`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 1 of 42
`
`Jesse Panuccio (pro hac admission pending)
`BOIES SCHILLER FLEXNER LLP
`1401 New York Ave, NW
`Washington, DC 20005
`Tel.: (202) 237-2727
`Fax: (202) 237-6131
`jpanuccio@bsfllp.com
`
`
`
`
`
`
`
`Mark C. Mao, CA Bar No. 236165
`Beko Reblitz-Richardson, CA Bar
`No. 238027
`Alexander J. Konik, CA Bar No. 299291
`BOIES SCHILLER FLEXNER LLP
`44 Montgomery St., 41st Floor
`San Francisco, CA 94104
`Tel.: (415) 293-6800
`Fax: (415) 293-6899
`mmao@bsfllp.com
`brichardson@bsfllp.com
`akonik@bsfllp.com
`James Lee (pro hac admission pending)
`Rossana Baeza (pro hac admission pending)
`BOIES SCHILLER FLEXNER LLP
`100 SE 2nd St., 28th Floor
`Miami, FL 33131
`Tel.: (305) 539-8400
`Fax: (303) 539-1307
`jlee@bsfllp.com
`rbaeza@bsfllp.com
`
`Attorneys for Plaintiffs
`
`
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`
`ANIBAL RODRIGUEZ and JULIEANNA
`MUNIZ individually and on behalf of all
`other similarly situated,
`
`Plaintiffs,
`
`v.
`
`GOOGLE LLC and ALPHABET INC.,
`
`
`Defendants.
`
`
`
`
`Case No. 3:20-cv-4688
`
`COMPLAINT
`
`CLASS ACTION FOR
`(1) FEDERAL WIRETAP VIOLATIONS,
`18 U.S.C. §§ 2510, ET. SEQ.;
`(2) INVASION OF PRIVACY ACT
`VIOLATIONS, CAL. PENAL CODE
`§§ 631 & 632;
`(3) INVASION OF PRIVACY;
`(4) COMPREHENSIVE COMPUTER
`DATA ACCESS AND FRAUD ACT,
`CAL. PENAL CODE § 502.
`
`
`DEMAND FOR JURY TRIAL
`
`
`
`
`
`
`
`
`
`
`COMPLAINT CASE NO. 3:20-CV-4688
`
`

`

`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 2 of 42
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`
`
`
`
`
`CLASS ACTION COMPLAINT
`This action arises from the unlawful and intentional interception and collection of
`
`individuals’ confidential communications and data without their knowledge or consent, even when
`those individuals expressly follow the recommendations of defendants Google LLC and its parent
`
`company Alphabet Inc. (collectively, “Google” or “Defendants”) to prevent the interception or
`collection of their browsing and other activity on their mobile apps. Plaintiffs Anibal Rodriguez
`and JulieAnna Muniz, individually and on behalf of all others similarly situated, file this class action
`against Google, and in support state the following:
`
`I.
`INTRODUCTION
`1.
`Google promises user control and privacy. In reality, Google is a voyeur
`extraordinaire. Google is always watching. Even when it promises to look away, Google is
`watching. Every click, every website, every app—our entire virtual lives. Intercepted. Tracked.
`Logged. Compiled. Packaged. Sold for profit.
`2.
`This case is about Google’s illegal interception of consumers’ private activity on
`consumer mobile applications (“apps”)—a huge and growing treasure trove of data that Google
`amasses by the second to sustain profits in its ever-growing share of the market for consumer
`advertising.
`3.
`Protecting data privacy is critical in our increasingly virtual and interconnected
`society. People everywhere are becoming more aware and more concerned, that large corporations
`are intercepting, collecting, recording and exploiting for profit their personal communications and
`private information.
`4.
`Well aware of these justified and growing concerns over privacy, Google—one of
`
`the world’s largest technology companies—has assured and continues to assure its consumers and
`users that when it comes to mobile app activity, they and not Google, are “in control of what
`information [they] share with Google.” For example, Google’s global Privacy Policy states on the
`first page:
`
`
`When you use our services, you’re trusting us with your
`information. We understand this is a big responsibility and work
`hard to protect your information and put you in control.
`2
`COMPLAINT CASE NO. 3:20-cv-4688
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 3 of 42
`
`…
`Our services include: … products that are integrated into third-
`party apps and sites, like ads and embedded Google Maps.
`…
`[A]cross our services, you can adjust your privacy settings to
`control what we collect and how your information is used.
