Preview
Mark C. Mao, CA Bar No. 236165 John A. Yanchunis (pro hac
mmao@bsfllp.c forthcoming
Beko Richardson, CA Bar No. 238027 jyanchunis@forthepeople.com
brichardson@bsfllp.com Ryan J. McGee (pro hac forthcoming
Joshua M. Stein, CA Bar No. 298856 rmcgee@forthepeople.com
jstein@bsfllp.com MORGAN & MORGAN
BOIES SCHILLER FLEXNER LLP 201 N. Franklin Street, 7 Floor
44 Montgomery St., 41 Floor Tampa, FL 33602
San Francisco, CA Tel.: (813) 223
Tel.: (415) 293
Michael F. Ram, CA Bar No. 104805
Fax: (415) 293
mram@forthepeople.com
James Lee (pro hac vice forthcoming MORGAN & MORGAN
jlee@bsfllp.com 711 Van Ness Ave, Suite 500
BOIES SCHILLER FLEXNER LLP San Francisco, CA 94102
100 SE 2nd St., 28 Floor Tel: (415) 358
Miami, FL 33131
Tel.: (305) 539 8400
Fax: (303) 539 1307
Attorneys for Plaintiffs
SUPERIOR COURT OF CALIFORNIA
COUNTY OF S NTA CLARA
Gilberto Flores Jr Case No.
Kendra Willis
Thomas Erb COMPLAINT FOR DAMAGES
Danielle Soucie
Aleksandar Aleksandrov VIOLATION OF CALIFORNIA’S
Michael Sattler INVASION OF PRIVACY ACT (“CIPA”)
Kevin Cooper CAL. PENAL CODE §§ 631 & 632
Daniel Blitch VIOLATION OF THE
Marissa Hearn COMPREHENSIVE COMPUTER DATA
Juan Tapia ACCESS AND FRAUD ACT (“CDAFA”),
Nadine Pactol CAL. PENAL CODE §§ 502 ET SEQ
Christina Mcculloch INVASION OF PRIVACY
Ryan Threadgill INTRUSION UPON SECLUSION;
Joshua Wilson BREACH OF CONTRACT; AND
David Gordon VIOLATION OF CA UCL, CAL. BUS. &
Zachary Umek PROF. CODE ET. SEQ.
Adrian Fielding UNJUST ENRICHMENT
Susan Olsen
Robert Everhart DEMAND FOR JURY TRIAL
Sidney Ray
Roger Du Pont
William Eggers
Juan Trujillo
Anudt Suthigoseeya
Eddie Weathers
1 David Stevenson,
Jonathan Hampton,
2 Antonino Dilorenzo,
Linda Wagner,
3 Jennifer Roberts,
Robert Browne,
4 Andrew Randolph,
Joseph Weiss,
5 Alaina Cain,
Steven Segal,
6 Viswa Muppirala,
Beau Block,
7 Ken Reid,
Octavius Davis,
8 Josh Weatherford,
Jaime Crivello,
9 Daniel Bressler,
Bailey Harper,
10 Damien Hall,
Ron Ingram,
11 Deena Ellis,
Lee Lawson,
12 Michael Smith,
Kamlesh Makwana,
13 and Jose Ramirez,
14 Plaintiffs,
15 v.
16 GOOGLE LLC,
17 Defendant.
18
19
20
21
22
23
24
25
26
27
28
TABLE OF CONTENTS
1
INTRODUCTION ......................................................................................................................... 4
2 THE PARTIES............................................................................................................................... 7
JURISDICTION AND VENUE .................................................................................................. 13
3 FACTUAL ALLEGATIONS REGARDING GOOGLE ............................................................ 13
I. Google’s History of Privacy Violations & Its Agreement with the FTC ............ 13
4 II. Google’s Privacy Policy, Privacy “Controls,” and “Incognito Screen”
Each Falsely State that Users Can Prevent Google’s Collection By Using
5 “Private Browsing Mode” (Including Incognito Mode) ...................................... 17
A. Privacy Policy .......................................................................................... 18
6 B. Privacy “Controls” ................................................................................... 19
C. “Incognito Screen” ................................................................................... 21
7 D. Plaintiffs Had a Reasonable Expectation of Privacy ............................... 23
III. Google Surreptitiously Intercepts Communications Between Users and
8 Websites And Collects Personal and Sensitive User Data Even When the
Users are in “Private Browsing Mode” ................................................................ 24
9 A. The Data Secretly Collected .................................................................... 24
B. Google Collects Data Using Google Analytics ....................................... 26
10 C. Google Collects Data Using Ad Manager ............................................... 30
D. Google Collects This Data From Users Even in Incognito Mode ........... 32
11 IV. Google Creates Profiles On Its Users Using Confidential Information ............... 33
A. Google’s Business Model Requires Extensive And Continual User
12 Data Collection ........................................................................................ 33
B. Google Creates a User Profile on Each Individual .................................. 34
13 C. Google Analytics Profiles Are Supplemented by the “X-Client-
Data Header” ............................................................................................ 35
14 D. Google Identifies You with “Fingerprinting” Techniques....................... 37
E. Google Identifies You With Your System Data and Geolocation
15 Data .......................................................................................................... 38
V. Google Profits from Its Surreptitious Collection of User Data............................ 40
16 VI. Tolling of the Statute of Limitations .................................................................... 47
FACTUAL ALLEGATIONS REGARDING THE NAMED PLAINTIFFS .............................. 53
17 CALIFORNIA LAW APPLIES TO ALL PLAINTIFFS’ CLAIMS ........................................... 83
COUNTS...................................................................................................................................... 86
18 COUNT ONE: VIOLATION OF THE CALIFORNIA INVASION OF
PRIVACY ACT (“CIPA”), CALIFORNIA PENAL CODE §§ 631 AND
19 632........................................................................................................................ 83
COUNT TWO: VIOLATIONS OF THE COMPREHENSIVE COMPUTER
20 DATA ACCESS AND FRAUD ACT (“CDAFA”), CAL. PENAL CODE
§ 502 ET SEQ....................................................................................................... 85
21 COUNT THREE: INVASION OF PRIVACY ................................................................ 86
COUNT FOUR: INTRUSION UPON SECLUSION...................................................... 89
22 COUNT FIVE: BREACH OF CONTRACT ................................................................... 90
COUNT SIX: CALIFORNIA UNFAIR COMPETITION LAW (“UCL”), CAL.
23 BUS. & PROF. CODE § 17200 ET SEQ. ............................................................ 91
COUNT SEVEN: UNJUST ENRICHMENT .................................................................. 92
24 PRAYER FOR RELIEF .............................................................................................................. 93
JURY TRIAL DEMAND ............................................................................................................ 93
25
26 `
27
28
2
1 COMPLAINT
2 Plaintiffs file this Complaint against defendant Google LLC (“Google” or “Defendant”),
3 and in support state the following.
4 INTRODUCTION
5 1. This lawsuit concerns Google’s surreptitious interception and unlawful collection of
6 Plaintiffs’ personal and sensitive data while Plaintiffs were in “Incognito” mode in Google’s
7 Chrome browser, which was supposed to permit them to browse privately.
8 2. Google has represented to Google account holders, including Plaintiffs, that they are
9 “in control of what information [they] share with Google,” meaning that they have the power to
10 limit what data Google tracks, collects, and shares with third parties. Google has represented that
11 one way for users to exercise this “control” is by setting their web-browsing software (used to
12 connect to websites) to “private browsing mode”—including Incognito mode in Google’s Chrome
13 browser (“Incognito”), which Google launched in 2008.
14 3. Based on Google’s representations, Plaintiffs reasonably believed that their data
15 would not be collected, stored, or used by Google and that Google would not intercept their
16 communications when they were in “private browsing mode.” This included Plaintiffs’ Incognito
17 mode visits to non-Google websites without being signed into any Google account.
18 4. Google’s representations were and continue to be false. Google unlawfully
19 intercepted Plaintiffs’ private browsing communications to collect their personal and sensitive
20 information, without disclosure or consent, including when they in Incognito mode visited non-
21 Google websites without being signed into any Google Account.
22 5. Google has intercepted and collected Plaintiffs’ private browsing data by causing
23 their web browsing software to run Google software scripts (bits of code) that replicate and send
24 the data to Google servers in California. These Google software “scripts” do this even if the user
25 is in Incognito mode visiting non-Google websites. These Google software scripts give no notice
26 to the user of Google’s data collection methods, and operate without any choice or consent by users.
27 6. These same Google practices have been extensively litigated in a class action lawsuit
28 filed in federal court in June 2020, where the federal court denied Google’s motions to dismiss and
3
1 for summary judgment and also granted Rule 23(b)(2) certification for two nationwide classes
2 seeking injunctive relief. Brown v. Google LLC, No. 4:20-cv-03664-YGR-SVK (“Brown” or the
3 “Brown Lawsuit”), Dkts. 53, 82, 87, 89, 92, 113. Google previously represented and led users (and
4 regulators) to believe—falsely—that users could limit Google’s data collection practices by setting
5 their Chrome browser to Incognito mode.
6 7. Admissions by Google employees found in many internal Google documents have
7 become publicly available through the Brown Lawsuit, including for example:
8 • A 2014 Google email recommending changes to Incognito so “we don’t deceive users.”
9 • A Google email describing Incognito as “bad for users, bad for human rights, bad for
10 democracy.”
11 • A 2015 Google internal presentation regarding Incognito “misconceptions” noting
12 “concern about Google collecting data in Incognito.”
13 • A 2015 Google email describing Incognito as “radioactive” and “a lie.”
