Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 1 of 37
`
`
`Mark C. Mao, CA Bar No. 236165
`Sean P. Rodriguez, CA Bar No. 262437
`Alexander J. Konik, CA Bar No. 299291
`BOIES SCHILLER FLEXNER LLP
`44 Montgomery St., 41st Floor
`San Francisco, CA 94104
`Tel.: (415) 293-6800
`Fax: (415) 293-6899
`mmao@bsfllp.com
`srodriguez@bsfllp.com
`akonik@bsfllp.com
`
`James Lee (pro hac admission pending)
`Rossana Baeza (pro hac admission pending)
`BOIES SCHILLER FLEXNER LLP
`100 SE 2nd St., 28th Floor
`Miami, FL 33131
`Tel.: (305) 539-8400
`Fax: (303) 539-1307
`jlee@bsfllp.com
`rbaeza@bsfllp.com
`Attorneys for Plaintiffs
`
`
`
`
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`
`CHASOM BROWN, MARIA NGUYEN, and
`WILLIAM BYATT, individually and on
`behalf of all other similarly situated,
`
`Plaintiffs,
`
`v.
`
`GOOGLE LLC and ALPHABET INC.,
`
`Defendants.
`
`
`
`
`
`
`Case No. 20-3664
`
`
`COMPLAINT
`
`CLASS ACTION FOR
`(1) FEDERAL WIRETAP VIOLATIONS, 18
`U.S.C. §§ 2510, ET. SEQ.;
`(2) INVASION OF PRIVACY ACT
`VIOLATIONS, CAL. PENAL §§ 631 &
`632;
`(3) INVASION OF PRIVACY; AND
`(4) INTRUSION UPON SECLUSION.
`
`
`DEMAND FOR JURY TRIAL
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`
`
`COMPLAINT CASE NO. 20-3664
`
`

`

`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 2 of 37
`
`
`CLASS ACTION COMPLAINT
`Plaintiffs Chasom Brown, Maria Nguyen, and William Byatt, individually and on behalf of
`
`all others similarly situated, file this class action against defendants Google LLC and its parent
`company, Alphabet Inc. (collectively, “Google” or “Defendants”), and in support state the
`following:
`
`
`
`INTRODUCTION
`I.
`Protecting data privacy is critical in our rapidly modernizing society. People
`1.
`everywhere are becoming more aware (and concerned) that their personal communications are
`being intercepted, collected, recorded, or exploited for gain by technology companies they have
`
`come to depend on.
`Well aware of consumers’ legitimate and reasonable concerns over privacy, Google
`2.
`assured, and continues to assure, its consumers and users that they, and not Google, are “in control
`of what information [they] share with Google.” Google further represents that “across our services,
`you can adjust our privacy settings to control what we collect and how your information is used.”
`Nothing could be further from the truth.
`As discussed in more detail below, Google tracks and collects consumer browsing
`3.
`history and other web activity data no matter what safeguards consumers undertake to protect their
`data privacy. Indeed, even when Google users launch a web browser with “private browsing mode”
`activated (as Google recommends to users wishing to browse the web privately), Google nevertheless
`tracks the users’ browsing data and other identifying information.
`Google accomplishes its surreptitious tracking through means that include: Google
`4.
`Analytics, Google Ad Manager, and various other application and website plug-ins, such as Google
`applications on mobile devices and the “Google Sign-In button” for websites. When an internet user
`
`visits a webpage or opens an app that uses such services (over 70% of all online publishers use such
`a service), Google receives detailed, personal information such as the user’s IP address (which may
`provide geographic information), what the user is viewing, what the user last viewed, and details
`about the user’s hardware. Google takes the data regardless of whether the user actually clicks on a
`Google-supported advertisement—or even knows of its existence. This means that billions of times
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`2
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 3 of 37
`
`
`a day, Google causes computers around the world to report the real-time internet communications of
`hundreds of millions of people to Google.
`Google has anticipated that consumers are understandably concerned that Google is
`5.