`
`
`
`
`(emphasis added).
`5.
`Google purports to offer consumers the option to “control” what app browsing and
`activity data Google collects by adjusting their privacy settings to “turn Web & App Activity off . .
`. at any time” before opening or browsing mobile apps. Google repeatedly assures its consumers
`
`that they need only “[t]urn Web & App Activity on or off” to control what app activity Google can
`and cannot see.
`6.
`Google’s privacy promises and assurances are blatant lies.
`7.
`Google in fact intercepts, tracks, collects and sells consumer mobile app browsing
`history and activity data regardless of what safeguards or “privacy settings” consumers undertake
`to protect their privacy. Even when consumers follow Google’s own instructions and turn off “Web
`& App Activity” tracking on their “Privacy Controls,” Google nevertheless continues to intercept
`consumers’ app usage and app browsing communications and personal information. Indeed, even
`if consumers completely avoid using Google-branded apps and devices, Google still tracks and
`compiles their communications by covertly integrating Google’s tracking software into the products
`of other companies. Google’s illegal practices extend to hundreds of thousands of smartphone apps,
`such as apps for The New York Times, Lyft, Alibaba, The Economist and others.
`8.
`Google accomplishes this surreptitious and unlawful interception, tracking, and data
`collection of users’ app activity through its Firebase SDK (software development kits). Firebase
`
`SDK is a suite of software tools that purports to provide additional functionality to an app, especially
`if it is to be released for Android. Third-party apps use Firebase SDK because its implementation
`is a prerequisite before Google allows access to its other tools such as Google Analytics, use of
`Google’s ad exchanges (such as AdMob, explained below), and marketing of those apps on the
`Google Play Store. Developers often have no choice but to use Firebase SDK because of Google’s
`demands and market power, including with analytics, advertisements, and the Android mobile
`
`3
`COMPLAINT CASE NO. 3:20-cv-4688
`
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 4 of 42
`
`operating system. Once third-party app developers implement Firebase SDK, however, Firebase
`SDK allows Google to automatically and systematically intercept, track, and collect their users’ app
`activity data—regardless of whether those users turn off “Web & App Activity” in their settings.
`9.
`Google’s practices infringe upon consumers’ privacy; intentionally deceive
`
`consumers; give Google and its employees power to learn intimate details about individuals’ lives,
`interests, and app usage; and make Google a potential target for “one-stop shopping” by any
`government, private, or criminal actor who wants to undermine individuals’ privacy, security, or
`freedom. Through its pervasive and unlawful communication interceptions and massive data
`
`tracking and collection business, Google knows every user’s friends, hobbies, political leanings,
`culinary preferences, cinematic tastes, shopping activity, preferred vacation destinations, romantic
`involvements, and even the most intimate and potentially embarrassing aspects of the user’s app
`browsing histories and usage—regardless of whether the user accepts Google’s illusory offer to
`keep such activities “private.” Indeed, notwithstanding consumers’ best efforts, Google has made
`itself an unaccountable trove of information so detailed and expansive that George Orwell himself
`could not have imagined it.
`10.
`Google must be held accountable for the harm it has caused to its consumers. And it
`must be prevented from continuing to engage in the covert and unauthorized data tracking and
`collection from virtually every American with a mobile phone. Beyond the California Constitution,
`federal and state privacy laws recognize individuals’ reasonable expectations of privacy in
`confidential communications under these circumstances. Federal and California privacy laws
`prohibit unauthorized interception, access, and use of the contents in electronic communications.
`The European courts have also recently found the practices at issue illegal. Likewise, American
`
`regulators are beginning to recognize Google’s abusive practices for what they are.
`11.
`Plaintiffs are individuals whose mobile app usage was tracked by Google during the
`period after Google first offered users the ability to turn off “Web & App Activity” tracking and the
`present (the “Class Period”) with his or her “Web & App Activity” turned off. Google’s tracking
`and data collection included detailed browsing history data collected by Google, whereby Google
`created and monetized user information without those users’ consent. Plaintiffs bring federal and
`
`4
`COMPLAINT CASE NO. 3:20-cv-4688
`
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 5 of 42
`
`
`
`California state law claims on behalf of other similarly-situated Google subscribers in the United
`States (the “Class”) arising from Google’s knowing and unauthorized interception, copying, taking,
`use, and tracking of consumers’ internet communications and activity, and its knowing and
`unauthorized invasion of consumer privacy.
