Ninth Circuit Revives Case Challenging Google’s Bait-and-Switch Data Practices

Yesterday the Ninth Circuit issued an opinion in Calhoun v. Google LLC reversing a lower court decision in favor of Google. The Court sent the case back to the district court to evaluate whether a “reasonable” user of the Google Chrome browser should be presumed to have consented to certain misleading and convoluted privacy policies. EPIC submitted an amicus brief in the case urging the court to hold that users who specifically opted out of syncing their information from Chrome with their Google accounts did not consent to the more invasive data practices disclosed in Google’s general privacy policy.

The plaintiffs in the case are Chrome users who declined to sync their Chrome browsers with their Google accounts. As a result, the plaintiffs were led to believe based on Google Chrome’s privacy notice that Google would not use or sync certain personal information collected while they browsed the internet. But personal data from these Chrome users was, in fact, transmitted to Google. Google alleged that plaintiffs agreed to this data collection by consenting to the far more permissive terms of Google’s general privacy policy. Despite the absurdity of assuming that Chrome users could understand how these inconsistent privacy policies were meant to fit together, the district court determined that the key question was whether the data collection at issue was “browser agnostic.” After holding a 7.5-hour evidentiary hearing on this topic, the court concluded that Chrome users had consented to Google’s data collection and granted summary judgment for Google.

In reversing summary judgment, the Ninth Circuit held that the district court failed to apply the correct standard because it did not conduct a proper “reasonable person” inquiry. Instead, the district court focused on a highly technical distinction—whether the data collection at issue was “browser agnostic”—to assess if a reasonable user would have understood that they were consenting to it. The Ninth Circuit explained that the issue of consent should not be determined by “attributing to that user the skill of an experienced business lawyer or someone who is able to easily ferret through a labyrinth of legal jargon to understand what he or she is consenting to.” Rather, the Ninth Circuit instructed the district court to consider a reasonable user with “a level of sophistication attributable to the general public.”

EPIC regularly files amicus briefs in consumer privacy cases and advocates for strong data minimization rules to protect consumers from the failed notice and choice framework. EPIC also routinely highlights Google’s history of failing to uphold its privacy promises to consumers.