• by Wendy Davis  @wendyndavis, May 8, 2025

Google has reached a “settlement in principle” with users who brought a class-action privacy complaint over real-time bidding (RTB), according to court papers filed Wednesday.

The deal was arrived at Tuesday, and terms are expected to be finalized and disclosed in court by July 11.

If accepted by U.S. District Court Judge Yvonne Gonzalez Rogers in the Northern District of California, the settlement will resolve a lawsuit dating to March 2021, when Missouri resident Kimberley Woodruff and other users alleged that the company's real-time bidding ad system violates people's privacy by sharing their personal information with “thousands” of outside companies. Other Google users, including California and out-of-state residents, later joined in the complaint.

Among other claims, the users said Google violated representations that it wouldn't share people's personal information.

The plaintiffs had sought to represent a class of all Google account holders whose personal information was sold or shared by Google through real-time bidding after June 28, 2016 -- the date Google revised its privacy policy in a way that allowed the company to combine data about pseudonymous web-browsing activity with personally identifiable information.

Rogers said in a ruling issued last April that the users could not proceed as a class for monetary damages, writing that claims regarding damages would require a person-by-person determination.

At the time, she also rejected the users' request to certify a class for purposes of obtaining an injunction, but without prejudice -- meaning that the plaintiffs could beef up that request and bring it again.

She also appeared to support the idea that Google should revise some real-time bidding practices.

“The injunctive relief sought would be an important step toward choice, accountability, and transparency,” she wrote.

“There is evidence before the court which already shows that Google shares enough information that [real-time bidding] participants can discern what an account holder is reading online, even when it is on a religious or medical topic; exactly where they are reading it, including the coordinates of an account holder’s home or work; and their background, which allows for a detailed, demographic profile of the account holder,” Rogers wrote in a 26-page ruling.

“Google cannot run away from the common question of whether it promises its account holders that it would not sell their personal information and, if so, it violates that promise billions of times a day,” she added.