There was no fist-pumping in the courtroom after a federal jury in San Francisco said Google should pay more than $425 million in damages for continuing to collect data about its users even after they switched off a key privacy setting. While substantial, the verdict is hardly a record for the resolution of private US privacy litigation, and a group of jurors who spoke about their deliberations after handing down the verdict said Google — from Chief Executive Sundar Pichai on down — wasn't transparent enough for users to grant meaningful consent.
A federal jury’s decision today that Google must pay $425.65 million for violating two privacy laws — a significant penalty but a fraction of what the plaintiffs sought in the first major jury privacy trial against the Internet giant — left no one rejoicing. The federal jury in San Francisco concluded that Google didn't violate the California Comprehensive Computer Data Access and Fraud Act, a state data security law that could have triggered much higher damages. While awarding $247.2 million to Android users and $178.5 million to non-Android-phone users, the jury also determined that the plaintiffs failed to adequately prove that Google acted with “malice, oppression or fraud” in continuing to collect user data even when users toggled off the Web & App Activity (WAA) privacy toggle, a finding that would have triggered much larger punitive damages for Google had the jury gone the other way.
While substantial, the Google verdict is less than the $725 million settlement Meta Platforms finalized earlier this year, a high-water mark for the resolution of private US privacy litigation (see here). In reaching today's mixed ruling for Google, a group of jurors, including presiding juror Michael Bowman, said after handing down the verdict that a key to the ruling was how the panel of eight differentiated between “permission” and “consent.”
“I think that's where we tried to put ourselves in the place of an average user, what their expectations would be for privacy,” Bowman said in the courtroom, in conversation with lawyers and journalists after the verdict. “And I think what we all agreed is that [Google should have placed] somewhere higher up in the hierarchy of communication to the user, there was a disclosure that regardless of your settings, your data is still going to be collected and stored.”
Google Chief Executive Sundar Pichai didn't testify in court during the two-week trial, but jurors said today that the video testimony they saw about Pichai's 2018 testimony to Congress — that Google gives users "control" of their data — was important to their decision.
"We do think that the consent language should be a little more obvious to the user earlier on, not after a pop up, not after you read the terms [of service], and by the way, not after a CEO testifies to Congress and says you are in control," Bowman said. "We thought it was very interesting that he would do that."
Google vowed to fight on. "This decision misunderstands how our products work, and we will appeal it," said Jose Castañeda, a Google spokesperson. "Our privacy tools give people control over their data, and when they turn off personalization, we honor that choice."
— Diversity of views —
The jury didn't have a unified view of the case at the start of deliberations. “It was almost 50-50. It was pretty split,” said juror Kenney Tuyen.
Bowman, Tuyen and fellow juror Billy Crawford said the jury painstakingly scrolled through Google’s lengthy and complex privacy policy as the basis for their deliberations. They recognized that consumers gave Google permission to use their data to target ads when they agreed to the policy. But that wasn’t the same as granting consent with WAA, and a related privacy setting, supplemental Web & App Activity (sWAA), switched off.
“There's a lot of fine print that you see, and so you should therefore be responsible for reading the fine print. And so by granting permission means that you were responsible for reading the fine print. Consent means something a little different,” Bowman said. “We thought that the consent wasn't given because it didn't apply to the fine print” of the privacy policy.
The jurors agreed that while Google’s “lack of transparency” in continuing to collect user data with the WAA setting off was “offensive,” Bowman said, they could not reach a consensus that it was egregious enough to warrant punitive damages.
“We agreed that while it was offensive, it was not to the point of necessitating any type of punitivity,” Bowman said. The plaintiffs had sought more than $30 billion in compensatory, nominal, unjust enrichment and punitive damages.
The jury also concluded that plaintiffs did not adequately prove they were entitled to unjust enrichment damages. Bowman said they just didn’t have enough information to determine how much the data collected with sWAA and WAA off was worth. Plaintiffs’ counsel had put it at $3 per device per month, a figure they took from a Google commissioned study called "Screenwise" in which volunteers were paid to give Google access to everything they were doing on the internet.
Bowman said the jury believed that the sWAA-off data had value, but the Screenwise study was not a good comparison.
“These were willing participants who were also compensated in other ways other than a $3 per month fee, but they didn't really care about their data,” he said. “Someone who turns sWAA off wants to be anonymous and they would most likely charge a much higher price for their data. So what would that be? Well, we don't know because we weren't presented with that.”
The jury also determined that Google’s advertising arm, Google Analytics, was “not a major player” in the online ad measurement game. “There appears to be a large number of bigger players in terms of analytics data collection. Google Analytics, while being a player, is not a major player. It’s certainly not the largest,” Bowman said.
When pressed by plaintiffs’ counsel on how the jury came to that conclusion, Bowman said they took it from testimony that conversion tracking company AppsFlyer was the largest. “And the data would have been collected anyway,” Bowman added. “Google would have had that data as far as tracking the relevance and performance of their advertising so they probably would have not seen a huge, significant loss in revenue without this data.”
Crawford said the jury “didn't have enough evidence” to award disgorgement. “We were going back and forth. We had $4.6 billion but there was an argument about where did we get that number?”
— No clear winner —
The jury found that while Google did not knowingly take, copy and use data from the plaintiffs' mobile devices without their permission in violation of the California Computer Data Access and Fraud Act, the tech giant was still liable for violating invasion-of-privacy and intrusion-upon-seclusion laws and that the plaintiffs were owed compensatory damages.
After the verdict, the mood in US District Judge Richard Seeborg’s courtroom was subdued, with more than two dozen lawyers from both sides crowding around jurors to hear how they reached their verdict.
Even named plaintiff Julian Santiago, who was there for the reading of the verdict, told MLex that he “didn’t know how to feel” about the jury’s decision. He said that while he was still processing what happened, he was ultimately glad that he filed the lawsuit.
Santiago and roughly 98 million other users were part of two classes of Android and non-Android devices who had turned off WAA and sWAA in order to stop Google’s software development kits embedded in third-party apps from collecting their personal information. The data, which tells developers whether their apps are functioning properly, is also critical to Google’s ad business as it allows Google to measure how online ads are performing and whether they lead to customers making purchases.
While it wasn’t entirely a win for Google, the outcome could have been far worse. It faced the possibility of having to pay roughly $31 billion in compensatory damages to the class, along with $4.6 billion in disgorgement of profits it allegedly derived from the ill-gotten data. The jury could have also decided to award nominal damages (it did not).
Perhaps most damaging to Google would have been the prospect of punitive damages, something the jury could have urged the federal judge overseeing the case to impose. The case would have then entered a penalty phase, with Seeborg determining a final amount.
The jurors also weren’t persuaded that Santiago or co-named plaintiff Anibal Rodriguez had been harmed.
“As far as the plaintiffs, if the witnesses would have had put more emphasis on their damages as far as their losses were, that would have been more effective,” Crawford said. “To me, in the room, the argument was really about 'there was no suffering, no harm done to the plaintiffs'.”
“At least financial harm,” Bowman said. “Or emotional,” Crawford added.
They said they would have liked to have heard from more class members, or to have seen surveys regarding how typical Google users felt about Google harvesting their data. “We would have liked to have seen more class members testify for sure,” Bowman said.
When asked if he was going to turn sWAA off, Bowman responded with a wry “Now we know that it doesn’t matter.” Laughter rang out through the courtroom, the only moment of levity in an otherwise muted resolution to what could have been a blockbuster case.
Please email editors@mlex.com to contact the editorial staff regarding this story, or to submit the names of lawyers and advisers.