Google Privacy Policy Change Spawns Swath of New Lawsuits

Google implemented a new privacy policy on March 1, 2012. It is safe to say that Google's legal department has not had a rest since.

A barrage of class action lawsuits filed across the country are challenging the policy generally on one of three theories: (1) Google violated its own privacy policy and made deceptive claims regarding consolidation of user data across Google's products (e.g., Google search, Gmail, Google +, YouTube, etc.) in violation of various statutory and common laws; (2) Google inserted code, without disclosure, into its web content that deactivated security protections built into the Safari web browser; and (3) Google unlawfully intercepted information from Google + users in order to sell to third parties.

Within each of these three categories, most of the lawsuits are virtually identical, and the same Plaintiff's counsel is involved. The lawsuits mostly allege violations of the Federal Wiretap Act, 18 U.S.C. § 2511, the Stored Electronic Communications Act, 18 U.S.C. § 2701, the Computer Fraud Abuse Act, 18 U.S.C. § 1030, state consumer protection laws, and common law violations for intrusion upon seclusion, trespass to chattels, commercial misappropriation, and unjust enrichment. The lawsuits seek to represent classes of people who have had Google accounts or cell phones running Google's Android operating system. Last week, counsel began efforts to have the various groups of cases coordinated.

The most recently filed case – Anderson v. Google Inc., Case No. 12-cv-1565 (N.D. Cal., filed Mar. 29, 2012) – is illustrative of the typical allegations about the privacy policy, particularly for the first category of cases listed above. According to that complaint, prior to March 1, 2012, each of Google's separate products had its own privacy policy, and that policy precluded sharing of user information with other Google products absent user consent. The complaint alleges that the new privacy policy, however, permits consolidation of this information across all of Google's products. So, for example, if a user types "Chelsea restaurants" into Google search, under the new policy information can be pooled from that user's Gmail, Google Maps's usage, etc, to help determine whether the user is looking for restaurants in Manhattan or London. Plaintiff alleges that, despite Google's claim that the new policy will provide a more intuitive user experience, this violates a user's reasonable expectation of privacy when using one particular product. Plaintiff also alleges that the primary purpose for this new policy is to maximize advertising revenues.

Lawsuits aren't the only headache to Google's legal department. Regulatory bodies in the U.S. and abroad have scrutinized the new policy. In February 2012, 35 Attorneys General sent a letter to Google complaining about aspects of the policy. And just last week, Googleresponded formally to questions posed to it by France's National Commission for Data Protection (*insert link). Google has stood its ground, claiming that its new privacy policy is transparent, respects all applicable laws and principles, and will provide its users with a better experience.

© Arnold & Porter Kaye Scholer LLP 2012 All Rights Reserved. This blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.