`II.
`THE PARTIES
`12.
`Plaintiff JulieAnna Muniz is an adult domiciled in El Cerrito, California. She had
`an active Google account during the entire Class Period.
`13.
`Plaintiff Anibal Rodriguez is an adult domiciled in Homestead, Florida. He had an
`
`active Google account during the entire Class Period.
`14.
`Defendant Google LLC is a Delaware limited liability company with a principal
`place of business at what is officially known as The Googleplex, 1600 Amphitheatre Parkway,
`Mountain View, California 94043. Google LLC regularly conducts business throughout California
`and in this judicial district. Google LLC is one of the largest technology companies in the world
`and conducts product development, search, and advertising operations in this district.
`15.
`Defendant Alphabet Inc. is a Delaware corporation, organized and existing under
`the laws of the State of Delaware, with its principal place of business at what is officially known as
`The Googleplex, 1600 Amphitheatre Parkway, Mountain View, California 94043-1351. Alphabet
`is the parent holding company of Google LLC. Alphabet owns all the equity interests in Google
`LLC.1
`
`III.
`JURISDICTION AND VENUE
`16.
`This Court has personal jurisdiction over Defendants because their principal place
`of business is in California. Additionally, Defendants are subject to specific personal jurisdiction
`
`in this State because a substantial part of the events and conduct giving rise to Plaintiffs’ and the
`Class’ claims occurred in this State.
`
`1 During the 2015 reorganization, certain of Google LLC’s business segments were spun off and
`separated into independent entities under the ownership of Alphabet Inc. At various times during
`the Class Period, certain of the business segments re-merged with Google LLC under one corporate
`structure. Accordingly, Alphabet Inc. and Google LLC both have been named as defendants in
`order to ensure all corporate entities who may be found liable for any portion of the alleged
`wrongdoing are part of this lawsuit.
`
`5
`COMPLAINT CASE NO. 3:20-cv-4688
`
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 6 of 42
`
`17.
`This Court has subject matter jurisdiction over the federal claims in this action,
`namely the Federal Wiretap Act, 18 U.S.C. § 2511 (the “Federal Wiretap Act”) pursuant to 28
`U.S.C. § 1331.
`18.
`This Court has subject matter jurisdiction over this entire action pursuant to the
`
`Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1332(d), because this is a class action in which
`the amount in controversy exceeds $5,000,000, and at least one member of the class is a citizen
`of a state other than California or Delaware.
`19.
`This Court also has supplemental jurisdiction over the state law claims in this
`
`action pursuant to 28 U.S.C. § 1367 because the state law claims form part of the same case or
`controversy as those that give rise to the federal claims.
`20.
`Venue is proper in this District because a substantial portion of the events and
`actions giving rise to the claims in this matter took place in this judicial District. Furthermore,
`Defendants Alphabet Inc. and Google LLC are headquartered in this District and subject to personal
`jurisdiction in this District.
`21.
`Intradistrict Assignment. A substantial part of the events and conduct which give
`rise to the claims herein occurred in Santa Clara County.
`IV. FACTUAL ALLEGATIONS
`
`
`A.
`
`Google’s Persistent, Covert Collection of Private Consumer Data through
`Google Analytics
`
`22.
`Google has collected, and continues to collect, an untold amount of consumer data
`based on online browsing activity. Over 70% of online websites and publishers on the internet
`(altogether “Websites”) utilize Google’s website visitor-tracking product, “Google Analytics.”
`
`Google Analytics is a “freemium” service Google makes available to Websites that provides data
`analytics and attribution about the origins of a Website’s traffic, demographics, frequency,
`browsing habits on the Website, and other data about visitors.2
`
`2 Google Analytics is “free” to implement if Websites want general reports with pseudo-
`anonymous data regarding visitors. To obtain more specific and granular data about visitors,
`Websites must pay a substantial fee, such as by paying for Google’s DV360, Ad Hub, or Google
`Audience products.
`
`6
`COMPLAINT CASE NO. 3:20-cv-4688
`
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 7 of 42
`
`23.
`To implement Google Analytics, Google requires Websites to embed Google’s own
`custom code into their existing webpage code. When a consumer visits a Website, his or her
`browser communicates a request to the Website’s servers to send the computer script to display
`the Website. This communication and request for content from the consumer is often referred to
`
`as a HTTP GET request, to which the Website’s servers respond with the computer code script to
`display the contents of the Website. The consumer’s browser then begins to read Google’s custom
`code along with the Website’s own code when loading the Website from the Website’s server.
