New information emerged on Monday regarding Google's settlement of a class-action lawsuit concerning Chrome's tracking of Incognito users. Initially filed in 2020, the lawsuit had the potential to cost the tech giant $5 billion in damages. However, The Wall Street Journal reports that instead of facing this hefty sum, Google has agreed to take significant corrective measures.
According to the report, Google will be discarding "billions of data points" it unlawfully amassed, revising its data collection disclosures, and implementing a default setting to block Chrome's third-party cookies for the next five years.
The lawsuit, which accused Google of misleading Chrome users about the privacy of Incognito browsing, highlighted the company's alleged contradiction in claiming users' privacy while monitoring their online activities. Google's defence included the argument that it had cautioned users that Incognito mode "does not mean 'invisible'" and that websites could still track their activity.
The settlement, initially disclosed in December, addresses claims under federal wiretapping and California privacy laws. It was revealed that Google failed in its attempts to dismiss the legal action, with Judge Lucy Koh ruling in 2021 that the company had not adequately notified users of its data collection practices while Incognito mode was active.
During the course of the lawsuit, internal emails surfaced, shedding light on Google's own reservations about Incognito mode's privacy claims. In one exchange in late 2022, Google's Chief Marketing Officer, Lorraine Twohill, expressed concerns to CEO Sundar Pichai that labelling Incognito as "private" could perpetuate misconceptions. Twohill suggested that the term "private" was misleading, leading to a need for vague language in marketing materials.
Although the lawsuit did not gain class-action status for financial damages, some users wasted no time in filing individual suits. A group of 50 individuals filed a separate suit in a California state court last Thursday, focusing on privacy violations.
The trial for the lawsuit was initially scheduled for February, but the settlement awaits final approval from Judge Yvonne Gonzalez Rogers of the Northern District of California.
"This settlement is a significant step towards holding dominant technology companies accountable," commented Attorney David Boies, representing the plaintiffs, in a statement to The Wall Street Journal.
One aspect of the settlement, the mandate to disable third-party tracking cookies by default for five years, may become redundant. Google's Privacy Sandbox initiative had already planned to phase out all third-party cookies by the year's end. This initiative includes the Topics API, a system designed to categorise browsing activity locally, enabling advertisers to target ads without direct access to browsing data.
Harry Halpin, CEO of Nym Technologies and research scientist at MIT said, “Any centralised platform, from Facebook to Google to Apple to any VPN company, can say it’s respecting your privacy. They also can be forced to share your personal data by government request, as Snowden revealed. Yet only decentralised networks are actually forced to protect your privacy by design. Otherwise, it’s too easy to just analyse that supposedly private data, as the lawsuit against Google shows”
The effectiveness of erasing improperly collected data is also questionable, given that the lawsuit covers information dating back to 2016. It is reasonable to assume that much of this data has been sold to third parties or incorporated into other products not covered by the settlement.