`tracking their personal information and browsing history. To assuage them, Google promises
`consumers that they can “browse the web privately” and stay in “control of what information [users]
`
`share with Google.” To prevent information from being shared with Google, Google recommends
`that its consumers need only launch a browser such as Google Chrome, Safari, Microsoft Edge, or
`Firefox in “private browsing mode.” Both statements are untrue. When users undertake either—or
`both—of the aforementioned steps, Google continues to track, collect, and identify their browsing
`
`data in real time, in contravention of federal and state laws on wiretapping and in violation of
`consumers’ rights to privacy.
`Google’s practices infringe upon users’ privacy; intentionally deceive consumers;
`6.
`give Google and its employees power to learn intimate details about individuals’ lives, interests,
`and internet usage; and make Google “one stop shopping” for any government, private, or criminal
`actor who wants to undermine individuals’ privacy, security, or freedom. Through its pervasive
`data tracking business, Google knows who your friends are, what your hobbies are, what you like
`to eat, what movies you watch, where and when you like to shop, what your favorite vacation
`destinations are, what your favorite color is, and even the most intimate and potentially
`embarrassing things you browse on the internet—regardless of whether you follow Google’s advice
`to keep your activities “private.” Indeed, notwithstanding consumers’ best efforts, Google has made
`itself an unaccountable trove of information so detailed and expansive that George Orwell could
`never have dreamed it.
`Google must be held accountable for the harm it has caused to its users in order to
`7.
`
`ensure it cannot continue to engage in the covert and unauthorized data collection from virtually every
`American with a computer or phone. This action arises from Google’s unlawful and intentional
`interception and collection of individuals’ confidential communications without their consent, even
`when those individuals expressly follow Google’s recommendations to prevent the tracking or
`collection of their personal information and communications. Beyond the California Constitution,
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`3
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 4 of 37
`
`
`federal and state privacy laws recognize individuals’ reasonable expectations of privacy in
`confidential communications under
`these circumstances. Federal privacy
`laws prohibit
`unauthorized interception, access, and use of the contents in electronic communications. California
`law similarly prohibits, among other things, eavesdropping, recording, and sharing of confidential
`communications without the consent of all parties to the communication.
`
`Plaintiffs are Google subscribers whose internet use was tracked by Google between
`8.
`June 1, 2016 and the present (the “Class Period”), while browsing the internet from a browser in
`“private browsing mode.” They bring federal and California state law claims on behalf of other
`similarly-situated Google subscribers in the United States (the “Class”) arising from Google’s
`
`knowing and unauthorized interception and tracking of users’ internet communications and activity,
`and knowing and unauthorized invasion of consumer privacy.
`THE PARTIES
`II.
`Plaintiff Mr. Chasom Brown (“Brown”) is an adult domiciled in Los Angeles,
`9.
`California. Brown had an active Google account during the entire Class Period.
`Plaintiff Ms. Maria Nguyen (“Nguyen”) is an adult domiciled in Los Angeles,
`10.
`California. Nguyen had an active Google account during the entire Class Period.
`Plaintiff Mr. William Byatt (“Byatt”) is an adult domiciled in Florida. Byatt had an
`11.
`active Google account during the entire Class Period.
`Defendant Google is a Delaware limited liability company with a principal place of
`12.
`business at what is officially known as The Googleplex, 1600 Amphitheatre Parkway, Mountain
`View, California 94043. Google regularly conducts business throughout California and in this
`judicial district. Google is one of the largest technology companies in the world and conducts product
`development, search, and advertising operations in this district.
`
`///
`///
`///
`///
`///
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`4
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 5 of 37
`
`
`Defendant Alphabet Inc. is a Delaware corporation, organized and existing under the
`13.
`laws of the State of Delaware, with its principal place of business at what is officially known as The
`Googleplex, 1600 Amphitheatre Parkway, Mountain View, California 94043. Alphabet Inc. is the
`parent holding company of Google LLC. Alphabet Inc. owns all the equity interests in Google
`LLC.1
`
`
`JURISDICTION AND VENUE
`III.
`This Court has personal jurisdiction over Defendants because their principal place
`14.
`of business is in California. Additionally, Defendants are subject to specific personal jurisdiction
`in this State because a substantial part of the events and conduct giving rise to Plaintiffs’ and the
`
`Class’ claims occurred in this State.
