• by Wendy Davis  @wendyndavis, March 15, 2021

Google must face claims that it violates federal and California state privacy laws by collecting data about Chrome users who browse the web in "incognito" mode, a federal judge ruled Friday.

“Google did not notify users that Google engages in the alleged data collection while the user is in private browsing mode,” U.S. District Court Judge Lucy Koh in San Jose said in a 41-page opinion rejecting Google's bid for an early dismissal.

The decision stems from a class-action complaint filed in June by California residents Chasom Brown and Maria Nguyen and Florida resident William Byatt.

They alleged that even when Chrome users are in incognito mode, their visits to sites that use Google Analytics or Google Ad Manager result in Google's collection of IP addresses, browser and device information, and web pages' content.

When Chrome users command the browser to open an incognito window, they are greeted with a message stating that Chrome won't save browsing history, cookies and site data, and information entered in forms. But the message also tells users their activity may be “visible” to websites they visit.

That type of data can be used for “device fingerprinting” -- a controversial tracking technique that doesn't rely on cookies. 

The complaint includes claims that Google violates the federal wiretap law -- which prohibits companies from intercepting electronic communications without at least one party's consent -- as well as various California privacy laws.

Google argued the lawsuit should be dismissed at an early stage for several reasons -- including that the users consented to the data collection. The company pointed to its terms of service, which incorporated a privacy policy stating that Google would receive data from third-party services.

Koh rejected that argument, writing that the company's general disclosures in the terms of service didn't say Google could collect information when people are in incognito mode.

“A Google user reading the general disclosure ... might have reasonably concluded that Google does not collect this data from users in private browsing mode,” she wrote.

She added that since May of 2018, Google's privacy policy “has presented incognito mode as a way that users can control the information that Google collects.”

Google separately argued that websites from which data was collected implicitly consented to the alleged interception of traffic. Koh rejected that argument as well.

“Google does not demonstrate that websites consented to, or even knew about, the interception of their communications with users who were in private browsing mode,” she wrote.

A Google spokesperson says the company "strongly" disputes the claims and plans to defend itself "vigorously" against them. 

Google is currently facing several other privacy lawsuits, including one alleging it collects data about Android users' app use, and one alleging it gathers personal information from people using the Chrome browser -- including their IP addresses, identifiers stored on cookies, and data about web-browsing activity.