14 • A 2016 Google email discussing Incognito and how “nothing will be more scannable
15 than the name and icon, both of which are a poor fit for what the feature actually
16 provides.”
17 • A 2018 Google internal document titled “Five ways people misunderstand Incognito and
18 private browsing” noting “common misconceptions” that could give a “false impression
19 of privacy.”
20 • A 2018 Google internal presentation titled “The Incognito Problem” noting Google
21 branding and disclosures “confuse people” with Google “over-promising and under-
22 delivering.”
23 • A 2018 Google email discussing how the words “Incognito” and “private” reinforce the
24 “misperception that your browsing is private everywhere instead of just on your device.”
25 • A 2018 Google email stating “the blame for people’s misconceptions about Incognito
26 Mode is due to that name and branding” as “argued repeatedly.”
27 • A 2019 Google internal document regarding Incognito stating “most users do not
28 correctly understand the current messaging” and the need to clarify whether users are
4
1 “protected from Google.”
2 • A 2019 Google internal document for CEO Sundar Pichai instructing him to not use the
3 word “private” to describe Incognito due to “known misconceptions.”
4 • A 2019 Google internal presentation noting Incognito “[u]sers currently believe that none
5 of their data is collected and they are essential[ly] [sic] anonymous.”
6 • A 2020 Google internal presentation noting private browsing users “do not understand
7 how private mode works” with “several common misconceptions” including that it “hides
8 browsing activity from Google.”
9 • A 2020 Google internal document discussing Incognito and noting “[i]t’s not private in
10 ways that many users want, that is, as to Google” and “you don’t have the ability to see
11 or delete” data, “Google has it.”
12 • A 2021 Google internal presentation noting Incognito “[u]sers overestimate the
13 protections that Incognito provides and are unaware of the personalization and data
14 collection that occurs.”
15 • A 2021 email to Google CEO Sundar Pichai admitting Incognito is “not truly private.”
16 8. Google accomplishes its surreptitious interception and data collection through means
17 that include (without limitation) Google Analytics, Google “fingerprinting” techniques, concurrent
18 Google applications and processes on a consumer’s device, and Google’s Ad Manager. More than
19 70% of all online publishers (websites) use one or more of these Google services. When a user’s
20 web-browsing software accesses one of those non-Google websites, hidden Google software
21 “scripts” cause the user’s device to send detailed, personal information to Google’s servers, including
22 the private browsing communications between the user and the website. This includes the contents
23 of the webpage being requested and the URL viewed, by Plaintiffs, in Incognito mode.
24 9. Google’s practices violate the law, infringe upon users’ privacy, and give Google
25 and its employees power to learn intimate details about individuals’ lives, interests, and internet
26 usage. This makes Google “one stop shopping” for any private, government, or criminal actor who
27 wants to undermine individuals’ privacy, security, and freedom.
28 10. Through its pervasive data tracking business, Google knows who your friends are,
5
1 what your hobbies are, what you like to eat, what movies you watch, where and when you like to
2 shop, what your favorite vacation destinations are, what your favorite color is and even the most
3 intimate and potentially embarrassing things you browse on the internet—regardless of whether you
4 follow Google’s advice to keep your activities “private.” Notwithstanding consumers’ best efforts,
5 to keep their activities on the internet private, Google has made itself an unaccountable trove of
6 information so detailed and expansive that George Orwell could never have dreamed it.
7 11. Plaintiffs are individuals who are all within the scope of the certified nationwide
8 classes in the Brown Lawsuit who have now decided to separately seek monetary relief from Google
9 based on Google’s unlawful acts. Plaintiffs assert claims that already proceeded past motions to
10 dismiss and summary judgment in the Brown Lawsuit, where the federal court certified two
11 nationwide classes under Rule 23(b)(2) to pursue these claims for purposes of obtaining injunctive
12 relief. Plaintiffs now each seek monetary relief from Google, including statutory damages. Google
13 has taken the position that any request for monetary relief involves certain individualized issues and
14 should be tried separately.
15 THE PARTIES
16 12. Plaintiffs are Google account holders whose internet use was tracked by Google while
17 browsing the internet from the Chrome browser in Incognito mode. Plaintiffs assert claims arising
18 from Google’s knowing and unauthorized interception and tracking of their internet communications
19 and activity and knowing and unauthorized invasion of consumer privacy.
20 13. Plaintiff Gilberto Flores Jr (“Flores”) is an adult domiciled in Eagle Pass, TX, who
21 has an active Google account and during the relevant period used Incognito mode to visit non-
22 Google websites without being signed in to any Google account.
23 14. Plaintiff Kendra Willis (“Willis”) is an adult domiciled in Redwood City, CA, who
24 has an active Google account and during the relevant period used Incognito mode to visit non-
25 Google websites without being signed in to any Google account.
26 15. Plaintiff Thomas Erb (“Erb”) is an adult domiciled in Knoxville, TN, who has an
27 active Google account and during the relevant period used Incognito mode to visit non-Google
28 websites without being signed in to any Google account.
6
1 16. Plaintiff Danielle Soucie (“Soucie”) is an adult domiciled in Davenport, IA, who has
2 an active Google account and during the relevant period used Incognito mode to visit non-Google
3 websites without being signed in to any Google account.
4 17. Plaintiff Aleksandar Aleksandrov (“Aleksandrov”) is an adult domiciled in Las
5 Vegas, NV, who has an active Google account and during the relevant period used Incognito mode
6 to visit non-Google websites without being signed in to any Google account.
7 18. Plaintiff Michael Sattler (“Sattler”) is an adult domiciled in Tallahassee, FL, who
8 has an active Google account and during the relevant period used Incognito mode to visit non-
9 Google websites without being signed in to any Google account.
10 19. Plaintiff Kevin Cooper (“Cooper”) is an adult domiciled in Marshfield, WI, who has
11 an active Google account and during the relevant period used Incognito mode to visit non-Google
12 websites without being signed in to any Google account.
13 20. Plaintiff Daniel Blitch (“Blitch”) is an adult domiciled in Burbank, CA, who has an
14 active Google account and during the relevant period used Incognito mode to visit non-Google
15 websites without being signed in to any Google account.
16 21. Plaintiff Marissa Hearn (“Hearn”) is an adult domiciled in Oak Ridge, TN, who has
17 an active Google account and during the relevant period used Incognito mode to visit non-Google
18 websites without being signed in to any Google account.
19 22. Plaintiff Juan Tapia (“Tapia”) is an adult domiciled in Round Lake Beach, IL, who
20 has an active Google account and during the relevant period used Incognito mode to visit non-
21 Google websites without being signed in to any Google account.
22 23. Plaintiff Nadine Pactol (“Pactol”) is an adult domiciled in Hilo, HI, who has an active
23 Google account and during the relevant period used Incognito mode to visit non-Google websites
24 without being signed in to any Google account.
25 24. Plaintiff Christina Mcculloch (“Mcculloch”) is an adult domiciled in Troy, OH, who
26 has an active Google account and during the relevant period used Incognito mode to visit non-
27 Google websites without being signed in to any Google account.
28 25. Plaintiff Ryan Threadgill (“Threadgill”) is an adult domiciled in Memphis, TN, who
7
1 has an active Google account and during the relevant period used Incognito mode to visit non-
2 Google websites without being signed in to any Google account.
3 26. Plaintiff Joshua Wilson (“Wilson”) is an adult domiciled in Miami, FL, who has an
4 active Google account and during the relevant period used Incognito mode to visit non-Google
5 websites without being signed in to any Google account.
6 27. Plaintiff David Gordon (“Gordon”) is an adult domiciled in University Place, WA,
7 who has an active Google account and during the relevant period used Incognito mode to visit non-
8 Google websites without being signed in to any Google account.
9 28. Plaintiff Zachary Umek (“Umek”) is an adult domiciled in Hillsboro, IL, who has an
10 active Google account and during the relevant period used Incognito mode to visit non-Google
11 websites without being signed in to any Google account.
12 29. Plaintiff Adrian Fielding (“Fielding”) is an adult domiciled in Cartersville, GA, who
13 has an active Google account and during the relevant period used Incognito mode to visit non-
14 Google websites without being signed in to any Google account.
15 30. Plaintiff Susan Olsen (“Olsen”) is an adult domiciled in Tampa, FL, who has an
16 active Google account and during the relevant period used Incognito mode to visit non-Google
17 websites without being signed in to any Google account.
18 31. Plaintiff Robert Everhart (“Everhart”) is an adult domiciled in Santa Barbara, CA,
19 who has an active Google account and during the relevant period used Incognito mode to visit non-
20 Google websites without being signed in to any Google account.
21 32. Plaintiff Sidney Ray (“Ray”) is an adult domiciled in Canton, MS, who has an active
22 Google account and during the relevant period used Incognito mode to visit non-Google websites
23 without being signed in to any Google account.
24 33. Plaintiff Roger Du Pont (“Du Pont”) is an adult domiciled in New York, NY, who
25 has an active Google account and during the relevant period used Incognito mode to visit non-
26 Google websites without being signed in to any Google account.
27 34. Plaintiff William Eggers (“Eggers”) is an adult domiciled in Cupertino, CA, who has
28 an active Google account and during the relevant period used Incognito mode to visit non-Google
8
1 websites without being signed in to any Google account.
2 35. Plaintiff Juan Trujillo (“Trujillo”) is an adult domiciled in Roswell, NM, who has an
3 active Google account and during the relevant period used Incognito mode to visit non-Google
4 websites without being signed in to any Google account.
