Ninth Circuit Signals That a Reasonable User Cannot Consent to Data Collection Via Confusing and Contradictory Privacy Disclosures

Last week, the Ninth Circuit heard oral argument in Google v. Calhoun, a case about whether users really consented to Google’s collection and sharing of their personal data in light of contradictory statements made in Google’s published policies. In an amicus brief filed in the case, EPIC explained that consumers cannot be said to have consented to data practices that Google specifically promised not to engage in under its privacy policy—even though Google separately disclaimed liability in its general privacy disclosure. During oral argument, the judges signaled agreement with EPIC’s position.

The plaintiffs in the case sued Google because the company represented to Chrome users that it would not collect browsing history unless the users chose to sync that data to the cloud. In fact, Google did collect and transfer information about Chrome user’s browsing habits even if they did not choose to sync their data. Google argued in its defense that these users had nevertheless consented to the collection and transfer of their sensitive browsing data based on general disclosures in its user agreement.

The Ninth Circuit panel signaled agreement with the plaintiffs and EPIC, noting that the federal judge below was forced to hold an 8-hour evidentiary hearing to understand Google’s data collection practices and that no reasonable user can be held to that same standard. One judge also said that reading complicated terms of service online is like reading hieroglyphics.

EPIC’s brief also underscored the failed notice-and-choice system to obtain user “consent” for privacy invasive data practices. Privacy policies are too complicated, difficult to understand, and misleading for users to be adequately notified. And large data controllers have too much knowledge and power compared to the average internet user for the user to meaningfully choose to limit the collection and use of their personal information.

EPIC regularly advocates for strong data minimization rules to protect consumers from the failed notice and choice framework. EPIC also routinely highlights Google’s history of failing to uphold its privacy promises to consumers.