`Two sets of code are thus automatically run as part of the browser’s attempt to load and read the
`
`Website pages—the Website’s code, which loads the content of the Website requested by the
`consumer, and Google’s embedded code, which does something altogether different.
`24.
`Google’s embedded code causes the user’s browser to send his or her personal
`information to Google and its servers in California, such as the user’s IP address, the URL address
`(which identifies the particular page of the Website that is being visited), and other information
`regarding the user’s device and browser. Google’s data collection almost always occurs without
`the user’s knowledge, as an automatic response to the consumer’s request for information from
`the Website’s server. Google does not require that Websites disclose upfront that Google is
`collecting the visitors’ information regardless of what they do, and as further discussed below,
`Google does not tell its consumers which websites implement Google Analytics. Other than
`staying off the internet entirely, there is no effective way for consumers to avoid Google Analytics
`and its surreptitious tracking.
`25.
`By embedding its tracking code through Google Analytics, Google is able to
`intercept, track, collect, take, compile, and use more communications that reveal personal and
`
`consumer data than any company in the world. Because more than 70% of Websites use Google
`Analytics, Google is able to track and collect a staggering amount of personal and consumer data
`online in real time. With virtually every click of the mouse to initiate a consumer’s internet
`request, Google intercepts a signal contemporaneously and sends it to its own servers. Those
`signals contain consumers’ personal viewing information and requests, which Google collects,
`reads, and organizes based on consumers’ prior histories. Google then advances its business
`
`7
`COMPLAINT CASE NO. 3:20-cv-4688
`
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 8 of 42
`
`interests by using the personal information obtained through this routine practice of covert
`interception.
`26.
`Contrary to Google’s representations, Google tracks consumers even when
`consumers select “private mode” on their browsers, including while consumers are “Incognito” on
`
`Google Chrome.3 Google does this through Google Analytics because the Google Analytics
`tracking code continues to run each time a Website is loaded regardless of whether a user is
`browsing in “private mode” or not. Thus, unbeknownst to most consumers, Google constantly
`tracks what they request and read on the internet, click by click and page by page, in real time.
`
`
`
`B.
`Google’s Persistent Collection of Mobile App Communications
`27.
`In addition to its unauthorized collection of consumer web data through Google
`Analytics, Google also engages in the same surreptitious tracking practices with respect to
`consumer use of mobile apps.
`28.
`Consumers’ mobile app usage has grown exponentially in recent years, and Google
`views this activity as the new frontier in its multi-billion dollar data tracking and collection
`business. Indeed, Google has already publicly announced that it is prioritizing mobile app results
`in its search function, and that its search results have preferred mobile app pages over webpages
`since July 1, 2019.
`29.
`Google tracks consumers’ use of mobile apps via a software development kit
`(“SDK”) called Firebase, which Google purchased as part of its acquisition of Firebase, Inc., in
`2014. Firebase SDK is a suite of software tools that purports to provide additional functionality to
`an app, especially if it is to be released for Android. Google acquired Firebase SDK as part of its
`efforts to “index” the world’s mobile apps, which permits Google Search to present search results
`
`not just from webpages but also directly from indexed pages within mobile apps. Notably,
`“Google Search uses information about the actions users take on public and personal content in an
`app to improve ranking for Search results and suggestions.” Log User Actions, FIREBASE,
`https://firebase.google.com/docs/app-indexing/android/log-actions (last visited July 1, 2020).
`
`3 This specific misconduct is detailed in a separate lawsuit pending in the Northern District of
`California. See Brown et al. v. Google LLC et al., Case No. 20–cv–03664–LHK (N.D. Cal.).
`8
`COMPLAINT CASE NO. 3:20-cv-4688
`
`
`
`
`
`
`

`

`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 9 of 42
`
`Google uses Firebase SDK for its own benefit with Google Search by “log[ging] user actions
`through the App Indexing API.” Id. Through Firebase SDK, Google can “[l]og the user’s
`interactions with the app, including viewing content, creating new content, or sharing content.”
`Id.
`
`
`30.
`For example, through Firebase SDK, Google can identify certain “actions”
`consumers take within an app, such as “viewing a recipe,” and then “log separate calls” for each
`time the consumers “view[] a recipe (start) and then clos[e] the recipe (end).” Id.