5 36. Plaintiff Anudt Suthigoseeya (“Suthigoseeya”) is an adult domiciled in Chicago, IL,
6 who has an active Google account and during the relevant period used Incognito mode to visit non-
7 Google websites without being signed in to any Google account.
8 37. Plaintiff Eddie Weathers (“Weathers”) is an adult domiciled in Hinesville, GA, who
9 has an active Google account and during the relevant period used Incognito mode to visit non-
10 Google websites without being signed in to any Google account.
11 38. Plaintiff David Stevenson (“Stevenson”) is an adult domiciled in Queens, NY, who
12 has an active Google account and during the relevant period used Incognito mode to visit non-
13 Google websites without being signed in to any Google account.
14 39. Plaintiff Jonathan Hampton (“Hampton”) is an adult domiciled in Minneapolis, MN,
15 who has an active Google account and during the relevant period used Incognito mode to visit non-
16 Google websites without being signed in to any Google account.
17 40. Plaintiff Antonino Dilorenzo (“Dilorenzo”) is an adult domiciled in Queens, NY,
18 who has an active Google account and during the relevant period used Incognito mode to visit non-
19 Google websites without being signed in to any Google account.
20 41. Plaintiff Linda Wagner (“Wagner”) is an adult domiciled in Opp, AL, who has an
21 active Google account and during the relevant period used Incognito mode to visit non-Google
22 websites without being signed in to any Google account.
23 42. Plaintiff Jennifer Roberts (“Roberts”) is an adult domiciled in Greenbrier, TN, who
24 has an active Google account and during the relevant period used Incognito mode to visit non-
25 Google websites without being signed in to any Google account.
26 43. Plaintiff Robert Browne (“Browne”) is an adult domiciled in San Juan Capistrano,
27 CA, who has an active Google account and during the relevant period used Incognito mode to visit
28 non-Google websites without being signed in to any Google account.
9
1 44. Plaintiff Andrew Randolph (“Randolph”) is an adult domiciled in Phoenixville, PA,
2 who has an active Google account and during the relevant period used Incognito mode to visit non-
3 Google websites without being signed in to any Google account.
4 45. Plaintiff Joseph Weiss (“Weiss”) is an adult domiciled in Lake Forest, IL, who has
5 an active Google account and during the relevant period used Incognito mode to visit non-Google
6 websites without being signed in to any Google account.
7 46. Plaintiff Alaina Cain (“Cain”) is an adult domiciled in Akron, OH, who has an active
8 Google account and during the relevant period used Incognito mode to visit non-Google websites
9 without being signed in to any Google account.
10 47. Plaintiff Steven Segal (“Segal”) is an adult domiciled in Carson City, NV, who has
11 an active Google account and during the relevant period used Incognito mode to visit non-Google
12 websites without being signed in to any Google account.
13 48. Plaintiff Viswa Muppirala (“Muppirala”) is an adult domiciled in Seattle, WA, who
14 has an active Google account and during the relevant period used Incognito mode to visit non-
15 Google websites without being signed in to any Google account.
16 49. Plaintiff Beau Block (“Block”) is an adult domiciled in Rushford, MN, who has an
17 active Google account and during the relevant period used Incognito mode to visit non-Google
18 websites without being signed in to any Google account.
19 50. Plaintiff Ken Reid (“Reid”) is an adult domiciled in Indianapolis, IN, who has an
20 active Google account and during the relevant period used Incognito mode to visit non-Google
21 websites without being signed in to any Google account.
22 51. Plaintiff Octavius Davis (“Davis”) is an adult domiciled in Middleburg, FL, who has
23 an active Google account and during the relevant period used Incognito mode to visit non-Google
24 websites without being signed in to any Google account.
25 52. Plaintiff Josh Weatherford (“Weatherford”) is an adult domiciled in Butler, GA, who
26 has an active Google account and during the relevant period used Incognito mode to visit non-
27 Google websites without being signed in to any Google account.
28 53. Plaintiff Jaime Crivello (“Crivello”) is an adult domiciled in Sebring, FL, who has
10
1 an active Google account and during the relevant period used Incognito mode to visit non-Google
2 websites without being signed in to any Google account.
3 54. Plaintiff Daniel Bressler (“Bressler”) is an adult domiciled in Eugene, OR, who has
4 an active Google account and during the relevant period used Incognito mode to visit non-Google
5 websites without being signed in to any Google account.
6 55. Plaintiff Bailey Harper (“Harper”) is an adult domiciled in Bay Village, OH, who
7 has an active Google account and during the relevant period used Incognito mode to visit non-
8 Google websites without being signed in to any Google account.
9 56. Plaintiff Damien Hall (“Hall”) is an adult domiciled in New Port Richey, FL, who
10 has an active Google account and during the relevant period used Incognito mode to visit non-
11 Google websites without being signed in to any Google account.
12 57. Plaintiff Ron Ingram (“Ingram”) is an adult domiciled in Las Vegas, NV, who has
13 an active Google account and during the relevant period used Incognito mode to visit non-Google
14 websites without being signed in to any Google account.
15 58. Plaintiff Deena Ellis (“Ellis”) is an adult domiciled in Deland, FL, who has an active
16 Google account and during the relevant period used Incognito mode to visit non-Google websites
17 without being signed in to any Google account.
18 59. Plaintiff Lee Lawson (“Lawson”) is an adult domiciled in Mayo, FL, who has an
19 active Google account and during the relevant period used Incognito mode to visit non-Google
20 websites without being signed in to any Google account.
21 60. Plaintiff Michael Smith (“Smith”) is an adult domiciled in Brooksville, FL, who has
22 an active Google account and during the relevant period used Incognito mode to visit non-Google
23 websites without being signed in to any Google account.
24 61. Plaintiff Kamlesh Makwana (“Makwana”) is an adult domiciled in Los Angeles, CA,
25 who has an active Google account and during the relevant period used Incognito mode to visit non-
26 Google websites without being signed in to any Google account.
27 62. Plaintiff Jose Ramirez (“Ramirez”) is an adult domiciled in San Diego, CA, who has
28 an active Google account and during the relevant period used Incognito mode to visit non-Google
11
1 websites without being signed in to any Google account.
2 63. Defendant Google is a Delaware limited liability company with a principal place of
3 business at what is officially known as The Googleplex, 1600 Amphitheatre Parkway, Mountain
4 View, California 94043. Google regularly conducts business throughout California and in this
5 judicial district. Google is one of the largest technology companies in the world and conducts
6 product development, search, and advertising operations in this district.
7 JURISDICTION AND VENUE
8 64. This Court has jurisdiction because Google’s principal place of business is in
9 California, Google maintains its headquarters in Santa Clara County, California, and a substantial
10 part of the events and conduct giving rise to Plaintiffs’ claims occurred in this State, including
11 Google’s development of the at-issue technology and receiving, accessing, and using the intercepted
12 communications and data at issue in California.
13 65. This Court is a proper venue for this action. Google is headquartered in and engaged
14 in the unlawful conduct from this County, and the contract between Plaintiffs and Google includes a
15 venue selection clause for Santa Clara County. Google’s Terms of Service state “all disputes arising
16 out of or relating to these terms, service specific additional terms, or any related services, regardless of
17 conflict of laws rules ... will be resolved exclusively in the federal or state courts of Santa Clara County,
18 California, USA, and you and Google consent to personal jurisdiction in those courts.” Venue is
19 therefore proper here in Santa Clara County.
20 FACTUAL ALLEGATIONS REGARDING GOOGLE
21 I. Google’s History of Privacy Violations & Its Agreement with the FTC
22 66. Google’s violation of consumers’ privacy rights is not new—it has been persistent
23 and pervasive for at least a decade.
24 67. In 2010, the FTC charged that Google “used deceptive tactics and violated its own
25 privacy promises to consumers when it launched its social network, Google Buzz.” To settle the
26 matter, the FTC barred Google “from future privacy misrepresentations” and required Google “to
27
28
12
1 implement a comprehensive privacy program.”1
2 68. In 2011, Google entered into a consent decree with the FTC (the “Consent Decree”),
3 effective for 20 years, in which the FTC required and Google agreed as follows (emphasis added):
4 IT IS ORDERED that [Google], in or affecting commerce, shall not
misrepresent in any manner, expressly or by implication:
5
A. the extent to which [Google] maintains and protects the privacy and
6 confidentiality of any covered information, including, but not limited to,
misrepresentations related to: (1) the purposes for which it collects and uses
7 covered information, and (2) the extent to which consumers may exercise
control over the collection, use, or disclosure of covered information.2
8
9 69. This requirement applies to the Google conduct at issue in this lawsuit, as the
10 Consent Decree broadly defines “covered information” to include information Google “collects
11 from or about an individual” including a “persistent identifier, such as IP address,” and
12 combinations of additional data with the same.
13 70. Just one year after the Consent Decree was entered, the FTC found that Google had
14 already violated the Consent Decree, by way of Google’s misrepresentations regarding what
15 consumer data it would and would not collect with the Safari web browser. In an August 2012
16 press release, the FTC explained:
17 Google Inc. has agreed to pay a record $22.5 million civil penalty to settle
Federal Trade Commission charges that it misrepresented to users of
18 Apple Inc.’s Safari Internet browser that it would not place tracking
“cookies” or serve targeted ads to those users, violating an earlier privacy
19 settlement between the company and the FTC.
20 The settlement is part of the FTC’s ongoing efforts to make sure
companies live up to the privacy promises they make to consumers and is
21 the largest penalty the agency has ever obtained for a violation of a
Commission order. In addition to the civil penalty, the order also requires
22 Google to disable all the tracking cookies it had said it would not place on
consumers’ computers.