`This Court has subject matter jurisdiction over the federal claims in this action,
`15.
`namely the Federal Wiretap Act, 18 U.S.C. § 2511 (the “Wiretap Act”) pursuant to 28 U.S.C.
`§ 1331.
`This Court has subject matter jurisdiction over this entire action pursuant to the
`16.
`Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1332(d), because this is a class action in which
`the amount in controversy exceeds $5,000,000, and at least one member of the class is a citizen
`of a state other than California or Delaware.
`This Court also has supplemental jurisdiction over the state law claims in this
`17.
`action pursuant to 28 U.S.C. § 1367 because the state law claims form part of the same case or
`controversy as those that give rise to the federal claims
`Venue is proper in this District because a substantial portion of the events and
`18.
`actions giving rise to the claims in this matter took place in this judicial District. Furthermore,
`Defendants Alphabet Inc. and Google LLC are headquartered in this District and subject to personal
`
`jurisdiction in this District.
`
`1 During the 2015 reorganization, certain of Google LLC’s business segments were spun off and
`separated into independent entities under the ownership of Alphabet Inc. At various times during
`the Class Period, certain of the business segments re-merged with Google LLC under one corporate
`structure. Accordingly, Alphabet Inc. and Google LLC both have been named as defendants in
`order to ensure all corporate entities who may be found liable for any portion of the alleged
`wrongdoing are part of this lawsuit.
`
`5
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 6 of 37
`
`
`A.
`
`Intradistrict Assignment. A substantial part of the events and conduct which give
`19.
`rise to the claims herein occurred in Santa Clara County.
`FACTUAL ALLEGATIONS
`IV.
`Google’s Persistent Tracking Through Its Analytics and Ad Manager
`Products
`20.
`Over 70% of online websites and publishers on the internet (altogether “Websites”)
`
`utilize Google’s website visitor-tracking product, “Google Analytics.” Google Analytics is a
`“freemium” service Google makes available to Websites that provides data analytics and
`attribution about the origins of a Website’s traffic, demographics, frequency, browsing habits on
`the Website, and other data about visitors.
`
`Google Analytics is “free” to implement, but the associated data and attribution
`21.
`reports come at a price tag when Websites want more specific information. Websites can obtain
`free general reports with pseudo-anonymous data regarding visitors. To obtain more specific and
`granular data about visitors, Websites must pay a substantial fee, such as by paying for Google’s
`DV360, Ad Hub, or Google Audience products.
`To implement Google Analytics, Google asks that Websites embed Google’s own
`22.
`custom code into their existing webpage code. When a consumer visits a Website, his or her
`browser communicates a request to the Website’s servers to send the computer script to display
`the Website. This communication and request for content from the consumer is often referred to
`as a HTTP GET request, to which the Website’s servers respond with the computer code script to
`display the contents of the Website. The consumer’s browser then begins to read Google’s custom
`code along with the Website’s own code when loading the Website from the Website’s server.
`Two sets of code are thus automatically run as part of the browser’s attempt to load and read the
`Website pages—the Website’s own code, and Google’s embedded code.
`
`Google designed its Analytics code such that when it is run, Google causes the
`23.
`user’s browser to send his or her personal information to Google and its servers in California, such
`as the user’s IP address, URL address and particular page of the Website that is being visited, and
`other information regarding the user’s device and browser. This is almost always done without
`the user’s knowledge, in response to the consumer’s request for information from the Website’s
`6
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 7 of 37
`
`
`server. Google does not require that Websites disclose upfront that Google is collecting the
`visitors’ information regardless of what they do, and as further discussed below, Google does not
`tell its users which websites implement Google Analytics. There is no effective way for consumers
`to avoid Google Analytics.
`This practice allows Google to intercept, track, and collect more communications
`24.
`
`that reveal personal and consumer data than any company in the world. Since more than 70% of
`Websites use Google Analytics, Google is able to track a staggering amount of personal and
`consumer data online in real time. With virtually every click of the mouse to initiate a consumer’s
`request, Google intercepts a signal and sends it to its own servers. Those signals contain
`
`consumers’ personal viewing information and requests, which Google collects, reads, analyzes the
`contents of, and organizes based on consumers’ prior histories. Google then uses the personal
`information obtained through this routine practice of interception to advance its business interests.
