• by Wendy Davis  @wendyndavis, June 14, 2022

Siding against Google, a federal judge ruled that a group of account holders can proceed with a host of privacy related claims stemming from the company's real-time bidding system.

In a decision issued Monday, U.S. District Court Judge Yvonne Gonzalez Rogers in the Northern District of California ruled that the allegations in the complaint, if proven true, could show that Google violated its privacy policy as well as federal and California privacy laws.

“Plaintiffs have alleged enough facts to draw a reasonable inference that their personal information had been shared by Google by way of the [real-time bidding] process,” Rogers wrote.

The decision stems from a lawsuit brought against Google in March of 2021, when Missouri resident Kimberley Woodruff and other users alleged the company's real-time bidding ad system violates people's privacy by sharing their personal information with “thousands” of outside companies. Other Google users, including California and out-of-state residents, later joined in the complaint.

Among other claims, the users said Google violated representations that it wouldn't shared users' personal information.

Google argued the lawsuit should be dismissed at an early stage for numerous reasons, including that the data allegedly shared wasn't “personal information” -- which the company argued means “names, email addresses, billing information, or other equivalent information.”

Google added that its privacy policies don't define unique identifiers -- such as IP addresses or cookies -- as personal information.

Rogers rejected that argument, writing that California's broad privacy law defines personal information as data that can be linked with a consumer or household -- including browsing history and search history.

Google also said the users shouldn't be able to proceed with claims that it violated the California constitution (which includes a right to privacy) or that it engaged in “intrusion upon seclusion” (a broad claim involving “highly offensive” conduct), arguing that the users didn't allege they had a reasonable expectation of privacy in the data.

Rogers sided against Google on that point as well. 

“Plaintiffs allege that Google sells sensitive personal information such as ... IP address, geo-location data, and web-browsing information, search terms, and sensitive websites that plaintiffs visited relating to race, religion, sexual orientation, and health,” Rogers wrote.

“Google argues that such information is routinely shared and thus cannot support a reasonable expectation of privacy. Not so,” she continued.

The ruling also allows the users to proceed with other claims, including that Google violated federal and state wiretap laws.