23
“The record setting penalty in this matter sends a clear message to all
24 companies under an FTC privacy order,” said Jon Leibowitz, Chairman of
25
26 1
.https://www.ftc.gov/news-events/press-releases/2011/03/ftc-charges-deceptive-privacy-
practices-googles-rollout-its-buzz.
27
2
28 https://www.ftc.gov/sites/default/files/documents/cases/2011/03/110330googlebuzzagreeorder.p
df.
13
the FTC. “No matter how big or small, all companies must abide by FTC
1 orders against them and keep their privacy promises to consumers, or they
will end up paying many times what it would have cost to comply in the
2 first place.”3
3
71. Since 2012, a number of federal, state, and international regulators have similarly
4
accused Google of violating its promises to consumers on what data it would and would not collect,
5
with Google failing to obtain consent for its conduct.
6
72. In September 2016, when Google updated its browser app for Apple iOS, Google
7
wrote that users would have “[m]ore control with incognito mode” and “Your searches are your
8
business. That’s why we’ve added the ability to search privately with incognito mode in the
9
Google app for iOS. When you have incognito mode turned on in your settings, your search and
10
browsing history will not be saved.”4 Google made no statements about how users’ privacy would
11
actually be limited in these private browsing sessions and avoided for years what it now claims (as
12
a result of this litigation shining the light on its practices): that users never had the privacy they
13
were promised.
14
73. Similarly, in May 2018, Google modified its privacy policy to state, “[y]ou can use
15
our services in a variety of ways to manage your privacy. . . . You can also choose to browse the
16
web privately using Chrome in Incognito mode.”5
17
74. Nonetheless, in 2019, Google and YouTube agreed to pay $170 million to settle
18
allegations by the Federal Trade Commission and the New York Attorney General that YouTube
19
video sharing services illegally collected personal information from children without their parents’
20
consent.
21
75. Then, in June 2020, France’s Highest Administrative Court upheld a 50 million
22
Euro fine against Google based on its failure to provide clear notice and obtain users’ valid consent
23
to process their personal data for ad personalization purposes.
24
25
26 3
https://www.ftc.gov/news-events/press-releases/2012/08/google-will-pay-225-million-settle-
ftc-charges-it-misrepresented.
27 4
https://www.googblogs.com/the-latest-updates-and-improvements-for-the-google-app-for-ios/.
28 See also, https://search.googleblog.com/index.html.
5
https://policies.google.com/privacy/archive/20171218-20180525?hl=en-US.
14
1 76. There have been myriad proceedings by the State Attorneys General and the
2 Australian Competition and Consumer Commission alleging Google’s failure to obtain consent
3 regarding its collection of location data and its decision to combine certain user data.
4 77. For example, In the Arizona Attorney General action, Google has produced
5 documents establishing “overwhelming” evidence that “Google has known that the user
6 experience they designed misleads and deceives users.”
7 78. And in an Australia proceeding, the Australian Competition & Consumer
8 Commission (“ACCC”) alleged that “Google misled Australian consumers to obtain their consent
9 to expand the scope of personal information that Google could collect and combine about
10 consumers’ internet activity, for use by Google, including for targeted advertising.”6 The ACCC
11 contended that Google “misled Australian consumers about what it planned to do with large
12 amounts of their personal information, including internet activity on websites not connected to
13 Google.”7
14 79. Google’s employees made numerous admissions in internal communications,
15 recognizing that Google’s privacy disclosures are a “mess” with regards to obtaining “consent”
16 for its data collection practices and other issues relevant in this lawsuit. Those documents are
17 heavily redacted by Google, and include for example the following comments and questions by
18 Google employees:
19 a. “Do users with significant privacy concerns understand what data we are
20 saving?”
21 b. “[T]ake a look at [redacted by Google] – work in progress, trying to rein
22 in the overall mess that we have with regards to data collection, consent,
23 and storage.”
24 c. “[A] bunch of other stuff that’s super messy. And it’s a Critical User
25
26 6
https://www.accc.gov.au/media-release/correction-accc-alleges-google-misled-consumers-
about-expanded-use-of-personal-
27 data#:~:text=The%20ACCC%20has%20launched%20Federal,Google%2C%20including%20for
28 %20targeted%20advertising.
7
Id.
15
1 Journey to make sense out of this mess.”
2 80. Those internal documents are not limited to location data, and unredacted versions
3 of those documents and other internal Google documents will further demonstrate and confirm the
4 lack of consent for the Google conduct at issue in this lawsuit.
5 II. Google’s Privacy Policy, Privacy “Controls,” and “Incognito Screen” Each Falsely
State that Users Can Prevent Google’s Collection By Using “Private Browsing
6
Mode” (Including Incognito Mode)
7 81. The public, legislators, and courts have become increasingly aware of online threats
8 to consumer privacy—including threats posed by powerful technology companies like Google that
9 have become household names.
10 82. To comply with the new laws like the California Consumer Privacy Act (the
11 “CCPA”) and Europe’s General Data Privacy Regulation (the “GDPR”) and to comply with the
12 Consent Decree, Google has repeatedly represented that users have control over what information
13 is shared with Google and that users can prevent Google from tracking their browsing history and
14 collecting their personal data online.
15 83. Plaintiffs had a reasonable expectation of privacy while they were using a private
16 browser mode. Specifically, Plaintiffs expected that, when they were using Incognito mode,
17 Google (a) would not collect the data as described in this Complaint, and (b) would not thereafter
18 use the data, collected during “private browsing mode,” for all of the purposes described below.
19 84. This expectation of privacy was reasonable because of Google’s own statements
20 regarding “private browsing modes” like Incognito mode as described below, including the
21 following:
22 • “You’re in control of what information you share with Google . . . .”
23 • “You can use our services in a variety of ways to manage your privacy . . . across
24 our services, you can adjust our privacy settings to control what we collect and
25 how your information is used.”
26 • “You can also choose to browse the web privately using Chrome in Incognito
27 mode.”
28 • “Your search and ad results may be customized using search-related activity even
16
1 if you’re signed out. To turn off this kind of search customization, you can search
2 and browse privately.”
3 • “To browse the web privately, you can use private browsing, sign out of your
4 account, change your custom results settings, or delete past activity.”
5 • “Your searches are your business. . . . When you have incognito mode turned on
6 in your settings, your search and browsing history will not be saved.”
7 Importantly, Google did not represent in any disclosure to Plaintiffs that it would continue to
8 intercept, track, and collect communications even when they used a browser while in Incognito
9 mode.
10 85. Google never notified Plaintiffs that Google would intercept, collect, store, or use
11 Plaintiffs’ communications while in Incognito mode.
12 A. Privacy Policy
13 86. In Google’s Privacy Policy (the “Privacy Policy”), Google made numerous
14 representations about how users can “control” the information users share with Google and how
15 users can browse the web anonymously and without their communications with websites being
16 intercepted.
17 87. Google’s Privacy Policy starts by stating in the Introduction section that “you can
18 adjust your privacy settings to control what we collect and how your information is used” and that
19 “[y]ou can choose to browse the web privately using Chrome in Incognito mode”:
20
21
22
23 88. The front and center of the “choices” offered to consumers is “Your privacy
24 controls” on the Privacy Policy. Here, Google reiterates, “[y]ou have choices regarding the
25 information we collect and how it’s used.” On the “My Activity” section of this part of the Privacy
26 Policy, Google reiterates that “My Activity allows you to review and control data that’s created
27 when you use Google services, like searches you’ve done.
28
17
1
2
3
4
5
6
7 89. In the Privacy Policy Google also promises that it will not reduce the protections it
8 guarantees to users without first obtaining their explicit consent to do so:
9
10
11
12
13
14
15
B. Privacy “Controls”
16
90. Users interested in controlling what Google collects are directed to the “Control
17
Panel” of this same Privacy Policy, where Google assures users that “[t]o browse the web privately,
18
you can use private browsing” and that “[i]f you want to search the web without saving your search
19
activity to your account, you can use private browsing mode in a browser (like Chrome or Safari).” 8
20
When users click on “Go to My Activity” to control their data, they are presented with the option
21
to “Learn more.” When users click on “Learn more,” they are taken to a page where they are
22
supposed to be able to “View & control activity in your account.” On that page, Google states that
23
you may “[s]top saving activity temporarily. . . . You can search and browse the web privately,”
24
embedding a hyperlink to the “Search & Browse Privately” page. 9
25
26
8
https://support.google.com/websearch/answer/4540094?.
27 9
See SEARCH & BROWSE PRIVATELY,
28 https://support.google.com/websearch/answer/4540094?hl=en&ref_topic
=3036132.
18
1 91. On the “Search & Browse Privately” page, Google once again reiterates that the
2 user, not Google, is “in control of what information [a user] . . . share[s] with Google . . . .” Google
3 states simply that consumers enabling “private browsing mode” on their browsers will allow
4 consumers to “browse the web privately”:
5
6
7
8
9
10
11
12
13
14
15
16
17 There is nothing on this page about Google Analytics, Google Ad Manager, any other Google data
18 collection tool, or where and which websites online implement such data collection tools.
19 92. From the “View & control activity in your account” page referenced above, a
20 consumer can also click the link, “See & control your Web & App Activity” on the right-hand
21 side.10 On that page, Google again represents that searching and browsing in “private browsing
22 mode” will “turn off” any “search customization” “using search-related activity”:
23
24
25
26
27
10
28 SEE & CONTROL YOUR WEB & APP ACTIVITY, https://support.google.com/websearch/
answer/54068?visit_id=6372555086257257422105376128&hl=en&rd=1.