`31.
`In other words, Google aggressively tracks what consumers browse, see, create,
`
`and share online when using the apps installed on their mobile devices.
`32.
`As Search Engine Watch explained in 2015,4 “Google can index the content
`contained within an app, either through a sitemap file or through Google’s Webmaster Tools. If
`someone searches for content contained within an app, and if the user has that app installed, the
`person then has the option to view that content within the app, as opposed to outside the app on a
`mobile webpage. For sites that have the same content on their main website and app, the app
`results will appear as deep links[5] within the search listing. If the user has the app installed and
`they tap on these deep links, the app will launch and take them directly to the content.” Firebase
`SDK enables a number of tracking and data collection functions, including: what the app user is
`looking at; how the user was guided to launching the application; how the user navigates within
`the application; what actions the user takes within the application; and whether the app user
`ultimately pays for a transaction (like booking a hotel) within the application.
`33.
`Firebase SDK automatically collects information from apps, similar to how Google
`Analytics automatically collects information from online websites. Indeed, as Google itself
`
`explains to app developers: Firebase’s “[a]utomatically collected events are triggered by basic
`
`
`4 Christopher Ratcliff, What Is App Indexing and Why Is It Important?, SEARCH ENGINE WATCH
`(Nov. 19, 2015), https://www.searchenginewatch.com/2015/11/19/what-is-app-indexing-and-
`why-is-it-important/.
`5 Deep links are like hyperlinks to a specific page location within a mobile application.
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`9
`COMPLAINT CASE NO. 3:20-cv-4688
`
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 10 of 42
`
`interactions with your app. As long as you use the Firebase SDK, you don’t need to write any
`additional code to collect these events.” These “[a]utomatically collected events” include:
`(a) “page_location,” (b) “page_referrer,” and (c) “page_title.” Google states that these three
`parameters are “collected by default with every event.”6 This means that every time the user
`
`interacts with an app, Firebase records that interaction by compiling at least those parameters into
`the user’s history.
`34.
`Firebase SDK often does this automatic collection of information in conjunction
`with Google’s older app SDK, called AdMob SDK. Like Firebase SDK, AdMob SDK also
`
`automatically collects app-related information.7 AdMob is owned by Google and is one of the
`largest mobile advertisement exchanges, and Google required that publishers integrate AdMob
`SDK in order to use AdMob.
`35.
`Google’s tracking of app activity occurs not only in its own apps, which utilize
`Firebase and AdMob, but also on third-party apps that have no formal association or affiliation
`with Google other than simply utilizing the Firebase SDK. Those third-party apps utilizing the
`Firebase SDK include, for example, The New York Times, Duolingo, Alibaba, Lyft, Venmo,
`Shazam, and The Economist.
`36.
`All consumer requests for content from an app using Firebase SDK are accessible,
`collectible, trackable, and usable by Google—regardless of whether the user has expressly
`revoked permission for Google to collect and use such information.
`37.
`Google uses all of this tracked data to enhance its targeted advertising algorithms.
`38. When Google collects such information via Firebase, Google intercepts private
`communications between app users and the app publisher—that is, Google intercepts the app
`
`user’s request for specific content from the publisher. The communications collected by Firebase
`
`
`6 See Automatically Collected Events, FIREBASE HELP, https://support.google.com/firebase/
`answer/6317485?hl=en#:~:text=Automatically%20collected%20events%20%20%20%20Event
`%20name,currency%2C%20quan%20...%20%2023%20more%20rows%20 (last visited June 29,
`2020).
`7 See Automatically Collected Events, GOOGLE ADMOB HELP, https://support.google.com/
`admob/answer/9755157?hl=en (last visited July 1, 2020).
`10
`COMPLAINT CASE NO. 3:20-cv-4688
`
`
`
`
`
`
`

`

`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 11 of 42
`
`are simultaneously transmitted to Google servers in California, and Google is thereby able to
`analyze at least what the user is viewing (i.e., the “page_title”), if the user arrived at that page from
`another place where Google has a tracker (i.e., the “page_referrer”), and the page URL (i.e., the
`“page_location”). Google then uses the data to target the user with advertisements throughout
`
`Google’s advertising ecosystem—including in the very app where the communication was
`intercepted. All consumers’ requests for content from the app thereby become accessible,
`collectible, and usable by Google—regardless of whether the user has expressly revoked
`permission for Google to collect and use such information.
`
`39.