`In addition to Google Analytics, over 70% of online publishes utilize another
`25.
`Google tracking and advertising product, called “Google Ad Manager” (formerly known as
`“DoubleClick For Publishers” or “DFP”).
`Like Google Analytics, Google Ad Manager requires Google code to be embedded
`26.
`into the Website’s code, which is also run automatically whenever a user’s browser loads the
`Website, as part of the consumer’s request for the contents of the Website from the Website
`servers. The code essentially tells the browser what Google advertisements to display along with
`the Website’s actual content, so that ads are served on behalf of Google’s advertising customers.
`In addition to serving ads, however, the Ad Manager code also causes users’
`27.
`browsers to send their personal information to Google and its servers in California, allowing
`Google to track visitors and traffic in much the same way as Google Analytics. To display a
`
`webpage with an ad served by Ad Manager, Google’s code again extracts the visitor’s IP address,
`browser and device information, the URL page, and content the visitor’s device is displaying in
`real time. This occurs every time a user opens a Website containing the Google Ad Manager code.
`As with Google Analytics, Google does not require that Websites disclose upfront that Google is
`collecting the visitors’ information regardless of what they do, and as further discussed below,
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`7
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 8 of 37
`
`
`Google does not tell its users which websites implement Google Ad Manager. There is no effective
`way for consumers to avoid Google Ad Manager.
`Thus, unbeknown to most consumers, Google constantly tracks what they request
`28.
`and read, click by click and page by page, in real time.2
`Google’s Misrepresentations About Data Privacy
`B.
`
`Over the last few years, the public, legislators, and courts have become increasingly
`29.
`aware of online threats to consumer privacy—including threats posed by powerful technology
`companies that have become household names. Google has responded by giving users the false
`impression that they can prevent Google from tracking their browsing history and collecting their
`
`personal data online. In Google’s Privacy Policy, Google makes numerous assurances about how
`users can “control” the information users share with Google, and that they can surf the web
`anonymously and without their communications with websites being intercepted.
`Google’s Privacy Policy explicitly states that “you can adjust your privacy settings
`30.
`to control what we collect and how your information is used.”
`
`
`
`
`
`On the “Go to My Activity” page of the Privacy Policy, Google reiterates that
`31.
`“My Activity allows you to review and control data that’s created when you use Google
`services, like searches you’ve done.”
`
`
`
`2 The technical explanation is that when an individual internet user visits a web page, his or her
`browser sends a message called a “GET request” to the web page’s server. The GET request serves
`two purposes: it first tells the website what information is being requested and then instructs the
`website to send the information back to the user. The GET request also transmits a referer header
`containing the personally-identifiable URL information. Typically, this communication occurs
`only between the user’s web browser and the third-party website. On websites with Google code
`such as Google Analytics and Ad Manager, however, Google’s code directs the user’s browser to
`copy the referer header from the GET request and then send a separate but identical GET request
`and its associated referer header to Google’s server. It is through this duplication and collection
`of GET requests that Google compiles users’ browsing histories.
`8
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 9 of 37
`
`
`
`
`
`
`32. When users click on “Go to My Activity” to control their data, they are presented
`with the option to “Learn more.” When users click on “Learn more,” they are taken to a page
`
`where they are supposed to be able to “View & control activity in your account.” On that page,
`Google states that you may “[s]top saving activity temporarily. . . . You can search and browse the
`web privately,” embedding a hyperlink to the “Search & Browse Privately” page. See SEARCH &
`BROWSE PRIVATELY, https://support.google.com/websearch/answer/4540094?hl=en&ref_topic
`=3036132 (last visited May 29, 2020).
`On the “Search & Browse Privately” page, Google once again reiterates that the
`33.
`user, not Google, is “in control of what information [a user] . . . share[s] with Google . . . .” Google
`states simply that consumers enabling “private browsing mode” on their browsers will allow
`consumers to “browse the web privately”:
`Search & browse privately
`
`You’re in control of what information you share with Google when you search. To
`browse the web privately, you can use private browsing, sign out of your account,
`change your custom results settings, or delete past activity.
