EPIC v. FTC (Enforcement of the Google Consent Order)

EPIC filed a lawsuit to compel the Federal Trade Commission to enforce the Google consent order and block Google’s proposed consolidation of user data. EPIC sought action prior to March 1, when Google implemented changes in its terms of service that allowed the company to combine user data without user consent. This change in business practice is in clear violation of the consent order that Google entered into on October 13, 2011. The Federal District Court of the District of Columbia heard the case before the March 1 deadline on an expedited schedule, and ultimately ruled that, because courts lack jurisdiction over agency enforcement actions, it was unable to compel the FTC to enforce the consent order. However, the court acknowledged “serious concerns” with Google’s changes.

Background

On February 9, 2010, Google attempted to launch Buzz, a social networking service linked to Gmail, Google’s email service. Google Buzz was an online service that compiled and made public a Gmail user’s social networking list based on address book and Gchat list contacts. In response, EPIC filed a complaint with the FTC, highlighting several aspects of the Google Buzz service that threatened Gmail users’ privacy. The complaint alleged that Google engaged in unfair and deceptive trade practices by transforming its email service into a social networking service without offering users meaningful control over their information or opt-in consent.

On October 13, 2011, having determined that Google did engage in unfair and deceptive trade practices, the FTC issued a consent order establishing new privacy safeguards for users of all Google products and services and subjecting the company to regular privacy audits. This order bars Google from misrepresenting the company’s privacy practices, requires the company to obtain users’ consent before disclosing personal data, and requires the company to develop and comply with a comprehensive privacy program.

On January 24, 2012, Google announced that it would change its terms of service for current users of more than 60 Google services, including Gmail, Google+, Youtube, and the Android mobile operating system. Rather than keeping personal information about a user of a given Google service separate from information gathered from other Google services, Google will consolidate user data from across its services and create a single merged profile for each user. The change will become effective on March 1, 2012.

On February 24, 2012, five privacy organizations, including EPIC, wrote to Rep. Bono-Mack to urge the Chairwoman of a powerful Congressional committee to hold a public hearing on Google’s proposed changes in business practices that will take effect March 1.

On February 28, 2012, the head of the French Data Protection Agency, on behalf of European privacy agencies, warned that Google’s proposed change violates European Union privacy law. She is reiterated the recommendation of Europe’s Justice Minister that Google suspend the change. In an interview with C-Span, the Chairman of the Federal Trade Commission said that users of Google services face a “brutal choice.”

EPIC’s Lawsuit

Procedural History

On February 8, 2012 in the D.C. District Court, EPIC filed a complaint and motion for a temporary restraining order and preliminary injunction compelling the FTC to enforce the Google consent order. On February 9, 2012, the court set an expedited briefing schedule in order to make a decision before Google’s March 1, 2012 change in business practices.

On February 17, 2012, the Federal Trade Commission filed an opposition and a motion to dismiss in response to EPIC’s complaint. The government stated that EPIC would “deprive the Commission of the discretion to exercise its enforcement authority.” The government also charged that EPIC’s lawsuit is “completely baseless.” On that same day, the Wall Street Journal reported that Google had subverted the privacy settings of millions of users of the Internet browser software Safari despite representations to the contrary.

In a reply brief filed in Washington, DC, on February 21, 2012, EPIC said that the Federal Trade Commission’s failure to enforce the Consent Order against Google prior to March 1 would cause “irreparable injury.” EPIC cited Google’s plans to combine user data without consent, and pointed to numerous cases that establish the need for the Court to assess the FTC’s failure to act. Dismissing arguments asserted by the government that “FTC enforcement decisions are not subject to judicial review,” EPIC said that Congress has clearly told the Federal Trade Commission to enforce its final orders. And in response to a claim that EPIC’s request for action by March 1 is “arbitrary,” EPIC wrote “If the government is unaware that Google plans to make a substantial change in its business practices on March 1, 2012, it should turn on a computer connected to the Internet.”

On February 24, 2012, a federal court dismissed EPIC’s lawsuit against the FTC because the “decision to enforce the Consent Order is committed to agency discretion and is not subject to judicial review.” However, the Judge also said, “the Court has not reached the question of whether the new policies would violate the consent order or if they would be contrary to any other legal requirements.” And she said “the FTC, which has advised the Court that the matter is under review, may ultimately decide to institute an enforcement action.” Within hours, EPIC filed an emergency appeal with the Court of Appeals for the DC Circuit, asking the appellate court to overturn the lower court decision before March 1, when Google will change its terms of service and consolidate user data without consent. On March 5, the D.C. Circuit Court affirmed the lower court’s ruling and dismissed EPIC’s complaint.

Legal Arguments

EPIC argues it is entitled to a temporary restraining order and preliminary injunction requiring the FTC to enforce its consent order with Google.

EPIC argues that Google’s proposed March 1, 2012 change in business practices is in clear violation of this consent order. Google violated Part I(a) of the Consent Order by misrepresenting the extent to which it maintains and protects the privacy and confidentiality of covered information. Google also violated Part I(b) of the Consent Order by misrepresenting the extent to which it complies with the U.S.-EU Safe Harbor Framework. Google violated Part II of the Consent Order by failing to obtain affirmative consent from users prior to sharing their information with third parties. Google violated Part III of the Consent Order by failing to comply with the requirements of a comprehensive privacy program.

EPIC argues that the FTC has violated section 706 of the Administrative Procedures Act by unlawfully withholding agency action on a required action. The FTC has a non-discretionary obligation to enforce a final order. But the agency has thus far failed to take any action regarding this matter, placing the privacy interests of Google users at grave risk. EPIC brings this suit to require the Commission to enforce the consent order.

Legal Documents

United States Court of Appeals for the District of Columbia

EPIC v. the Federal Trade Commission, Case No. 12-5054 (D.C. Cir. filed Feb. 24, 2012).

• EPIC’s Appeal

United States District Court for the District of Columbia

EPIC v. the Federal Trade Commission, Case No. 12-00206-JAB (D.D.C. filed Feb. 9, 2012).

• Court Ruling, EPIC v. FTC, No. 12-0206 (ABJ) (D.D.C. Feb. 24, 2012).
• EPIC’s Opposition to FTC’s Motion to Dismiss and Reply in Support of Motion for Temporary Restraining Order and Preliminary Inunction
• FTC Motion to Dismiss and Memorandum in Opposition to EPIC’s Motion
• Motion for Temporary Restraining Order and Preliminary Injunction
• EPIC’s Complaint for Injunctive Relief

Resources

Google’s Safari Tracking

• EPIC’s Letter to FTC Commissioner John Leibowitz on Google Safari Tracking, Feb. 17, 2012.
• Google’s iPhone Tracking, Julia Angwin & Jennifer Valentino-Devries, Wall St. J., Feb. 17, 2012.
• Safari Trackers, Jonathan Mayer, Web Policy, Feb. 17, 2012.

In re Google Buzz

• Ctr. for Digital Democracy’s FTC Complaint, In re Google Buzz, Request for Investigation and Imposition of Fines and Other Remedies for Violation of “Google Buzz” Consent Decree, No. C­4336, Feb. 22, 2012.
• Google Privacy Compliance Report, as required by In re Google Buzz
• FTC Consent Order, In re Google Buzz
• FTC – “FTC Charges Deceptive Privacy Practices in Google’s Rollout of Its Buzz Social Network.”
• Background: EPIC – In re Google Buzz