19
1
2
3
4 93. When users click the “Learn how” link, they are again redirected back to the
5 “Search & Browse Privately” page. In other words, because Google repeatedly touts that users
6 can “control” the information they share with Google and Google constantly refers users bac
Preview
Mark C. Mao, CA Bar No. 236165 John A. Yanchunis (pro hac mmao@bsfllp.c forthcoming Beko Richardson, CA Bar No. 238027 jyanchunis@forthepeople.com brichardson@bsfllp.com Ryan J. McGee (pro hac forthcoming Joshua M. Stein, CA Bar No. 298856 rmcgee@forthepeople.com jstein@bsfllp.com MORGAN & MORGAN BOIES SCHILLER FLEXNER LLP 201 N. Franklin Street, 7 Floor 44 Montgomery St., 41 Floor Tampa, FL 33602 San Francisco, CA Tel.: (813) 223 Tel.: (415) 293 Michael F. Ram, CA Bar No. 104805 Fax: (415) 293 mram@forthepeople.com James Lee (pro hac vice forthcoming MORGAN & MORGAN jlee@bsfllp.com 711 Van Ness Ave, Suite 500 BOIES SCHILLER FLEXNER LLP San Francisco, CA 94102 100 SE 2nd St., 28 Floor Tel: (415) 358 Miami, FL 33131 Tel.: (305) 539 8400 Fax: (303) 539 1307 Attorneys for Plaintiffs SUPERIOR COURT OF CALIFORNIA COUNTY OF S NTA CLARA Gilberto Flores Jr Case No. Kendra Willis Thomas Erb COMPLAINT FOR DAMAGES Danielle Soucie Aleksandar Aleksandrov VIOLATION OF CALIFORNIA’S Michael Sattler INVASION OF PRIVACY ACT (“CIPA”) Kevin Cooper CAL. PENAL CODE §§ 631 & 632 Daniel Blitch VIOLATION OF THE Marissa Hearn COMPREHENSIVE COMPUTER DATA Juan Tapia ACCESS AND FRAUD ACT (“CDAFA”), Nadine Pactol CAL. PENAL CODE §§ 502 ET SEQ Christina Mcculloch INVASION OF PRIVACY Ryan Threadgill INTRUSION UPON SECLUSION; Joshua Wilson BREACH OF CONTRACT; AND David Gordon VIOLATION OF CA UCL, CAL. BUS. & Zachary Umek PROF. CODE ET. SEQ. Adrian Fielding UNJUST ENRICHMENT Susan Olsen Robert Everhart DEMAND FOR JURY TRIAL Sidney Ray Roger Du Pont William Eggers Juan Trujillo Anudt Suthigoseeya Eddie Weathers 1 David Stevenson, Jonathan Hampton, 2 Antonino Dilorenzo, Linda Wagner, 3 Jennifer Roberts, Robert Browne, 4 Andrew Randolph, Joseph Weiss, 5 Alaina Cain, Steven Segal, 6 Viswa Muppirala, Beau Block, 7 Ken Reid, Octavius Davis, 8 Josh Weatherford, Jaime Crivello, 9 Daniel Bressler, Bailey Harper, 10 Damien Hall, Ron Ingram, 11 Deena Ellis, Lee Lawson, 12 Michael Smith, Kamlesh Makwana, 13 and Jose Ramirez, 14 Plaintiffs, 15 v. 16 GOOGLE LLC, 17 Defendant. 18 19 20 21 22 23 24 25 26 27 28 TABLE OF CONTENTS 1 INTRODUCTION ......................................................................................................................... 4 2 THE PARTIES............................................................................................................................... 7 JURISDICTION AND VENUE .................................................................................................. 13 3 FACTUAL ALLEGATIONS REGARDING GOOGLE ............................................................ 13 I. Google’s History of Privacy Violations & Its Agreement with the FTC ............ 13 4 II. Google’s Privacy Policy, Privacy “Controls,” and “Incognito Screen” Each Falsely State that Users Can Prevent Google’s Collection By Using 5 “Private Browsing Mode” (Including Incognito Mode) ...................................... 17 A. Privacy Policy .......................................................................................... 18 6 B. Privacy “Controls” ................................................................................... 19 C. “Incognito Screen” ................................................................................... 21 7 D. Plaintiffs Had a Reasonable Expectation of Privacy ............................... 23 III. Google Surreptitiously Intercepts Communications Between Users and 8 Websites And Collects Personal and Sensitive User Data Even When the Users are in “Private Browsing Mode” ................................................................ 24 9 A. The Data Secretly Collected .................................................................... 24 B. Google Collects Data Using Google Analytics ....................................... 26 10 C. Google Collects Data Using Ad Manager ............................................... 30 D. Google Collects This Data From Users Even in Incognito Mode ........... 32 11 IV. Google Creates Profiles On Its Users Using Confidential Information ............... 33 A. Google’s Business Model Requires Extensive And Continual User 12 Data Collection ........................................................................................ 33 B. Google Creates a User Profile on Each Individual .................................. 34 13 C. Google Analytics Profiles Are Supplemented by the “X-Client- Data Header” ............................................................................................ 35 14 D. Google Identifies You with “Fingerprinting” Techniques....................... 37 E. Google Identifies You With Your System Data and Geolocation 15 Data .......................................................................................................... 38 V. Google Profits from Its Surreptitious Collection of User Data............................ 40 16 VI. Tolling of the Statute of Limitations .................................................................... 47 FACTUAL ALLEGATIONS REGARDING THE NAMED PLAINTIFFS .............................. 53 17 CALIFORNIA LAW APPLIES TO ALL PLAINTIFFS’ CLAIMS ........................................... 83 COUNTS...................................................................................................................................... 86 18 COUNT ONE: VIOLATION OF THE CALIFORNIA INVASION OF PRIVACY ACT (“CIPA”), CALIFORNIA PENAL CODE §§ 631 AND 19 632........................................................................................................................ 83 COUNT TWO: VIOLATIONS OF THE COMPREHENSIVE COMPUTER 20 DATA ACCESS AND FRAUD ACT (“CDAFA”), CAL. PENAL CODE § 502 ET SEQ....................................................................................................... 85 21 COUNT THREE: INVASION OF PRIVACY ................................................................ 86 COUNT FOUR: INTRUSION UPON SECLUSION...................................................... 89 22 COUNT FIVE: BREACH OF CONTRACT ................................................................... 90 COUNT SIX: CALIFORNIA UNFAIR COMPETITION LAW (“UCL”), CAL. 23 BUS. & PROF. CODE § 17200 ET SEQ. ............................................................ 91 COUNT SEVEN: UNJUST ENRICHMENT .................................................................. 92 24 PRAYER FOR RELIEF .............................................................................................................. 93 JURY TRIAL DEMAND ............................................................................................................ 93 25 26 ` 27 28 2 1 COMPLAINT 2 Plaintiffs file this Complaint against defendant Google LLC (“Google” or “Defendant”), 3 and in support state the following. 4 INTRODUCTION 5 1. This lawsuit concerns Google’s surreptitious interception and unlawful collection of 6 Plaintiffs’ personal and sensitive data while Plaintiffs were in “Incognito” mode in Google’s 7 Chrome browser, which was supposed to permit them to browse privately. 8 2. Google has represented to Google account holders, including Plaintiffs, that they are 9 “in control of what information [they] share with Google,” meaning that they have the power to 10 limit what data Google tracks, collects, and shares with third parties. Google has represented that 11 one way for users to exercise this “control” is by setting their web-browsing software (used to 12 connect to websites) to “private browsing mode”—including Incognito mode in Google’s Chrome 13 browser (“Incognito”), which Google launched in 2008. 14 3. Based on Google’s representations, Plaintiffs reasonably believed that their data 15 would not be collected, stored, or used by Google and that Google would not intercept their 16 communications when they were in “private browsing mode.” This included Plaintiffs’ Incognito 17 mode visits to non-Google websites without being signed into any Google account. 18 4. Google’s representations were and continue to be false. Google unlawfully 19 intercepted Plaintiffs’ private browsing communications to collect their personal and sensitive 20 information, without disclosure or consent, including when they in Incognito mode visited non- 21 Google websites without being signed into any Google Account. 22 5. Google has intercepted and collected Plaintiffs’ private browsing data by causing 23 their web browsing software to run Google software scripts (bits of code) that replicate and send 24 the data to Google servers in California. These Google software “scripts” do this even if the user 25 is in Incognito mode visiting non-Google websites. These Google software scripts give no notice 26 to the user of Google’s data collection methods, and operate without any choice or consent by users. 27 6. These same Google practices have been extensively litigated in a class action lawsuit 28 filed in federal court in June 2020, where the federal court denied Google’s motions to dismiss and 3 1 for summary judgment and also granted Rule 23(b)(2) certification for two nationwide classes 2 seeking injunctive relief. Brown v. Google LLC, No. 4:20-cv-03664-YGR-SVK (“Brown” or the 3 “Brown Lawsuit”), Dkts. 53, 82, 87, 89, 92, 113. Google previously represented and led users (and 4 regulators) to believe—falsely—that users could limit Google’s data collection practices by setting 5 their Chrome browser to Incognito mode. 6 7. Admissions by Google employees found in many internal Google documents have 7 become publicly available through the Brown Lawsuit, including for example: 8 • A 2014 Google email recommending changes to Incognito so “we don’t deceive users.” 9 • A Google email describing Incognito as “bad for users, bad for human rights, bad for 10 democracy.” 11 • A 2015 Google internal presentation regarding Incognito “misconceptions” noting 12 “concern about Google collecting data in Incognito.” 13 • A 2015 Google email describing Incognito as “radioactive” and “a lie.” 14 • A 2016 Google email discussing Incognito and how “nothing will be more scannable 15 than the name and icon, both of which are a poor fit for what the feature actually 16 provides.” 17 • A 2018 Google internal document titled “Five ways people misunderstand Incognito and 18 private browsing” noting “common misconceptions” that could give a “false impression 19 of privacy.” 20 • A 2018 Google internal presentation titled “The Incognito Problem” noting Google 21 branding and disclosures “confuse people” with Google “over-promising and under- 22 delivering.” 