• by Wendy Davis  @wendyndavis, May 3, 2024

A group of Google users who are suing the company over alleged privacy violations are now battling with it over a key issue in the case -- whether the company adequately disclosed how it collects analytics data.

The legal fight, which dates to 2000, focuses on Google Analytics for Firebase -- a tool that can collect data about smartphone users' app usage.

Anibal Rodriguez and other consumers alleged in a class-action complaint that Google “intentionally created an illusion of user control” through its “Web & App Activity” settings, which users must turn on if they want to save searches and activity in their Google account.

The complaint alleged that even when users don't activate the setting, Google uses its Firebase code “to collect users’ communications made via the apps on users’ devices.”

Shortly after the case was filed, Google asked U.S. District Court Judge Richard Seeborg to prevent the plaintiffs from moving forward, arguing that they consented to the alleged data transfers by accepting Google's privacy policies.

Seeborg refused to dismiss the matter on those grounds in May 2021, and allowed Rodriguez and the others to proceed with several privacy-related claims.

He wrote at the time that navigating Google's privacy statements “is a singularly fragmented affair.”

“The average internet user is not a full-stack engineer; he or she should not be treated as one when Google explains which digital data goes into which digital buckets, and where the corresponding spigots might be found,” he added.

Since then, Google and the plaintiffs exchanged evidence and questioned each others' witnesses.

In April, Google argued to Seeborg that the evidence developed since his May 2021 ruling shows that it accurately described its practices in the Web and App Activity setting, and that no reasonable smartphone user would have expected that the setting could “disable the entire data flow from the app to Google.”

“Nobody who uses mobile apps reasonably believes that they can grind the mobile ads ecosystem to a halt by flipping a single button (or any other way),” Google writes in a motion for summary judgment.

“Even when personalization of advertising is disabled, advertising can still be served in spaces where apps choose to sell advertising space. And the server of those apps will of course keep a log that the ad was served,” the company adds.

Google characterizes the data at issue as “non-personal,” and says the privacy policies disclosed that the company could use “non-personal information for basic record-keeping.”

On Thursday, lawyers for Rodriguez and the others countered that a jury should decide whether Google's privacy policies adequately disclosed its practices.

“A reasonable juror could readily agree with plaintiffs that Google represented that it would not collect or save app activity when [Web & App Activity] was off,” class counsel argued.

Counsel also argued that even if users consented to the collection of analytics data, the consent wouldn't have been “voluntary” because Firebase (and other related code) is embedded in most popular apps.

Seeborg is expected to hold a hearing in the case on July 25.