Google still tracks app users when they unsubscribe, privacy lawsuit claims
Last month I reported how lawyers had filed a class action proposal seeking damages of at least $5bn (£4bn) against Google, alleging unlawful collection of information during Chrome browser incognito mode sessions.
Now, the same law firm, Boies Schiller Flexner, has filed another Google data privacy lawsuit seeking class action status. This time, Google is alleged to be tracking both users’ browsing activity and data across a wide variety of apps. This is happening, the class action complaint of which I have a copy of the claims, without the user’s knowledge or consent and “regardless of safeguards or ‘privacy settings’ that consumers agree to protect their private lives”.
Google’s “Web and App Activity” settings take center stage
The lawsuit, filed in the U.S. District Court for the Northern District of California, relates to the allegation of unlawful and intentional interception and collection of confidential data, even when the user followed Google’s recommendations to prevent this. This is a reference to the “Web & App Activity” settings.
The Google Search support page for web and app activity monitoring explains that if this option is enabled, searches and activity from “other Google services” are recorded by your Google account to provide “personalized experiences”, including faster searches and “more useful apps”. and content recommendations.”
This same support page says you can disable this feature and delete past activity, at any time, whether through your computer, Android device, or iPhone.
Firebase to blame, according to the complaint
However, the class action lawsuit accuses Google of violating federal wiretapping law as well as California’s invasion of privacy law. “Google is always watching,” the complaint states, “even when it promises to look away.” The accusation is that Google intercepts, tracks and collects data through the Firebase Cross-Platform Software Development Kit (SDK) which is actually a prerequisite for third-party Android apps that want to access Google Analytics and marketing on the Google Play Store. according to the trial.
Reuters reported earlier this year that a US anti-trust investigation was looking into concerns about Firebase usage. At the time, Google told Reuters that using Firebase tools was optional. Firebase also made headlines after misconfigurations leaked personal user data from over 4,000 Android apps.
Plaintiffs in the case, Anibal Rodriguez and Julieanna Muniz, claim that their use of mobile apps was tracked by Google after the ability to opt out of web and app activity tracking was introduced. The allegation being that “detailed browsing history data” was collected by Google, which was then monetized without the user’s consent. The 42-page complaint seeks a jury trial and class action status.
Jesse Panuccio, a partner at Boies Schiller Flexner and one of the attorneys who filed the lawsuit, said “Google promises privacy, but values voyeurism.” Referring to app activity data that is part of the central idea of this case, Panuccio says the lawsuit “aims to hold Google accountable under federal and California law for these privacy breaches.” .
Sean Wright, SMB Application Security Manager at ImmersiveLabs, says, “Privacy has become a hot topic, and many companies are jumping on it, which is great for users. , it’s when companies display a sense of privacy and usability That said, it’s also important for users to read details about the features they’re using to understand where companies may not be meeting all of the expectations that they’re using. they expect in terms of confidentiality.
Wright also says it’s important for developers using any library or SDK to understand the impact it may have on their product. “While they may intend to opt for a privacy-based solution,” he concludes, “the library or framework may get in the way.”
I contacted Google for a statement.
— Updated July 15 with comments from one of the attorneys who filed the complaint.