23 • A 2018 Google email discussing how the words “Incognito” and “private” reinforce the 24 “misperception that your browsing is private everywhere instead of just on your device.” 25 • A 2018 Google email stating “the blame for people’s misconceptions about Incognito 26 Mode is due to that name and branding” as “argued repeatedly.” 27 • A 2019 Google internal document regarding Incognito stating “most users do not 28 correctly understand the current messaging” and the need to clarify whether users are 4 1 “protected from Google.” 2 • A 2019 Google internal document for CEO Sundar Pichai instructing him to not use the 3 word “private” to describe Incognito due to “known misconceptions.” 4 • A 2019 Google internal presentation noting Incognito “[u]sers currently believe that none 5 of their data is collected and they are essential[ly] [sic] anonymous.” 6 • A 2020 Google internal presentation noting private browsing users “do not understand 7 how private mode works” with “several common misconceptions” including that it “hides 8 browsing activity from Google.” 9 • A 2020 Google internal document discussing Incognito and noting “[i]t’s not private in 10 ways that many users want, that is, as to Google” and “you don’t have the ability to see 11 or delete” data, “Google has it.” 12 • A 2021 Google internal presentation noting Incognito “[u]sers overestimate the 13 protections that Incognito provides and are unaware of the personalization and data 14 collection that occurs.” 15 • A 2021 email to Google CEO Sundar Pichai admitting Incognito is “not truly private.” 16 8. Google accomplishes its surreptitious interception and data collection through means 17 that include (without limitation) Google Analytics, Google “fingerprinting” techniques, concurrent 18 Google applications and processes on a consumer’s device, and Google’s Ad Manager. More than 19 70% of all online publishers (websites) use one or more of these Google services. When a user’s 20 web-browsing software accesses one of those non-Google websites, hidden Google software 21 “scripts” cause the user’s device to send detailed, personal information to Google’s servers, including 22 the private browsing communications between the user and the website. This includes the contents 23 of the webpage being requested and the URL viewed, by Plaintiffs, in Incognito mode. 24 9. Google’s practices violate the law, infringe upon users’ privacy, and give Google 25 and its employees power to learn intimate details about individuals’ lives, interests, and internet 26 usage. This makes Google “one stop shopping” for any private, government, or criminal actor who 27 wants to undermine individuals’ privacy, security, and freedom. 28 10. Through its pervasive data tracking business, Google knows who your friends are, 5 1 what your hobbies are, what you like to eat, what movies you watch, where and when you like to 2 shop, what your favorite vacation destinations are, what your favorite color is and even the most 3 intimate and potentially embarrassing things you browse on the internet—regardless of whether you 4 follow Google’s advice to keep your activities “private.” Notwithstanding consumers’ best efforts, 5 to keep their activities on the internet private, Google has made itself an unaccountable trove of 6 information so detailed and expansive that George Orwell could never have dreamed it. 7 11. Plaintiffs are individuals who are all within the scope of the certified nationwide 8 classes in the Brown Lawsuit who have now decided to separately seek monetary relief from Google 9 based on Google’s unlawful acts. Plaintiffs assert claims that already proceeded past motions to 10 dismiss and summary judgment in the Brown Lawsuit, where the federal court certified two 11 nationwide classes under Rule 23(b)(2) to pursue these claims for purposes of obtaining injunctive 12 relief. Plaintiffs now each seek monetary relief from Google, including statutory damages. Google 13 has taken the position that any request for monetary relief involves certain individualized issues and 14 should be tried separately. 15 THE PARTIES 16 12. Plaintiffs are Google account holders whose internet use was tracked by Google while 17 browsing the internet from the Chrome browser in Incognito mode. Plaintiffs assert claims arising 18 from Google’s knowing and unauthorized interception and tracking of their internet communications 19 and activity and knowing and unauthorized invasion of consumer privacy. 20 13. Plaintiff Gilberto Flores Jr (“Flores”) is an adult domiciled in Eagle Pass, TX, who 21 has an active Google account and during the relevant period used Incognito mode to visit non- 22 Google websites without being signed in to any Google account. 23 14. Plaintiff Kendra Willis (“Willis”) is an adult domiciled in Redwood City, CA, who 24 has an active Google account and during the relevant period used Incognito mode to visit non- 25 Google websites without being signed in to any Google account. 26 15. Plaintiff Thomas Erb (“Erb”) is an adult domiciled in Knoxville, TN, who has an 27 active Google account and during the relevant period used Incognito mode to visit non-Google 28 websites without being signed in to any Google account. 6 1 16. Plaintiff Danielle Soucie (“Soucie”) is an adult domiciled in Davenport, IA, who has 2 an active Google account and during the relevant period used Incognito mode to visit non-Google 3 websites without being signed in to any Google account. 4 17. Plaintiff Aleksandar Aleksandrov (“Aleksandrov”) is an adult domiciled in Las 5 Vegas, NV, who has an active Google account and during the relevant period used Incognito mode 6 to visit non-Google websites without being signed in to any Google account. 7 18. Plaintiff Michael Sattler (“Sattler”) is an adult domiciled in Tallahassee, FL, who 8 has an active Google account and during the relevant period used Incognito mode to visit non- 9 Google websites without being signed in to any Google account. 10 19. Plaintiff Kevin Cooper (“Cooper”) is an adult domiciled in Marshfield, WI, who has 11 an active Google account and during the relevant period used Incognito mode to visit non-Google 12 websites without being signed in to any Google account. 13 20. Plaintiff Daniel Blitch (“Blitch”) is an adult domiciled in Burbank, CA, who has an 14 active Google account and during the relevant period used Incognito mode to visit non-Google 15 websites without being signed in to any Google account. 16 21. Plaintiff Marissa Hearn (“Hearn”) is an adult domiciled in Oak Ridge, TN, who has 17 an active Google account and during the relevant period used Incognito mode to visit non-Google 18 websites without being signed in to any Google account. 19 22. Plaintiff Juan Tapia (“Tapia”) is an adult domiciled in Round Lake Beach, IL, who 20 has an active Google account and during the relevant period used Incognito mode to visit non- 21 Google websites without being signed in to any Google account. 22 23. Plaintiff Nadine Pactol (“Pactol”) is an adult domiciled in Hilo, HI, who has an active 23 Google account and during the relevant period used Incognito mode to visit non-Google websites 24 without being signed in to any Google account. 25 24. Plaintiff Christina Mcculloch (“Mcculloch”) is an adult domiciled in Troy, OH, who 26 has an active Google account and during the relevant period used Incognito mode to visit non- 27 Google websites without being signed in to any Google account. 28 25. Plaintiff Ryan Threadgill (“Threadgill”) is an adult domiciled in Memphis, TN, who 7 1 has an active Google account and during the relevant period used Incognito mode to visit non- 2 Google websites without being signed in to any Google account. 3 26. Plaintiff Joshua Wilson (“Wilson”) is an adult domiciled in Miami, FL, who has an 4 active Google account and during the relevant period used Incognito mode to visit non-Google 5 websites without being signed in to any Google account. 6 27. Plaintiff David Gordon (“Gordon”) is an adult domiciled in University Place, WA, 7 who has an active Google account and during the relevant period used Incognito mode to visit non- 8 Google websites without being signed in to any Google account. 9 28. Plaintiff Zachary Umek (“Umek”) is an adult domiciled in Hillsboro, IL, who has an 10 active Google account and during the relevant period used Incognito mode to visit non-Google 11 websites without being signed in to any Google account. 12 29. Plaintiff Adrian Fielding (“Fielding”) is an adult domiciled in Cartersville, GA, who 13 has an active Google account and during the relevant period used Incognito mode to visit non- 14 Google websites without being signed in to any Google account. 15 30. Plaintiff Susan Olsen (“Olsen”) is an adult domiciled in Tampa, FL, who has an 16 active Google account and during the relevant period used Incognito mode to visit non-Google 17 websites without being signed in to any Google account. 18 31. Plaintiff Robert Everhart (“Everhart”) is an adult domiciled in Santa Barbara, CA, 19 who has an active Google account and during the relevant period used Incognito mode to visit non- 20 Google websites without being signed in to any Google account. 21 32. Plaintiff Sidney Ray (“Ray”) is an adult domiciled in Canton, MS, who has an active 22 Google account and during the relevant period used Incognito mode to visit non-Google websites 23 without being signed in to any Google account. 24 33. Plaintiff Roger Du Pont (“Du Pont”) is an adult domiciled in New York, NY, who 25 has an active Google account and during the relevant period used Incognito mode to visit non- 26 Google websites without being signed in to any Google account. 27 34. Plaintiff William Eggers (“Eggers”) is an adult domiciled in Cupertino, CA, who has 28 an active Google account and during the relevant period used Incognito mode to visit non-Google 8 1 websites without being signed in to any Google account. 2 35. Plaintiff Juan Trujillo (“Trujillo”) is an adult domiciled in Roswell, NM, who has an 3 active Google account and during the relevant period used Incognito mode to visit non-Google 4 websites without being signed in to any Google account. 5 36. Plaintiff Anudt Suthigoseeya (“Suthigoseeya”) is an adult domiciled in Chicago, IL, 6 who has an active Google account and during the relevant period used Incognito mode to visit non- 7 Google websites without being signed in to any Google account. 8 37. Plaintiff Eddie Weathers (“Weathers”) is an adult domiciled in Hinesville, GA, who 9 has an active Google account and during the relevant period used Incognito mode to visit non- 10 Google websites without being signed in to any Google account. 