• by Wendy Davis , March 27, 2026

A federal judge has approved a class-action privacy settlement requiring Google to offer a new control that gives users the ability to limit the information transmitted about them in real-time bidding (RTB) auctions.

But the judge also appeared to question how much of an impact the new mechanism will have, given that users will have to affirmatively activate the control.

"The Court finds that the settlement is adequate, but by no means excellent," U.S. District Court Judge Yvonne Gonzalez Rogers in the Northern District of California wrote in a ruling issued Thursday.

She added that even though counsel for the plaintiffs boasted the settlement will “fundamentally alter Google’s business practices,” some media coverage suggested otherwise.

"The Court has reviewed press coverage of the settlement and has not found it to be quite as positive as this statement might suggest," she wrote.

"Indeed, much of the coverage questions the degree to which this injunctive relief will impact Google, given that the RTB control is an opt-in," she added, referencing an AdExchanger article that said: "History has shown that opt-out controls rarely spur widespread action. Most people simply leave things as they are."

The control "will make it very difficult for Google RTB auction participants to identify and/or track any class member who enables the RTB Control, and results in those class members no longer being tracked or targeted in RTB system for personalized ads," class counsel wrote last year in a motion seeking approval of the settlement.

Counsel added that the control, if enabled, will remove all identifiers from the Google RTB bid request, "including encrypted Google User IDs and the device advertising IDs."

Activating the control will also remove IP addresses from the Google RTB bid request, and will prevent "cookie matching," according to the plaintiffs' lawyers.

Last month, Connecticut Attorney General William Tong weighed in in favor of the settlement.

"The new RTB Control would present Google accountholders with at least two novel privacy controls," he said in a letter to the court. "First, it would offer accountholders a singular, consolidated option to limit the data shared with bidders, thereby obviating the need to manage multiple, disparate partial measures. Second, its account-level design would permit consumers to maintain their signed-in status while opting out of full RTB with a single election that applies across all devices."

This week's ruling ends a battle dating to March 2021, when Missouri resident Kimberley Woodruff and other users alleged that the company's RTB ad system violates people's privacy by sharing their personal information with “thousands” of outside companies. Other Google users, including California and out-of-state residents, later joined in the complaint. Among other claims, the users said Google violated representations that it wouldn't share people's personal information.

Rogers said in an April 2024 ruling that the plaintiffs couldn't proceed as a class for monetary damages, writing that claims regarding damages would require a person-by-person determination.

She also rejected the users' request to certify a class for purposes of obtaining an injunction, but without prejudice -- meaning that the plaintiffs could beef up that request and bring it again.

Despite that ruling, she appeared to support the idea that Google should revise some practices.

“The injunctive relief sought would be an important step toward choice, accountability, and transparency,” she wrote at the time.

“Google cannot run away from the common question of whether it promises its account holders that it would not sell their personal information and, if so, it violates that promise billions of times a day,” she added.

A Google spokesperson stated Friday that the company already has "the strictest real-time bidding restrictions in the industry," adding, "We are pleased to put this case behind us.”