`
`If you want to search the web without saving your search activity to your account,
`you can use private browsing mode in a browser (like Chrome or Safari).
`
`
`How private browsing works
`
`Private browsing works differently depending on which browser you use. Browsing
`in private usually means:
`
`• The searches you do or sites you visit won't be saved to your device or browsing
`history.
`• Files you download or bookmarks you create might be kept on your device.
`9
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 10 of 37
`
`
`• Cookies are deleted after you close your private browsing window or tab.
`• You might see search results and suggestions based on your location or other searches
`you've done during your current browsing session.
`
`Important: If you sign in to your Google Account to use a web service like Gmail,
`your searches and browsing activity might be saved to your account.
`
`There is nothing on this page about Google Analytics or Google Ad Manager, or where and which
`
`websites online implement such data collection tools.
`From the “View & control activity in your account” page referenced above, a
`34.
`consumer can also click the link, “See & control your Web & App Activity” on the right-hand
`side. See SEE & CONTROL YOUR WEB & APP ACTIVITY, https://support.google.com/websearch/
`
`answer/54068?visit_id=6372555086257257422105376128&hl=en&rd=1 (last visited May 29,
`2020). On that page, Google again represents that searching and browsing in “private browsing
`mode” will “turn off” any “search customization” “using search-related activity”:
`How Web & App Activity works when you’re signed out
`
`Your search and ad results may be customized using search-related activity even if
`you're signed out. To turn off this kind of search customization, you can search and
`browse privately. Learn how.
`
`35. When users click the “Learn how” link, they are again redirected back to the
`“Search & Browse Privately” page. In other words, with Google repeatedly touting that users can
`“control” the information they share with Google, and with Google constantly referring back to its
`recommendations on how users may “browse the web privately,” the only reasonable impression
`that users are left with is the following: if they are searching or browsing the web in “private
`browsing mode,” Google will honor their request to be left alone and in private without further
`tracking.
`
`As further explained herein, Google’s representations about how it does not track
`36.
`users under these conditions are completely false. Not only do consumers not know about what
`Google is doing to collect data on them, they have no meaningful way of avoiding Google’s data
`collection practices, even if they are following Google’s instructions to “browse the web
`privately.”
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`10
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 11 of 37
`
`
`C.
`
`Google Refuses to Turn Off Its Tracking of Users When They Are Browsing
`in “Private Browsing Mode”
`Despite its representations that users are in control of what information Google will
`37.
`track and collect, Google’s various tracking tools, including Google Analytics and Google Ad
`Manager, are actually designed to automatically track users when they visit webpages—no matter
`what settings a user chooses. This is true even when a user browses in “private browsing mode.”
`
`Take, for example, someone who visits The New York Times website in private
`38.
`mode with his Google Chrome browser. Indeed, even when he is browsing with “private browsing
`mode” enabled, Google Analytics and Google Ad Manager continue to track his data, as
`demonstrated by the following screenshot:
`
`
`
`
`
`
`
`Plaintiffs are informed and believe that even when users are browsing the internet
`39.
`in “private browsing mode,” Google continues to track them when they visit a Website that uses
`Google Analytics or Google Ad Manager. Google does so by collecting, at minimum, the
`11
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 12 of 37
`
`
`consumer’s IP address, browser and device information, and the webpage content that the
`consumer is actually looking at. This is precisely the type of private, personal information users
`wish and expect to protect when they have taken these steps to control what information is shared
`with Google. Google’s tracking occurred and continues to occur no matter how sensitive or
`personal users’ online activities are. By tracking, collecting, and intercepting Plaintiffs’ personal
`
`communications indiscriminately—regardless of whether Plaintiffs have attempted to avoid such
`tracking pursuant to Google’s instructions—Google has gained a complete, cradle-to-grave profile
`of Plaintiffs without their consent.
`Google’s justifications for doing so are baseless. Plaintiffs are informed and
`40.
