperson stated. “As we clearly state each time you open a new incognito tab, websites might be able to collect information about your browsing activity during your session.”

When Chrome users command the browser to open an incognito window, they are greeted with a message stating that Chrome won't save browsing history, cookies and site data, and information entered in forms. But the message also tells users their activity may be “visible” to websites they visit.

Monday's ruling stems from a lawsuit filed in June of 2020, when California residents Chasom Brown and Maria Nguyen and Florida resident William Byatt alleged in a class-action complaint that they were tracked by Google, even though they used the Chrome browser's incognito mode to visit sites including CNN.com, Apartments.com and NYTimes.com. 

They alleged that even in incognito mode, visiting a site that uses Google Analytics or Google Ad Manager results in Google's collection of IP addresses, browser and device information, and web pages' content.

The complaint includes claims that Google violated wiretap laws and that it engaged in “intrusion upon seclusion” -- a broad California concept that allows people to sue for “highly offensive” privacy violations.

Google urged Rogers to dismiss the claims without a trial, arguing that users “expressly consented to the relevant data collection and its use for advertising,” by accepting Google's privacy policy and other terms of service.

“The Privacy Policy and Account Holder Agreements disclose that Google collects the at-issue data when users visit websites choosing to use Google services and that Google may use the data for advertising,” the company wrote in its bid for summary judgment.

Rogers said she disagreed that the privacy policy “unambiguously discloses” the data collection, noting that the privacy policy also told users: “You can also choose to browse the web in a private mode, like Chrome Incognito mode.”

She wrote: “The way Google presents Incognito mode could be read to contradict its suggested interpretation of the Privacy Policy.”

The ruling paves the way for the users to attempt to prove their claims at trial, which is scheduled for November.

Rogers previously ruled that if the users prevail they will be able to seek an injunction against Google, but won't be able to seek monetary damages on a class-wide basis.