Brown v. Google LLC
| Decision Date | 12 March 2021 |
| Docket Number | Case No. 20-CV-03664-LHK |
| Citation | 525 F.Supp.3d 1049 |
| Parties | Chasom BROWN, et al., Plaintiffs, v. GOOGLE LLC, Defendant. |
| Court | U.S. District Court — Northern District of California |
John A. Yanchunis, Jean Sutton Martin, Pro Hac Vice, Olusegun Amen, Ra, Pro Hac Vice, Ryan McGee, Morgan & Morgan Complex Litigation Group, Tampa, FL, Alexander Patrick Frawley, Pro Hac Vice, Steven M. Shepard, Pro Hac Vice, William Christopher Carmody, Shawn Jonathan Rabin, Susman Godfrey LLP, New York, NY, Alexander Justin Konik, Antonio LaValle Ingram, II, Beko Osiris Ra Reblitz-Richardson, Sean Phillips Rodriguez, Hsiao C. Mao, Boies Schiller Flexner LLP, Michael Francis Ram, Morgan & Morgan Complex Litigation Group, San Francisco, CA, Amanda K. Bonn, Susman Godfrey L.L.P., Los Angeles, CA, David Boies, Boies Schiller and Flexner, Armonk, NY, James W. Lee, Rossana Baeza, Boies Schiller Flexner, Miami, FL, for Plaintiff Chasom Brown.
John A. Yanchunis, Jean Sutton Martin, Pro Hac Vice, Olusegun Amen, Ra, Pro Hac Vice, Ryan McGee, Morgan & Morgan Complex Litigation Group, Tampa, FL, Alexander Patrick Frawley, Pro Hac Vice, Steven M. Shepard, Pro Hac Vice, William Christopher Carmody, Shawn Jonathan Rabin, Susman Godfrey LLP, New York, NY, Alexander Justin Konik, Antonio LaValle Ingram, II, Beko Osiris Ra Reblitz-Richardson, Sean Phillips Rodriguez, Hsiao C. Mao, Boies Schiller Flexner LLP, San Francisco, CA, Amanda K. Bonn, Susman Godfrey L.L.P., Los Angeles, CA, David Boies, Boies Schiller and Flexner, Armonk, NY, James W. Lee, Rossana Baeza, Boies Schiller Flexner, Miami, FL, for Plaintiffs Maria Nguyen, William Byatt.
Andrew H. Schapiro, Pro Hac Vice, Quinn Emanuel Urquhart and Sullivan, LLP, Chicago, IL, Diane M. Doolittle, Thao T. Thai, Quinn Emanuel Urquhart & Sullivan, LLP, Redwood Shores, CA, Jomaire Alicia Crawford, Pro Hac Vice, Josef Teboho Ansorge, Pro Hac Vice, Quinn Emanuel Urquhart and Sullivan, LLP, New York, NY, Jonathan Sze Ming Tse, Quinn Emanuel Urquhart and Sullivan LLP, San Francisco, CA, Stephen Andrew Broome, Viola Trebicka, Quinn Emanuel Urquhart & Sullivan LLP, Los Angeles, CA, William Anthony Burck, Pro Hac Vice, Quinn Emanuel Urquhart and Sullivan, LLP, Washington, DC, for Defendant.
LUCY H. KOH, United States District Judge Plaintiffs Chasom Brown, Maria Nguyen, William Byatt, Jeremy Davis, and Christopher Castillo (collectively, "Plaintiffs"), individually and on behalf of all others similarly situated, sue Defendant Google LLC ("Google"). Before the Court is Google's motion to dismiss Plaintiffs’ first amended complaint. ECF No. 82. Having considered the parties’ submissions and oral arguments, the relevant law, and the record in this case, the Court DENIES Google's motion to dismiss.
Plaintiffs are Google account holders who used their browser in "private browsing mode." ECF No. 68 ("FAC") ¶ 11. Plaintiffs challenge Google's alleged collection of their data while they were in private browsing mode. Id. ¶ 5.
