• by Wendy Davis  @wendyndavis, February 4, 2021

Handing Google a partial defeat, a federal judge has refused to dismiss a lawsuit by an Android user who alleges that the company “spies” on smartphone users through the “Lockbox” program.

In a decision issued this week, U.S. District Court Magistrate Susan van Keulen rejected Google's motion to dismiss New York resident Robert McCoy's claims that the company violated a California consumer protection law by allegedly misrepresenting its privacy practices.

But van Keulen also threw out claims that Google violated various California privacy laws, including the new California Consumer Protection Act.

The dispute dates to last August, when McCoy alleged in a class-action complaint that Android Lockbox enables Google to “spy” on smartphone users' interactions with non-Google apps.

Allegations about Lockbox came to public attention in August, when The Information reported that Google drew on data about people's use of outside apps, like TikTok, for competitive purposes.

Google reportedly only collects the data from users who agree to share their “usage and diagnostics” information with the company.

Google argued the lawsuit should be dismissed at a preliminary stage for several reasons, including that McCoy consented to the data collection by agreeing to Google's privacy policy.

Among other disclosures, the company says in its privacy policy: “We collect information about the apps, browsers, and devices you use to access Google services, which helps us provide features like automatic product updates and dimming your screen if your battery runs low.”

McCoy countered that the privacy policy was vague, and didn't adequately disclose the extent of Google's alleged data collection. 

van Keulen said in her ruling that Google's privacy policy wasn't specific enough to warrant dismissal of McCoy's claims at an early stage of the proceeding.

She wrote that Google's statements, including examples of how it used data, might not lead a “reasonable user” to realize the company was collecting data about interactions with apps from outside developers.

She dismissed other claims, including that Google violated California's wiretap law, the state constitution, and the new California Consumer Privacy Act. She allowed McCoy to reformulate his complaint and refile some of those claims, but not ones related to the California Consumer Privacy Act. That measure, which took effect last year, doesn't provide for lawsuits by individuals.