Siding against Google, a federal judge ruled that a group
of account holders can proceed with a host of privacy related claims stemming from the company's real-time bidding system.
In a decision issued Monday, U.S. District Court Judge Yvonne
Gonzalez Rogers in the Northern District of California ruled that the allegations in the complaint, if proven true, could show that Google violated its privacy policy as well as federal and California
privacy laws.
“Plaintiffs have alleged enough facts to draw a reasonable inference that their personal information had been shared by Google by way of the [real-time bidding]
process,” Rogers wrote.
The decision stems from a lawsuit brought
against Google in March of 2021, when Missouri resident Kimberley Woodruff and other users alleged the company's real-time bidding ad system violates people's privacy by sharing their personal
information with “thousands” of outside companies. Other Google users, including California and out-of-state residents, later joined in the complaint.
Among other claims, the users
said Google violated representations that it wouldn't shared users' personal information.
Google argued the lawsuit should be dismissed at an early stage for numerous reasons, including that
the data allegedly shared wasn't “personal information” -- which the company argued means “names, email addresses, billing information, or other equivalent information.”
Google added that its privacy policies don't define unique identifiers -- such as IP addresses or cookies -- as personal information.
Rogers rejected that argument, writing that
California's broad privacy law defines personal information as data that can be linked with a consumer or household -- including browsing history and search history.
Google also said the users
shouldn't be able to proceed with claims that it violated the California constitution (which includes a right to privacy) or that it engaged in “intrusion upon seclusion” (a broad claim
involving “highly offensive” conduct), arguing that the users didn't allege they had a reasonable expectation of privacy in the data.
Rogers sided against Google on that point as
well.
“Plaintiffs allege that Google sells sensitive personal information such as ... IP address, geo-location data, and web-browsing information, search terms, and sensitive
websites that plaintiffs visited relating to race, religion, sexual orientation, and health,” Rogers wrote.
“Google argues that such information is routinely shared and thus cannot
support a reasonable expectation of privacy. Not so,” she continued.
The ruling also allows the users to proceed with other claims, including that Google violated federal and state
wiretap laws.