The first details emerged Monday of Google's settlement of a class-action lawsuit over Chrome's tracking of incognito users. Filed in 2020, the lawsuit could have required the company to pay $5 billion in damages. Instead, The Wall Street Journal tech/google-pledges-to-destroy-browsing-data-to-settle-incognito-lawsuit-1febfde5″ rel=”nofollow noopener” target=”_blank” data-ylk=”slk:reports;elm:context_link;elmt:doNotAffiliate;cpos:2;pos:1;itc:0;sec:content-canvas”>reports that Google will destroy “billions of data points” it improperly collected, update its data collection disclosures, and maintain settings that block third-party cookies from Chrome by default for the next five years.
The lawsuit accused Google of misleading Chrome users about how private incognito browsing really is. He claimed the company told customers their information was private, even as it monitored their activity. Google defended its practices, saying it warned Chrome users that incognito mode “does not mean 'invisible'” and that sites could still see their activity. The deal was first reported in December.
The lawsuit initially sought $5,000 in damages per user for alleged crimes related to federal wiretapping and California privacy laws. Google tried and failed to get the legal action dismissed, with Judge Lucy Koh ruling in 2021 that the company “failed to notify” users that it was still collecting data while incognito mode was active.
Engadget emailed Google for comment on the details of the deal. We will update this article if we receive a response.
The lawsuit's discovery included emails that, in late 2022, publicly revealed some of the company's concerns about Incognito's false privacy. In 2019, Google Chief Marketing Officer Lorraine Twohill suggested to CEO Sundar Pichai that “private” was the wrong term for incognito mode because it risked “exacerbating known misconceptions.” In a later email exchange, Twohill wrote: “We are limited in how strongly we can market Incognito because it is not truly private, so it requires very confusing and hedging language that is almost more damaging.”
The court did not approve a class of plaintiffs for financial damages, so users would have to sue Google as individuals to try to collect compensation. Some wasted no time: A group of 50 people already filed a separate lawsuit in California state court on Thursday alleging privacy violations.
The lawsuit was initially scheduled for trial in February. The agreement still needs final approval from Judge Yvonne González Rogers of the Northern District of California before it is official.
“This settlement is a historic step in demanding honesty and accountability from dominant technology companies,” attorney David Boies, who represents the plaintiffs, said in a statement to The Wall Street Journal.
One part of the deal, the requirement that Google disable third-party tracking cookies by default for the next five years, could already be a moot point. The company's Privacy Sandbox initiative was already scheduled to disable all third-party cookies for Chrome users by the end of the year. It will replace them with the Topics API, a system that bypasses cookies by classifying browsing activity into locally stored topics. The new system allows advertisers to target ads to users without having direct access to their browsing data.
It is also questionable how effective the destruction of improperly collected data will be. Considering that the lawsuit covers information dating back to 2016, it is reasonable to assume that the company sold much of the data to third parties long ago or incorporated it into separate products not covered by the settlement.
Google will also have to rewrite its privacy statements about its data collection practices in incognito mode. said The Wall Street Journal has already begun to apply the change.