Plaintiffs are Google account holders who used their browser in "private browsing mode." Id. ¶ 11. In Google's Chrome browser ("Chrome"), private browsing mode is referred to as "Incognito mode." All Plaintiffs used Google's Chrome browser in Incognito mode. Id. ¶¶ 168, 173, 178, 183, 188 ( that Plaintiffs used Chrome in Incognito mode). However, one plaintiff also used a different browser, Apple's Safari browser, in private browsing mode. Id. ¶ 173 (). Furthermore, Plaintiffs seek to represent a class of users of private browsing mode without regard to the specific browser used. Id. ¶ 192.
Plaintiffs allege that "users of the Internet enable ‘private browsing mode’ for the purpose of preventing others ... from finding out what the users are viewing on the Internet." Id. ¶ 162. For example, users often enable private browsing mode in order to visit especially sensitive websites. Id. Accordingly, "users’ Internet activity, while in ‘private browsing mode,’ may reveal: a user's dating history, a user's sexual interests and/or orientation, a user's political or religious views, a user's travel plans, a user's private plans for the future (e.g., purchasing of an engagement ring)." Id.
Plaintiffs allege that Google collects data from them while they are in private browsing mode "through means that include Google Analytics, Google ‘fingerprinting’ techniques, concurrent Google applications and processes on a consumer's device, and Google's Ad Manager." Id. ¶ 8. According to Plaintiffs, "[m]ore than 70% of all online publishers (websites) use one or more of these Google services."
Specifically, Plaintiffs allege that, whenever a user, including a user in private browsing mode, visits a website that is running Google Analytics or Google Ad Manager, "Google's software scripts on the website surreptitiously direct the user's browser to send a secret, separate message to Google's servers in California." Id. ¶ 63. This message includes six elements, each of which is discussed below.
First, Plaintiffs allege that Google collects duplicate GET requests. Whenever a user visits a webpage, his or her browser sends a message to the webpage's server, called a GET request. Id. The GET request "tells the website what information is being requested and then instructs the website to send the information to the user." Id. Accordingly, when Google obtains a duplicate GET request, the duplicate GET request "enables Google to learn exactly what content the user's browsing software was asking the website to display." Id. The duplicate GET request "also transmits a ... header containing the URL information of what the user has been viewing and requesting from websites online." Id.1
Second, Plaintiffs allege that Google collects the IP address of the user's connection to the Internet, which is unique to the user's device. Id. When a device is connected to the Internet, the Internet Service Provider (ISP) that is providing the internet connection will assign the device a unique IP address. Id. at 18 n.16. Although IP addresses can change over time, the ISP often continues to assign the same IP address to the same device. Id.
Third, Plaintiffs allege that Google collects information identifying the browser software that the user is using, including "fingerprint" data. Id. Because every unique device and installed application has small differences, images, digital pixels, and fonts display slightly differently for every device and application. Id. ¶ 100. Plaintiffs allege that, "[b]y forcing a consumer to display one of its images, pixels, or fonts, online companies such as Google are able to ‘fingerprint’ their users." Id.
Fourth, Plaintiffs allege that Google collects user IDs issued by the website to the user. Id. ¶ 63. According to Plaintiffs, "Google offers an upgraded feature called ‘Google Analytics User-ID,’ which allows Google to map and match the user ... to a specific unique identifier that Google can track across the web." Id. ¶ 69. Plaintiffs allege that "[b]ecause of Google's omnipresence on the web, the use of User-IDs can be so powerful that the IDs ‘identify related actions and devices and connect these seemingly independent data points.’ " Id.
Fifth, Plaintiffs allege that Google collects the geolocation of the user. Id. ¶ 63. According to Plaintiffs, Google collects "geolocation data from (1) the Android operating system running on users’ phones or tablets and (b) Google applications running on phones (e.g. Chrome and Maps), Google Assistant, Google Home, and other Google applications and services. Id. ¶ 105.