`The data collected by Firebase SDK are contemporaneously and automatically sent
`to Google servers and compiled by Google as part of its profiles on all consumers in the world,
`access to which Google then sells to advertisers for billions of dollars. Google explains none of
`this to its users.
`40.
`Publishers often have little choice in whether to use Firebase SDK, because Google
`requires the use of Firebase in the mobile ecosystem, particularly if publishers want access to
`Android operating system services, advertisement services, or analytics—all services where
`Google has market power. Notably, web and app publishers lack control over the information
`Google can collect from apps using Firebase. If online publishers want to integrate their Google
`web analytics with mobile app analytics—that is, those publishers that have both websites and
`apps and want analytics on both—Google requires that the publishers integrate Firebase SDK as
`part of their apps. Because Google Analytics is so widely used, Google’s tethering of Google
`Analytics with Firebase SDK makes Firebase SDK more pervasive, thereby making it even more
`difficult for consumers to avoid the many tentacles of Google’s data and content tracking practices.
`
`41.
`Once app publishers integrate Firebase SDK as part of their apps, they must play
`by Google’s rules. Google’s entire “configuration” menu on its Firebase documentation offers the
`following limited choices:
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`11
`COMPLAINT CASE NO. 3:20-cv-4688
`
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 12 of 42
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`Google essentially gives app publishers an all-or-nothing proposition: app publishers must either
`trust Google with everything Google collects about their users through the app (and that Google
`will comply with all laws and legal requirements), or publishers must effectively abandon
`Google’s SDK altogether.8 That app publishers—not to mention consumers and users—can
`“choose” how Google collects and uses consumer data is an illusion.
`42.
`Since the acquisition of Firebase in 2014, Google has quietly collected what must
`be the largest index of mobile app pages in the world, with over 1.5 million apps being effectively
`forced to use Firebase SDK, including most apps on Android OS. Google has also continued to
`use its monopoly power with respect to web-based searching to push rapid adoption of
`Firebase SDK, so that it can eventually release a “more complete” Search product that includes
`every mobile app page in the world. As a result, nearly every Android OS user (and most iOS
`users) are likely to have fallen victim to Google’s deceptive acts.
`C.
`Google’s Misrepresentations about Data Privacy
`
`43.
`Over the last few years, the public, legislators, enforcement agencies, and courts
`have become increasingly aware of online threats to consumer privacy—including threats posed
`by powerful technology companies that have become household names. Google has responded by
`
`
`8 See Configure Analytics Data Collection and Useage, FIREBASE HELP,
`https://firebase.google.com/docs/analytics/configure-data-collection?platform=android.
`
`12
`COMPLAINT CASE NO. 3:20-cv-4688
`
`
`
`
`
`
`

`

`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`1
`2
`3
`4
`5
`6
`7
`8
`9
`10
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`26
`27
`28
`
`Case 5:20-cv-04688-VKD Document 1 Filed 07/14/20 Page 13 of 42
`
`telling consumers that they can prevent Google from tracking their online history and collecting
`their personal data.
`44.
`In Google’s Privacy Policy, Google throughout the Class Period made and
`continues to make numerous assurances about how consumers can “control” the information
`
`consumers share with Google, and that they can engage in online activities anonymously and
`without their communications being intercepted by Google.
`45.
`Google’s Privacy Policy explicitly states: “you can adjust your privacy settings to
`control what we collect and how your information is used.” Privacy & Terms, GOOGLE,
`
`https://policies.google.com/privacy (emphasis added).
`
`
`
`46.
`Google included this same statement—“you can adjust your privacy settings to
`control what we collect and how your information is used”—in versions of its Privacy Policy dated
`May 25, 2018, January 22, 2019, October 15, 2019, December 19, 2019, March 31, 2020, and
`July 1, 2020. Earlier versions of Google’s Privacy Policy included similar representations
`regarding users’ ability to adjust privacy settings and control Google’s collection and use of their
`information.9
`47.
`On the “Go to My Activity” page of the Privacy Policy, both in the current version
`and prior versions published by Google during the Class Period, Google reiterates that “My
`Activity allows you to review and control data that’s created when you use Google services…”
`
`
`
`9 For example, the Google Privacy Policies effective between August 19, 2015 and May 24, 2018
`included a section titled “Transparency and choice.” That section states that Google’s “goal is to
`be clear about what information we collect, so that you can make meaningful choices about how
`it is used”