11 38. Plaintiff David Stevenson (“Stevenson”) is an adult domiciled in Queens, NY, who 12 has an active Google account and during the relevant period used Incognito mode to visit non- 13 Google websites without being signed in to any Google account. 14 39. Plaintiff Jonathan Hampton (“Hampton”) is an adult domiciled in Minneapolis, MN, 15 who has an active Google account and during the relevant period used Incognito mode to visit non- 16 Google websites without being signed in to any Google account. 17 40. Plaintiff Antonino Dilorenzo (“Dilorenzo”) is an adult domiciled in Queens, NY, 18 who has an active Google account and during the relevant period used Incognito mode to visit non- 19 Google websites without being signed in to any Google account. 20 41. Plaintiff Linda Wagner (“Wagner”) is an adult domiciled in Opp, AL, who has an 21 active Google account and during the relevant period used Incognito mode to visit non-Google 22 websites without being signed in to any Google account. 23 42. Plaintiff Jennifer Roberts (“Roberts”) is an adult domiciled in Greenbrier, TN, who 24 has an active Google account and during the relevant period used Incognito mode to visit non- 25 Google websites without being signed in to any Google account. 26 43. Plaintiff Robert Browne (“Browne”) is an adult domiciled in San Juan Capistrano, 27 CA, who has an active Google account and during the relevant period used Incognito mode to visit 28 non-Google websites without being signed in to any Google account. 9 1 44. Plaintiff Andrew Randolph (“Randolph”) is an adult domiciled in Phoenixville, PA, 2 who has an active Google account and during the relevant period used Incognito mode to visit non- 3 Google websites without being signed in to any Google account. 4 45. Plaintiff Joseph Weiss (“Weiss”) is an adult domiciled in Lake Forest, IL, who has 5 an active Google account and during the relevant period used Incognito mode to visit non-Google 6 websites without being signed in to any Google account. 7 46. Plaintiff Alaina Cain (“Cain”) is an adult domiciled in Akron, OH, who has an active 8 Google account and during the relevant period used Incognito mode to visit non-Google websites 9 without being signed in to any Google account. 10 47. Plaintiff Steven Segal (“Segal”) is an adult domiciled in Carson City, NV, who has 11 an active Google account and during the relevant period used Incognito mode to visit non-Google 12 websites without being signed in to any Google account. 13 48. Plaintiff Viswa Muppirala (“Muppirala”) is an adult domiciled in Seattle, WA, who 14 has an active Google account and during the relevant period used Incognito mode to visit non- 15 Google websites without being signed in to any Google account. 16 49. Plaintiff Beau Block (“Block”) is an adult domiciled in Rushford, MN, who has an 17 active Google account and during the relevant period used Incognito mode to visit non-Google 18 websites without being signed in to any Google account. 19 50. Plaintiff Ken Reid (“Reid”) is an adult domiciled in Indianapolis, IN, who has an 20 active Google account and during the relevant period used Incognito mode to visit non-Google 21 websites without being signed in to any Google account. 22 51. Plaintiff Octavius Davis (“Davis”) is an adult domiciled in Middleburg, FL, who has 23 an active Google account and during the relevant period used Incognito mode to visit non-Google 24 websites without being signed in to any Google account. 25 52. Plaintiff Josh Weatherford (“Weatherford”) is an adult domiciled in Butler, GA, who 26 has an active Google account and during the relevant period used Incognito mode to visit non- 27 Google websites without being signed in to any Google account. 28 53. Plaintiff Jaime Crivello (“Crivello”) is an adult domiciled in Sebring, FL, who has 10 1 an active Google account and during the relevant period used Incognito mode to visit non-Google 2 websites without being signed in to any Google account. 3 54. Plaintiff Daniel Bressler (“Bressler”) is an adult domiciled in Eugene, OR, who has 4 an active Google account and during the relevant period used Incognito mode to visit non-Google 5 websites without being signed in to any Google account. 6 55. Plaintiff Bailey Harper (“Harper”) is an adult domiciled in Bay Village, OH, who 7 has an active Google account and during the relevant period used Incognito mode to visit non- 8 Google websites without being signed in to any Google account. 9 56. Plaintiff Damien Hall (“Hall”) is an adult domiciled in New Port Richey, FL, who 10 has an active Google account and during the relevant period used Incognito mode to visit non- 11 Google websites without being signed in to any Google account. 12 57. Plaintiff Ron Ingram (“Ingram”) is an adult domiciled in Las Vegas, NV, who has 13 an active Google account and during the relevant period used Incognito mode to visit non-Google 14 websites without being signed in to any Google account. 15 58. Plaintiff Deena Ellis (“Ellis”) is an adult domiciled in Deland, FL, who has an active 16 Google account and during the relevant period used Incognito mode to visit non-Google websites 17 without being signed in to any Google account. 18 59. Plaintiff Lee Lawson (“Lawson”) is an adult domiciled in Mayo, FL, who has an 19 active Google account and during the relevant period used Incognito mode to visit non-Google 20 websites without being signed in to any Google account. 21 60. Plaintiff Michael Smith (“Smith”) is an adult domiciled in Brooksville, FL, who has 22 an active Google account and during the relevant period used Incognito mode to visit non-Google 23 websites without being signed in to any Google account. 24 61. Plaintiff Kamlesh Makwana (“Makwana”) is an adult domiciled in Los Angeles, CA, 25 who has an active Google account and during the relevant period used Incognito mode to visit non- 26 Google websites without being signed in to any Google account. 27 62. Plaintiff Jose Ramirez (“Ramirez”) is an adult domiciled in San Diego, CA, who has 28 an active Google account and during the relevant period used Incognito mode to visit non-Google 11 1 websites without being signed in to any Google account. 2 63. Defendant Google is a Delaware limited liability company with a principal place of 3 business at what is officially known as The Googleplex, 1600 Amphitheatre Parkway, Mountain 4 View, California 94043. Google regularly conducts business throughout California and in this 5 judicial district. Google is one of the largest technology companies in the world and conducts 6 product development, search, and advertising operations in this district. 7 JURISDICTION AND VENUE 8 64. This Court has jurisdiction because Google’s principal place of business is in 9 California, Google maintains its headquarters in Santa Clara County, California, and a substantial 10 part of the events and conduct giving rise to Plaintiffs’ claims occurred in this State, including 11 Google’s development of the at-issue technology and receiving, accessing, and using the intercepted 12 communications and data at issue in California. 13 65. This Court is a proper venue for this action. Google is headquartered in and engaged 14 in the unlawful conduct from this County, and the contract between Plaintiffs and Google includes a 15 venue selection clause for Santa Clara County. Google’s Terms of Service state “all disputes arising 16 out of or relating to these terms, service specific additional terms, or any related services, regardless of 17 conflict of laws rules ... will be resolved exclusively in the federal or state courts of Santa Clara County, 18 California, USA, and you and Google consent to personal jurisdiction in those courts.” Venue is 19 therefore proper here in Santa Clara County. 20 FACTUAL ALLEGATIONS REGARDING GOOGLE 21 I. Google’s History of Privacy Violations & Its Agreement with the FTC 22 66. Google’s violation of consumers’ privacy rights is not new—it has been persistent 23 and pervasive for at least a decade. 24 67. In 2010, the FTC charged that Google “used deceptive tactics and violated its own 25 privacy promises to consumers when it launched its social network, Google Buzz.” To settle the 26 matter, the FTC barred Google “from future privacy misrepresentations” and required Google “to 27 28 12 1 implement a comprehensive privacy program.”1 2 68. In 2011, Google entered into a consent decree with the FTC (the “Consent Decree”), 3 effective for 20 years, in which the FTC required and Google agreed as follows (emphasis added): 4 IT IS ORDERED that [Google], in or affecting commerce, shall not misrepresent in any manner, expressly or by implication: 5 A. the extent to which [Google] maintains and protects the privacy and 6 confidentiality of any covered information, including, but not limited to, misrepresentations related to: (1) the purposes for which it collects and uses 7 covered information, and (2) the extent to which consumers may exercise control over the collection, use, or disclosure of covered information.2 8 9 69. This requirement applies to the Google conduct at issue in this lawsuit, as the 10 Consent Decree broadly defines “covered information” to include information Google “collects 11 from or about an individual” including a “persistent identifier, such as IP address,” and 12 combinations of additional data with the same. 13 70. Just one year after the Consent Decree was entered, the FTC found that Google had 14 already violated the Consent Decree, by way of Google’s misrepresentations regarding what 15 consumer data it would and would not collect with the Safari web browser. In an August 2012 16 press release, the FTC explained: 17 Google Inc. has agreed to pay a record $22.5 million civil penalty to settle Federal Trade Commission charges that it misrepresented to users of 18 Apple Inc.’s Safari Internet browser that it would not place tracking “cookies” or serve targeted ads to those users, violating an earlier privacy 19 settlement between the company and the FTC. 20 The settlement is part of the FTC’s ongoing efforts to make sure companies live up to the privacy promises they make to consumers and is 21 the largest penalty the agency has ever obtained for a violation of a Commission order. In addition to the civil penalty, the order also requires 22 Google to disable all the tracking cookies it had said it would not place on consumers’ computers. 23 “The record setting penalty in this matter sends a clear message to all 24 companies under an FTC privacy order,” said Jon Leibowitz, Chairman of 25 26 1 .https://www.ftc.gov/news-events/press-releases/2011/03/ftc-charges-deceptive-privacy- practices-googles-rollout-its-buzz. 27 2 28 https://www.ftc.gov/sites/default/files/documents/cases/2011/03/110330googlebuzzagreeorder.p df. 13 the FTC. “No matter how big or small, all companies must abide by FTC 1 orders against them and keep their privacy promises to consumers, or they will end up paying many times what it would have cost to comply in the 2 first place.”3 3 71. Since 2012, a number of federal, state, and international regulators have similarly 4 accused Google of violating its promises to consumers on what data it would and would not collect, 5 with Google failing to obtain consent for its conduct. 