Brown v. Google LLC

685 F.Supp.3d 909

Chasom BROWN, et al., Plaintiffs, v. GOOGLE LLC, Defendant.

Case No.: 4:20-cv-3664-YGR

United States District Court, N.D. California

Signed August 7, 2023

John A. Yanchunis, Jean Sutton Martin, Olusegun Amen, Ra, Ryan McGee, Morgan & Morgan Complex Litigation Group, Tampa, FL, Alexander Patrick Frawley, Pro Hac Vice, Ryan Sila, Pro Hac Vice, Steven M. Shepard, Pro Hac Vice, William Christopher Carmody, Amy B. Gregory, Pro Hac Vice, Shawn Jonathan Rabin, Susman Godfrey LLP, New York, NY, Samuel Issacharoff, New York, NY, Alexander Justin Konik, Beko Osiris Ra Reblitz-Richardson, Erika Britt Nyborg-Burch, Sean Phillips Rodriguez, Mark C. Mao, Boies Schiller Flexner LLP, San Francisco, CA, Michael Francis Ram, Morgan & Morgan Complex Litigation Group, San Francisco, CA, Alison Lynn Anderson, Logan Wright, Boies Schiller Flexner LLP, Los Angeles, CA, Amanda K. Bonn, Susman Godfrey L.L.P., Los Angeles, CA, David Boies, Boies Schiller and Flexner, Armonk, NY, James W. Lee, Rossana Baeza, Boies Schiller Flexner, Miami, FL, Jenna Golda Farleigh, Susman Godfrey L.L.P., Seattle, WA, for Plaintiff Chasom Brown.

John A. Yanchunis, Jean Sutton Martin, Olusegun Amen, Ra, Ryan McGee, Morgan & Morgan Complex Litigation Group, Tampa, FL, Alexander Patrick Frawley, Pro Hac Vice, Ryan Sila, Pro Hac Vice, Steven M. Shepard, Pro Hac Vice, William Christopher Carmody, Amy B. Gregory, Shawn Jonathan Rabin, Susman Godfrey LLP, New York, NY, Samuel Issacharoff, New York, NY, Alexander Justin Konik, Beko Osiris Ra Reblitz-Richardson, Sean Phillips Rodriguez, Mark C. Mao, Boies Schiller Flexner LLP, San Francisco, CA, Amanda K. Bonn, Susman Godfrey L.L.P., Los Angeles, CA, David Boies, Boies Schiller and Flexner, Armonk, NY, James W. Lee, Rossana Baeza, Boies Schiller Flexner, Miami, FL, Jenna Golda Farleigh, Susman Godfrey L.L.P., Seattle, WA, for Plaintiff Maria Nguyen.

John A. Yanchunis, Jean Sutton Martin, Olusegun Amen, Ra, Ryan McGee, Morgan & Morgan Complex Litigation Group, Tampa, FL, Alexander Patrick Frawley, Pro Hac Vice, Ryan Sila, Pro Hac Vice, Steven M. Shepard, Pro Hac Vice, William Christopher Carmody, Amy B. Gregory, Shawn Jonathan Rabin, Susman Godfrey LLP, New York, NY, Samuel Issacharoff, New York, NY, Alexander Justin Konik, Beko Osiris Ra Reblitz-Richardson, Erika Britt Nyborg-Burch, Sean Phillips Rodriguez, Mark C. Mao, Boies Schiller Flexner LLP, San Francisco, CA, Alison Lynn Anderson, Logan Wright, Boies Schiller Flexner LLP, Los Angeles, CA, Amanda K. Bonn, Susman Godfrey L.L.P., Los Angeles, CA, David Boies, Boies Schiller and Flexner, Armonk, NY, James W. Lee, Rossana Baeza, Boies Schiller Flexner, Miami, FL, Jenna Golda Farleigh, Susman Godfrey L.L.P., Seattle, WA, for Plaintiff William Byatt.

Aarti G. Reddy, Cooley LLP, San Francisco, CA, Jonathan Sze Ming Tse, Quinn Emanuel Urquhart and Sullivan LLP, San Francisco, CA, Alyssa G. Olson, Stephen Andrew Broome, Viola Trebicka, Crystal Nix-Hines, Marie M. Hayrapetian, Quinn Emanuel Urquhart Sullivan LLP, Los Angeles, CA, Andrew H. Schapiro, Pro Hac Vice, Joseph H. Margolies, Pro Hac Vice, Teuta Fani, Quinn Emanuel Urquhart and Sullivan, LLP, Chicago, IL, Brett Watkins, Pro Hac Vice, Quinn Emanuel Urquhart and Sullivan LLP, Houston, TX, Carl Spilly, Pro Hac Vice, Washington, DC, Xi Gao, Quinn Emanuel Urquhart Sullivan, LLP, Washington, DC, Diane M. Doolittle, Sara E. Jenkins, Quinn Emanuel Urquhart & Sullivan, LLP, Redwood Shores, CA, Donald Seth Fortenbery, New York, NY, Jomaire Alicia Crawford, Pro Hac Vice, Josef Teboho Ansorge, Pro Hac Vice, Quinn Emanuel Urquhart and Sullivan, LLP, New York, NY, for Defendant.