Finally, Plaintiffs allege that Google collects information contained in Google cookies, which were saved by the user's browser. Id. ¶ 63.2 According to Plaintiffs, "Google Analytics contains a script that causes the user's ... browser to transmit, to Google, information from each of the Google Cookies already existing on the browser's cache." Id. ¶ 70. These cookies "typically show, at a minimum, the prior websites the user has viewed." Id. Thus, Google can obtain a user's browsing history from the current browsing session.
In addition, Plaintiffs allege that, for users using Chrome without Incognito Mode, Chrome constantly transmits "a unique digital string of characters called Google's ‘X-Client-Data Header,’ such that Google uniquely identifies the device and user thereafter." Id. ¶ 95. However, Plaintiffs allege that the X-Client Data Header is not present when a Chrome user has enabled Incognito Mode. Id. ¶ 96. Accordingly, Plaintiffs allege that Google is able to tell when a Chrome user has enabled Incognito Mode. Id. ¶ 96.
Plaintiffs allege that they "reasonably believed that their data would not be collected by Google and that Google would not intercept their communications when they were in ‘private browsing mode’ " because of Google's representations regarding private browsing mode. Id. ¶ 3. Conversely, Google contends that it disclosed the alleged data collection. ECF No. 82 ("Mot.") at 5–6. Five Google documents are of particular relevance regarding Google's representations to users:3 (1) Google's Privacy Policy; (2) Chrome's Privacy Notice; (3) a Google webpage entitled "Search & browse privately"; (4) a Google webpage entitled "How private browsing works in Chrome"; and (5) the Incognito Splash Screen. The Court discusses each document in turn.
First, Google's Privacy Policy states: "As you use our services, we want you to be clear how we're using information and the ways in which you can protect your privacy." Schapiro Decl. Exh. 1. Google's Privacy Policy states:
To continue reading
Request your trial
-
Denis v. Ige
...documents, even if they are currently only available through the Internet Archive's Wayback Machine. See, e.g., Brown v. Google LLC , 525 F.Supp.3d 1049, 1061 (N.D. Cal. 2021) ("Courts have taken judicial notice of the contents of web pages available through the Wayback Machine as facts tha......
-
In re Meta Pixel Healthcare Litig.
...viable. There is a not-insignificant chance, then, that plaintiffs may be able to show that the crime-tort exception applies. Cf. Brown, 525 F.Supp.3d at 1067 (finding that crime-tort exception may apply where plaintiffs had “adequately alleged that Google's association of their data with p......
-
Swarts v. The Home Depot, Inc.
... ... customers' “private chat sessions” with ... Quantum Metric; “provides its customers' chats with ... adservice.google.com”; and sends “live chat ... session data” to Twilio. Id. ¶¶ ... 9-10 ... Plaintiff ... Jason ... State's regulation.'” Id. (quoting ... Goodyear Dunlop Tires Operations, S.A. v. Brown , 564 ... U.S. 915, 919 (2011)) ... “The ... general rule is that personal jurisdiction over a defendant ... ...
-
Yockey v. Salesforce, Inc.
... ... write their own code to perform those functions from ... scratch,” Google LLC v. Oracle Am. , ... Inc. , 141 S.Ct. 1183, 1191 (2021) (quoting ... Oracle Am., Inc. v. Google, Inc. , 750 F.3d 1339, ... objectively reasonable expectation that the conversation is ... not being overheard or recorded.'” Brown v ... Google LLC , 525 F.Supp.3d 1049, 1073 (N.D. Cal. 2021) ... (quoting Flanagan v. Flanagan , 27 Cal.4th 766, ... 776-77 ... ...
-
California Invasion Of Privacy Act (CIPA) Decisions Continue To Create Uncertainty For Websites Using Third-Party Technology
...(C.D. Cal. Apr. 19, 2023). In reaching its conclusion, the Goodyear court appears to have expansively interpreted Brown v. Google, 525 F. Supp. 3d 1049 (N.D. Cal. 2021), as having held that CIPA Section 632.7 could apply to internet communications, where Brown dealt only with CIPA Section 6......