6 72. In September 2016, when Google updated its browser app for Apple iOS, Google 7 wrote that users would have “[m]ore control with incognito mode” and “Your searches are your 8 business. That’s why we’ve added the ability to search privately with incognito mode in the 9 Google app for iOS. When you have incognito mode turned on in your settings, your search and 10 browsing history will not be saved.”4 Google made no statements about how users’ privacy would 11 actually be limited in these private browsing sessions and avoided for years what it now claims (as 12 a result of this litigation shining the light on its practices): that users never had the privacy they 13 were promised. 14 73. Similarly, in May 2018, Google modified its privacy policy to state, “[y]ou can use 15 our services in a variety of ways to manage your privacy. . . . You can also choose to browse the 16 web privately using Chrome in Incognito mode.”5 17 74. Nonetheless, in 2019, Google and YouTube agreed to pay $170 million to settle 18 allegations by the Federal Trade Commission and the New York Attorney General that YouTube 19 video sharing services illegally collected personal information from children without their parents’ 20 consent. 21 75. Then, in June 2020, France’s Highest Administrative Court upheld a 50 million 22 Euro fine against Google based on its failure to provide clear notice and obtain users’ valid consent 23 to process their personal data for ad personalization purposes. 24 25 26 3 https://www.ftc.gov/news-events/press-releases/2012/08/google-will-pay-225-million-settle- ftc-charges-it-misrepresented. 27 4 https://www.googblogs.com/the-latest-updates-and-improvements-for-the-google-app-for-ios/. 28 See also, https://search.googleblog.com/index.html. 5 https://policies.google.com/privacy/archive/20171218-20180525?hl=en-US. 14 1 76. There have been myriad proceedings by the State Attorneys General and the 2 Australian Competition and Consumer Commission alleging Google’s failure to obtain consent 3 regarding its collection of location data and its decision to combine certain user data. 4 77. For example, In the Arizona Attorney General action, Google has produced 5 documents establishing “overwhelming” evidence that “Google has known that the user 6 experience they designed misleads and deceives users.” 7 78. And in an Australia proceeding, the Australian Competition & Consumer 8 Commission (“ACCC”) alleged that “Google misled Australian consumers to obtain their consent 9 to expand the scope of personal information that Google could collect and combine about 10 consumers’ internet activity, for use by Google, including for targeted advertising.”6 The ACCC 11 contended that Google “misled Australian consumers about what it planned to do with large 12 amounts of their personal information, including internet activity on websites not connected to 13 Google.”7 14 79. Google’s employees made numerous admissions in internal communications, 15 recognizing that Google’s privacy disclosures are a “mess” with regards to obtaining “consent” 16 for its data collection practices and other issues relevant in this lawsuit. Those documents are 17 heavily redacted by Google, and include for example the following comments and questions by 18 Google employees: 19 a. “Do users with significant privacy concerns understand what data we are 20 saving?” 21 b. “[T]ake a look at [redacted by Google] – work in progress, trying to rein 22 in the overall mess that we have with regards to data collection, consent, 23 and storage.” 24 c. “[A] bunch of other stuff that’s super messy. And it’s a Critical User 25 26 6 https://www.accc.gov.au/media-release/correction-accc-alleges-google-misled-consumers- about-expanded-use-of-personal- 27 data#:~:text=The%20ACCC%20has%20launched%20Federal,Google%2C%20including%20for 28 %20targeted%20advertising. 7 Id. 15 1 Journey to make sense out of this mess.” 2 80. Those internal documents are not limited to location data, and unredacted versions 3 of those documents and other internal Google documents will further demonstrate and confirm the 4 lack of consent for the Google conduct at issue in this lawsuit. 5 II. Google’s Privacy Policy, Privacy “Controls,” and “Incognito Screen” Each Falsely State that Users Can Prevent Google’s Collection By Using “Private Browsing 6 Mode” (Including Incognito Mode) 7 81. The public, legislators, and courts have become increasingly aware of online threats 8 to consumer privacy—including threats posed by powerful technology companies like Google that 9 have become household names. 10 82. To comply with the new laws like the California Consumer Privacy Act (the 11 “CCPA”) and Europe’s General Data Privacy Regulation (the “GDPR”) and to comply with the 12 Consent Decree, Google has repeatedly represented that users have control over what information 13 is shared with Google and that users can prevent Google from tracking their browsing history and 14 collecting their personal data online. 15 83. Plaintiffs had a reasonable expectation of privacy while they were using a private 16 browser mode. Specifically, Plaintiffs expected that, when they were using Incognito mode, 17 Google (a) would not collect the data as described in this Complaint, and (b) would not thereafter 18 use the data, collected during “private browsing mode,” for all of the purposes described below. 19 84. This expectation of privacy was reasonable because of Google’s own statements 20 regarding “private browsing modes” like Incognito mode as described below, including the 21 following: 22 • “You’re in control of what information you share with Google . . . .” 23 • “You can use our services in a variety of ways to manage your privacy . . . across 24 our services, you can adjust our privacy settings to control what we collect and 25 how your information is used.” 26 • “You can also choose to browse the web privately using Chrome in Incognito 27 mode.” 28 • “Your search and ad results may be customized using search-related activity even 16 1 if you’re signed out. To turn off this kind of search customization, you can search 2 and browse privately.” 3 • “To browse the web privately, you can use private browsing, sign out of your 4 account, change your custom results settings, or delete past activity.” 5 • “Your searches are your business. . . . When you have incognito mode turned on 6 in your settings, your search and browsing history will not be saved.” 7 Importantly, Google did not represent in any disclosure to Plaintiffs that it would continue to 8 intercept, track, and collect communications even when they used a browser while in Incognito 9 mode. 10 85. Google never notified Plaintiffs that Google would intercept, collect, store, or use 11 Plaintiffs’ communications while in Incognito mode. 12 A. Privacy Policy 13 86. In Google’s Privacy Policy (the “Privacy Policy”), Google made numerous 14 representations about how users can “control” the information users share with Google and how 15 users can browse the web anonymously and without their communications with websites being 16 intercepted. 17 87. Google’s Privacy Policy starts by stating in the Introduction section that “you can 18 adjust your privacy settings to control what we collect and how your information is used” and that 19 “[y]ou can choose to browse the web privately using Chrome in Incognito mode”: 20 21 22 23 88. The front and center of the “choices” offered to consumers is “Your privacy 24 controls” on the Privacy Policy. Here, Google reiterates, “[y]ou have choices regarding the 25 information we collect and how it’s used.” On the “My Activity” section of this part of the Privacy 26 Policy, Google reiterates that “My Activity allows you to review and control data that’s created 27 when you use Google services, like searches you’ve done. 28 17 1 2 3 4 5 6 7 89. In the Privacy Policy Google also promises that it will not reduce the protections it 8 guarantees to users without first obtaining their explicit consent to do so: 9 10 11 12 13 14 15 B. Privacy “Controls” 16 90. Users interested in controlling what Google collects are directed to the “Control 17 Panel” of this same Privacy Policy, where Google assures users that “[t]o browse the web privately, 18 you can use private browsing” and that “[i]f you want to search the web without saving your search 19 activity to your account, you can use private browsing mode in a browser (like Chrome or Safari).” 8 20 When users click on “Go to My Activity” to control their data, they are presented with the option 21 to “Learn more.” When users click on “Learn more,” they are taken to a page where they are 22 supposed to be able to “View & control activity in your account.” On that page, Google states that 23 you may “[s]top saving activity temporarily. . . . You can search and browse the web privately,” 24 embedding a hyperlink to the “Search & Browse Privately” page. 9 25 26 8 https://support.google.com/websearch/answer/4540094?. 27 9 See SEARCH & BROWSE PRIVATELY, 28 https://support.google.com/websearch/answer/4540094?hl=en&ref_topic =3036132. 18 1 91. On the “Search & Browse Privately” page, Google once again reiterates that the 2 user, not Google, is “in control of what information [a user] . . . share[s] with Google . . . .” Google 3 states simply that consumers enabling “private browsing mode” on their browsers will allow 4 consumers to “browse the web privately”: 5 6 7 8 9 10 11 12 13 14 15 16 17 There is nothing on this page about Google Analytics, Google Ad Manager, any other Google data 18 collection tool, or where and which websites online implement such data collection tools. 19 92. From the “View & control activity in your account” page referenced above, a 20 consumer can also click the link, “See & control your Web & App Activity” on the right-hand 21 side.10 On that page, Google again represents that searching and browsing in “private browsing 22 mode” will “turn off” any “search customization” “using search-related activity”: 23 24 25 26 27 10 28 SEE & CONTROL YOUR WEB & APP ACTIVITY, https://support.google.com/websearch/ answer/54068?visit_id=6372555086257257422105376128&hl=en&rd=1. 19 1 2 3 4 93. When users click the “Learn how” link, they are again redirected back to the 5 “Search & Browse Privately” page. In other words, because Google repeatedly touts that users 6 can “control” the information they share with Google and Google constantly refers users bac