In the ongoing Google privacy case involving its selling of personal information, another motion to dismiss is granted in part and denied in part. In re Google RTB Consumer Priv. Litig., 2022 U.S. Dist. LEXIS 115023 (N.D. Cal. June 13, 2022).* First is how it sells consumer information. Second is the holding:
Google collects, observes, and analyzes data from everyone using any of its services and platforms. (CCAC ¶ 9.) This data is then disseminated and sold through Google’s Real-Time Bidding system (“RTB”), which functions as an auction (Id. ¶¶ 3, 6.) Through RTB, Google solicits participants to bid on sending an ad to a specific individual (“the target”). (Id. ¶ 6.) Google provides highly specific information about the target in the bid request provided to RTB auction participants, including data that identifies the individual being targeted through unique identifiers, device identifiers, geolocation, IP address, cookie match, and other information. (Id.) Google also provides the specific content of account holders’ internet communications and highly detailed personal profile information about peoples’ interests, race, religion, sexual orientation, and health status. (Id. ¶¶ 12, 13.)
Once RTB participants receive the information about the target they compete for ad space to send the target an advertisement at a specific price. (Id. ¶ 7.) Google is paid by the winning bidder. (Id.) All RTB participants, even those who do not win and those who do not place a bid, are able to collect the target’s data. (Id.) Google also allows RTB “surveillance participants” to receive users’ data. (Id.) “Surveillance participants” are participants who have no interest in filling an ad space but who participate in RTB for the sole purpose of gaining access to users’ personal information. (Id.)
Because of RTB, Google is able to earn substantial revenue by selling users’ data. (Id. ¶ 9.) In doing so, Google’s practices violate California and federal law, as well as Google’s explicit contractual and extracontractual promises to Google’s account holders. (See e.g., id. ¶¶ 11-12.) Google improperly sells and disseminates account holders’ personal and private information to thousands of companies notwithstanding Google’s express promises not to sell users’ personal information. (Id. ¶¶ 1, 3.) RTB is also problematic because Google fails to disclose the practice to account holders and fails to obtain consent from account holders. (Id. ¶ 21.)
Plaintiffs are Google account holders who frequently use various web browsers, including Google Chrome, Safari, and Edge to request, obtain, and watch audio-visual materials and whose personal information was allegedly shared and sold through Google’s RTB process. (Id. ¶¶ 9, 37-68.)
. . .
Thus, the relevant question here is whether plaintiffs would reasonably expect that Google would use its access to account holders’ personal information to share and sell it to third parties. Plaintiffs argue that the amount of data, its sensitivity, the nature of the misuse, and the representations that Google made to account holders that they would never sale their personal information makes it such that plaintiffs had a reasonable expectation of privacy.
Google relies on its TOS and Privacy Policy disclosures to argue that plaintiffs lack a reasonable expectation of privacy in the information because Google provided sufficient notice of this conduct. Specifically, Google points to the following language as sufficient disclosure of the practice challenged in this lawsuit:
• Google uses “automated systems and algorithms to analyze your content” in order to “customize our services for you, such as providing recommendations [*22] and personalized search results, content, and ads (which you can change or turn off in Ad Settings.” (CCAC, Ex. 4 at 7) (TOS)
• “We may show you personalized ads based on your interests.” (Id., Ex. 15 at 5) (Privacy Policy)
• “We may share non-personally identifiable information publicly and with our partners—like publishers, advertisers, developers, or rights holders.” (Id. at 12) (Privacy Policy)
• “We use your personal information to make our products more helpful to you,” such as by “show[ing] ads based on your interests.” (Id., Ex. 5 at 1-2) (Google’s “How Our Business Works” page).
While plaintiffs might have been informed about Google’s use of information for its own internal purposes such as directing targeted advertising to plaintiffs, the referenced disclosures do not disclose the challenged conduct here—the sale and disclosure of plaintiffs’ personal information to third parties without plaintiffs’ consent or knowledge. Plaintiffs allege that Google does not inform account holders that it would sale and disclose its personal information to third parties. Plaintiffs also adequately allege that Google’s policies inform account holders that such information would never be sold to third parties without consent.
Plaintiffs have alleged sufficient facts to show that Google’s disclosure and sale through the RTB process was not sufficiently disclosed to account holders, and therefore they could not consent to the conduct. The “critical fact [that] [Google] represented to the plaintiffs that their information would not be [sold] but then proceeded to [sale] it anyways” undermines Google’s argument that plaintiffs lack a reasonable expectation of privacy. Facebook Tracking, 956 F.3d at 603 (finding plaintiffs adequately alleged a reasonable expectation of privacy where challenged conduct was not disclosed).
The nature and volume of the collected information is also important. Plaintiffs allege that Google sold and shared information relating to plaintiffs’ web browsing histories, device information, and consumer interest data. Specifically, plaintiffs allege that Google sells sensitive personal information such as plaintiff’s IP address, geo-location data, and web-browsing information, search terms, and sensitive websites that plaintiffs visited relating to race, religion, sexual orientation, and health. Google argues that such information is routinely shared and thus cannot support a reasonable expectation of privacy. Not so. First, such information is personal information under California law and parties generally maintain a reasonable expectation in their personal information. See Cal. Civ. Code § 1798.140 (explaining that “Internet or other electronic network activity information,” such as “browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement”).
Second, the Ninth Circuit’s decision in Facebook Tracking forecloses Google’s argument that plaintiffs do not maintain a reasonable expectation of privacy in their browsing activities. There, the Ninth Circuit held that plaintiffs adequately alleged a reasonable expectation of privacy where the Facebook allegedly collected and created “highly personalized profiles from [plaintiffs’] sensitive browsing histories and habits.” Facebook Tracking, 956 F.3d at 603.Taking plaintiffs’ allegations as true, as required at this stage of litigation, the Court finds that plaintiffs’ allegations that Google shared and sold plaintiffs’ personal and sensitive information without disclosing that it would precludes the Court from finding that plaintiffs have no reasonable expectation of privacy in this information. Accordingly, the motion to dismiss on this ground is Denied.