ORDER DENYING GOOGLE'S MOTION FOR SUMMARY JUDGMENT;

DENYING PLAINTIFFS' MOTION TO STRIKE;

ADDRESSING PARTIES' MOTIONS TO SEAL

Re: Dkt. Nos. 907, 908, 924, 933, 936, 937, 939, 942, 945

Yvonne Gonzalez Rogers, United States District Court Judge

Plaintiffs Chasom Brown, William Byatt, Jeremy Davis, Christopher Castillo, and Monique Trujillo bring this class action based on Google's "surreptitious interception and collection of personal and sensitive user data while users are in 'private browsing mode.' " (Dkt. No. 886, Fourth Amended Complaint, "4AC" ¶ 1.) The 4AC contains seven counts: (1) violation of the Federal Wiretap Act, 18 U.S.C. § 2510, et seq.; (2) violation of the California Invasion of Privacy Act ("CIPA"), California Penal Code §§ 631 and 632; (3) violation of the Comprehensive Data Access and Fraud Act ("CDAFA"), Cal. Pen. Code § 502, et seq.; (4) invasion of privacy; (5) intrusion upon seclusion; (6) breach of contract; and (7) violation of California's Unfair Competition Law ("UCL"), Cal. Bus. & Prof. Code § 17200, et seq. Google brings a Motion for Summary Judgment on all counts and parties both submitted several administrative motions to seal. (Dkt. Nos. 907, 908, 924, 933, 936, 937, 939, 942, 945.) Having carefully considered the parties' briefing, the admissible evidence, the record in this case, and upon further consideration after the May 12, 2023, oral argument, the Court DENIES Google's motion for summary judgment.¹ Google's motion hinges on the idea that plaintiffs consented to Google collecting their data while they were browsing in private mode. Because Google never explicitly told users that it does so, the Court cannot find as a matter of law that users explicitly consented to the at-issue data collection.

I. BACKGROUND

The parties have hotly disputed this action from the start. For the sake of brevity, the Court gives only the background relevant to the resolution of Google's motion for summary judgment.

A. FACTUAL BACKGROUND

1. Data Collection

Plaintiffs are Google account holders who used two types of "private browsing modes": Incognito mode, which is found on Google's Chrome browser, and the private browsing mode of other browsers.² (4AC ¶ 192.) Since June 1, 2016, Google represented to plaintiffs it would not collect their information while they browsed privately. (Id. ¶ 2.) It did so anyway, collecting, aggregating, and selling plaintiffs' private browsing data without their consent. (Id. ¶ 4.)

Whenever a user visits a website that is running Google Analytics, Ad Manager, or some similar Google service, Google's software directs the user's browser to send a separate communication to Google. (Id. ¶ 63.) This happens even when users are in private browsing mode, unbeknownst to website developers or the users themselves. (Id. ¶ 66.) The operation is not in dispute. (PAF 10.)³ When a user visits a website, the user's browser sends a "GET" request to the website to retrieve it. (Id.) This GET request contains the following information: the Request URL, or the URL of the specific webpage the user is trying to access; the user's IP address; the User-agent, which identifies the user's device platform and browser; user's geolocation, if available; the Referer, which is the URL of the page on which the user clicked a link to access a new page; event data, which describes how users interact with a website, for example, whether they saw an ad or played a video; and the actual search queries on the site. (Id.) At the same time, the user's browser reads Google's code, which is embedded on the website. (Id.) Google's code instructs the user's browser to send a second and concurrent transmission directly to Google. (Id.) This second transmission tells Google exactly what a user's browser communicated to the website. (Id.)

Google's services are ubiquitous on the internet: over 70 percenta of websites use Google Analytics and Ad Manager. (4AC ¶¶ 67 and 78.) To use these services, Google requires website developers to embed Google's code onto their websites and agree to its Privacy Policy. (PAF 6.) Google does not tell website developers that it tracks their visitors even when they are in private browsing mode. (Id.)

According to plaintiffs, Google then takes users' private browsing history and associates it with their preexisting user profiles. (PAF 47; Response to SUF 65.) Doing so allows Google to offer better, more targeted, advertisements to users. (Response to SUF 63; 4AC ¶ 84.) This is at the core of Google's business: the bulk of Google's hundreds of billions of dollars in revenue come from selling targeted advertisements to other companies. (4AC ¶ 89.) By selling users' information, Google prevents users from monetizing their own data. (4AC ¶ 138; PAF 27-28.) The value of this data can be quantified; for example, Google itself has piloted a program to pay users $3.00 per week to track them. (PAF 28.)

2.Google's Representations About Private Browsing Modes

The parties do not dispute that Google's General Terms of Service and its Chrome Privacy Notice are the basis of the contract between Google and its accountholders.⁴ (SUF 15.) Further, they agree that Google's Privacy Policy was incorporated up until March 2020. That said, plaintiffs assert that three other writings are incorporated into this contract: One, Google's Privacy Policy (post March 2020), which is hyperlinked in the latest version of its General Terms of Service. (Dkt. No. 908-14, Ex. 112, 12/15/22 Google Privacy Policy.) Google's Privacy Policy tells users it is "meant to help you understand what information we collect, why we collect it, and how you can update, manage, export, and delete your information." (Id.) Two, the Search & Browse Privately Help page, which is hyperlinked in that Privacy Policy. (Dkt. No. 908-8, Ex. 92, 3/5/22 Search & Browse Privately Help page.) This page tells users "you're in control of what you information you share with Google when you search." Three, the Incognito Splash Screen, which is the first thing users see when they access Incognito mode. (Dkt. No. 908-4, Ex. 74, Incognito Splash Screen.) The Splash Screen tells users:

Image materials not available for display.

B. PROCEDURAL BACKGROUND

Given the parties' briefing, the Court notes the following procedural background:

On June 2, 2020, plaintiffs filed this suit. Initia...