`
`believe that Google has contended in private industry conversations, and in internal meetings and
`documents, that such surreptitious data collection is permissible, as it “aggregates the data” after
`the data has already been intercepted, collected, reviewed, and analyzed by Google. This does not
`mean that Google does not utilize and/or monetize this data in any way. Google does. It merely
`changes the form of storage after the data has served Google’s nefarious uses. In any event, what
`Google says it does with users’ communications with Websites after it has intercepted, analyzed,
`and used them for certain of its business purposes is cold comfort for those whose privacy it has
`already violated, because Google has repeatedly promised not to intercept or collect such
`communications in the first place. By doing so, it has already breached its users’ expectations of
`privacy (that Google itself had created).
`Plaintiffs are informed and believe that Google has also claimed in private industry
`41.
`conversations and in internal meetings and documents that its data collection practices are
`acceptable and not impermissible interceptions of communications, because Google is “acting on
`behalf of the website(s)”, as their vendor. But that is simply not true. Instead, Google tells the
`
`Website owners—and their other advertisement vendors, which are often Google competitors—
`that data Google collects “on behalf of the website” actually belongs to Google, and not the
`website.
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`12
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 13 of 37
`
`
`Google Can Track on Websites Using Other Methods as Well
`D.
`In addition to Google Analytics and Ad Manager, Google actively and
`42.
`automatically tracks users who visit Websites in other ways, despite its assurances to the contrary.
`43. Much like other social media giants, Google has a “single sign on” button (the
`“Google Button”) that it causes various Websites to encode onto their webpages:
`
`
`
`
`
`Like other social media buttons, the Google Button has numerous tracking
`44.
`functions embedded into its code, which include the same type of automatic data collection
`implemented by Google’s Analytics and Ad Manager products described above. When a visitor’s
`browser loads the Google Button on the screen, Google’s code is called from its servers, which
`helps Google track the consumer.
`Google also allows “approved third parties” (such as Comscore, a data broker
`45.
`registered with California’s CCPA data broker registry) to provide digital pixels (“Google
`Approved Pixels”) to be embedded within the Websites’ code. See, e.g., USE TRACKING PIXELS,
`https://support.google.com/news/publisher-center/answer/9603438?hl=en (last visited May 29,
`2020). When the code for such pixels is run by user browsers, the pixels are displayed uniquely
`by each browser/device combination because of certain digital signatures unique to each browser
`and device. By tracking these pixels and the unique resulting displays, Google and its data-broker
`partners are able to track and “measure” consumers across the web.
`Like Google Analytics and Ad Manager, the Google Button and Google Approved
`46.
`
`Pixels help the tech giant track consumers across the web in real time, even when they are in
`private mode.
`Perhaps most troubling is Google’s ability to match its web tracking capabilities
`47.
`with its Android operating system data and various Google application data on mobile devices. In
`
`13
`COMPLAINT CASE NO. 20-3664
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 14 of 37
`
`
`a 2018 white paper entitled “Google Data Collection,”3 Professor Douglas C. Schmidt of
`Vanderbilt University concluded that Google’s Android operating system, and several of Google’s
`mobile applications, are constantly sending system and location data to Google’s servers.
`Specifically, Professor Schmidt wrote:
`
`Both Android and Chrome send data to Google even in the absence
`of any user interaction. Our experiments show that a dormant,
`
`stationary Android phone (with Chrome active in the background)
`communicated location information to Google 340 times during a
`24-hour period, or at an average of 14 data communications per
`hour. In fact, location information constituted 35% of all the data
`samples sent to Google.
`
`Indeed, now that Google has acquired Nest and merged Nest’s data with data obtained via Google
`
`Home, Professor Schmidt’s analysis regarding Google’s ability to identify and track who and
`
`where we are is even more persistent and pernicious.
`
`Through its passive data collection practices employed by Android, Google
`48.
`applications (e.g., Chrome and Maps), Google Home, and other Google applications and services,
`Google constantly collects users’ system and geolocation data. Plaintiffs are informed and believe
`that such passive collection happens even when a consumer is in the web browser’s “private
`browsing mode.” Indeed, the Arizona Attorney General recently filed a complaint against Google
`alleging that