Google Executives Knew “Incognito Mode” Failed to Protect Privacy, Case Says

A California federal judge is considering motions to file a lawsuit against Google that claims the company led them to believe their privacy was protected while using incognito mode in the Chrome browser.

The lawsuit, filed in Northern California District Court by five users more than two years ago, is now pending a recent motion by those plaintiffs for two class action certifications.

The former would cover all Chrome users with a Google account who logged into a non-Google website containing Google’s tracking or advertising code and who were in “incognito mode”; the second covers all Safari, Edge and Internet Explorer users with a Google account who logged into a non-Google website containing Google tracking code or advertising while in “private browsing mode”.

According to court documents first discovered by Bloomberg, Google employees joked about the browser’s incognito mode and how it didn’t really provide privacy; they also criticized the company for not doing more to provide users with the privacy they thought they had.

“As plaintiffs are fighting Google’s cynical efforts to block the production of relevant evidence, another hearing was held on October 11, which could have serious consequences for the lawsuit,” said a spokesperson for Boies Schiller Flexner LLP. , the law firm representing plaintiffs in the class action suit. “The plaintiffs motion for class certification has been discussed and a decision is currently pending.”

US District Judge Yvonne Gonzalez Rogers will decide whether tens of millions of Incognito users can be grouped to pursue legal damages of $ 100 to $ 1,000 per violation, which could bring the deal north of $ 5 billion.

The definition of the word “incognito” is to disguise or hide one’s identity.

Privacy settings in web browsers need to be removed Local tracks which websites a user visits, what they are looking for and information they have filled out in online forms. Put simply, privacy modes such as incognito browsing should not track and save data on online searches and websites visited by users.

Google also faces user privacy lawsuits from the Department of Justice and Attorneys General in several states, including Texas, Washington, DC, and the state of Washington. Earlier this month, Google resolved a $ 85 million lawsuit filed by Arizona’s AG.

“While the AGs are looking to Google for privacy concerns, this is the leading civil lawsuit related to Google’s incognito browser,” Boies spokesman Schiller Flexner said.

Originally filed in June 2020, the class action is asking for at least $ 5 billion, accusing the Alphabet unit of surprisingly gathering information about what people see online and where they browse, despite using incognito mode. The plaintiffs’ attorneys say they have a large number of internal Google emails showing that executives have known for years that “Incognito mode” doesn’t do what it claims.

When a user chooses to use the incognito mode, the Google web browser should automatically delete the browsing history and cookies at the end of a session.

The plaintiffs, who hold a Google account, allegedly the search engine collected their data and distributed and sold it for targeted advertising through a real-time bidding system (RTB).

The plaintiffs claim that even in incognito mode, Google can see which websites Chrome users visit and collect data “through means including Google Analytics, Google’s” fingerprinting “techniques, simultaneous Google applications and processes on the device. of a consumer “, as well as Google AdManager.

Ad Manager is a service from Google that allows businesses to publish and report on a company’s web, mobile and video advertising.

According to the lawsuit, over 70% of all online websites “use one or more of these Google services.” Specifically, the plaintiffs allege that whenever a user in private browsing mode visits a website running Google Analytics or Google Ad Manager, Google’s software scripts on the website “covertly direct the user’s browser to send a separate and secret message to Google’s servers in California. “

Google learns exactly what content the user’s browsing software was asking the website to display and also broadcasts a header containing the URL information of what the user viewed and requested online. The device’s IP address, geolocation data and user ID are all tracked and logged by Google, the lawsuit claims.

“Once collected, this mountain of data is analyzed to build digital dossiers on millions of consumers, in some cases identifying us by name, gender, age, as well as the medical conditions and political issues we researched online,” the lawsuit says.

In March 2021, a California judge dismissed 82 motions from Google’s attorneys to dismiss the lawsuit and ruled against the company, allowing the lawsuit to move forward.

In July, Google was ordered to pay nearly $ 1 million in legal fees and expenses as a penalty for failing to disclose evidence in a timely manner in connection with the lawsuit.

“This type of reprimand by a court is unprecedented for Google, but apparently it hasn’t stopped the company from engaging in further misconduct as it continues to block plaintiff’s efforts to gather critical evidence,” the spokesperson said. by Boies Schiller Flexner. “The plaintiffs have again submitted to the court an order requiring the production of evidence and asking for sanctions.”

Google did not respond to a request for comment.

A Google spokesperson told The Washington Post this week that it was upfront with users about what its Incognito mode offers for privacy and plaintiffs in the case “intentionally misrepresented our statements.”

Jack Gold, principal analyst at J. Gold Associates, said that Google makes most of its revenue by tracking everyone and selling ad space. “If they really create a completely private browsing experience, the revenue stream disappears,” he said. “So, I suspect there is a ‘balancing act’ going on internally as to where the boundaries between privacy and monitoring lie. No company creates a free browser without being able to generate revenue in some way. “

Plaintiffs in the case said they chose “private browsing mode” to prevent others from learning what they are viewing “on the Internet”.

For example, users often enable private browsing mode to visit particularly sensitive websites that may reveal items such as the user’s dating history, interests and / or sexual orientation, political or religious opinions, travel or private plans for the future (e.g., buying an engagement ring).

“I think the bottom line is for Google and other browsers: beware of the user,” Gold said. “You have to trust the creator to take care of your privacy, but it’s not always in their best interest to do so.”

Copyright © 2022 IDG Communications, Inc.