Google Can Be Sued for Tracking Users in Private Browsing Mode

A U.S. district judge in California has stated that Google can be sued for collecting data on users even when they use “private browsing mode” on their selected browsers.

The lawsuit in question is a class action brought forward by three Google users—Chasom Brown, Maria Nguyen, and William Byatt—who used private browsing mode in Chrome and in Safari, Apple’s web browser, in recent years. It claims that Google tracks and collects consumer browsing history and other web activity data “no matter what safeguards” users implement. In this case, Brown v. Google, the specific safeguard referenced is private browsing mode, a feature offered by many browsers. On Google’s Chrome browser, this is referred to as “Incognito mode.”

Nonetheless, the complaint alleges that Google still tracks users in private browsing mode using Google Analytics, Google Ad Manager, the Google app on mobile devices, and the Google sign-in button for websites.

Google Analytics and Ad Manager are common traffic and ad tools for websites that provide information about their visitors, such as their demographic data and the frequency with which they visit the site, and help them manage their ad campaigns. In fact, the suit alleges that more than 70% of websites use Google Analytics.

“Through its pervasive data tracking business, Google knows who your friends are, what your hobbies are, what you like to eat, what movies you watch, where and when you like to shop, what your favorite vacation destinations are, what your favorite color is, and even the most intimate and potentially embarrassing things you browse on the internet—regardless of whether you follow Google’s advice to keep your activities ‘private,’” attorneys for the plaintiffs stated.

On Friday, District Judge Lucy Koh denied Google’s motion to dismiss the class action. Google had argued that the case was based on a “willful misreading” of its statements on private browsing and that browsing in Chrome’s private browsing mode does not mean they are “invisible.” The company contended that its privacy policy, which the plaintiffs consented to, disclosed that it received data on users when browsing online.

Koh stated, among others, that Google had not demonstrated that the users filing the claim had consented to data collection in private browsing mode.

“[N]either Google’s Privacy Policy nor any other disclosure to which Google points states that Google engages in the alleged data collection while users are in private browsing mode,” Koh wrote. “To the contrary, Google’s disclosures present private browsing as a way users can manage their privacy and omits Google from the list of entities to which a user’s private browsing activity may be visible.”

Google also stated that the websites the users visited provided it with consent to receive data about the individuals by embedding the code for Google products such as Google Analytics and Google Ad Manager. Koh again struck the argument down.

“Google does not demonstrate that websites consented to, or even knew about, the interception of their communications with users who were in private browsing mode,” Koh said.

Gizmodo reached out to Google for comment but has not received a response. In a response to the Verge on Saturday, the company said it disputed the lawsuit’s claims and added that it would defend itself vigorously against them. A spokesman for Google, José Castañeda, told the outlet that Chrome’s Incognito mode gave users the choice to browse the internet without their activity being saved to their browser or devices.

“As we clearly state each time you open a new incognito tab, websites might be able to collect information about your browsing activity during your session,” Castañeda said.

The case is an interesting development at a time when Google, as well as other big tech giants, is under increased scrutiny for being a data collecting behemoth. Although Google has announced that it will phase out third-party tracking cookies in Chrome and won’t build alternate identifiers to track people, it does plan on creating “privacy-preserving” tools for ad targeting. Essentially, it will be still be tracking users using aggregated data.

However, this new class action states “no matter what” users do, Google will be able to get information on them through its various products. It pinpoints what we all already know: Google is in every part of the web, silently collecting data on whatever you do and wherever you go. Now, the judicial system will have to determine whether that is indeed lawful.