Destroying ‘digital gold’: Google has agreed to dispose of billions of data records as part of a settlement in a lawsuit alleging the company covertly monitored the internet activity of individuals who believed they were browsing privately. The search engine giant is often synonymised with the world’s biggest data mine due to the expanse of its user base, data-centric business model, and undisputed omnipresence. 

The terms of the settlement were submitted on Monday in the federal court of Oakland, California, and await approval from US District Judge Yvonne Gonzalez Rogers. Attorneys representing the plaintiffs estimated the settlement's worth to be over $5 billion, potentially reaching as high as $7.8 billion. Notably, Google is not liable for damages under this agreement, though individual users retain the right to pursue damages through separate legal actions.

The class-action lawsuit, initiated in 2020, encompasses millions of Google users who engaged in private browsing since June 1, 2016. Allegations against Google assert that its analytics, cookies, and applications enabled its subsidiary, Alphabet (GOOGL.O), to improperly track individuals who utilized Google Chrome's "Incognito" mode or equivalent settings in other browsers.

According to the plaintiffs, this activity transformed Google into an "unaccountable trove of information," enabling the company to glean insights into users' social circles, preferences, online activities, and potentially sensitive searches. As part of the settlement terms, Google has committed to improving disclosures regarding data collection during "private" browsing sessions, a process it has already initiated. Additionally, for a duration of five years, users in Incognito mode will have the option to block third-party cookies.

History of privacy breaches 

This is not the first time when Google has been criticised for unethical data practices. In September 2019, Google LLC and its subsidiary YouTube, paid a record $170 million to settle allegations by the Federal Trade Commission (FTC) and the New York Attorney General that YouTube illegally collected personal information from children without the consent of their parents.

In December 2022, France's data protection authority, CNIL, imposed a fine of nearly $57 million, on Google, accusing the company of breaching the European Union's General Data Protection Regulation (GDPR), specifically in its practices related to ad personalisation.

And more recently in, Alphabet Inc. has also tentatively agreed to a $350 million settlement to address accusations of concealing data-security flaws in the defunct Google+ social network. 

There has also been a complaint that alleges that Google has engaged in secretive data theft, claiming that the company has been unlawfully extracting and utilising everything ever created and shared on the internet by millions of Americans. 

Google’s response 

In response to the settlement, a spokesperson for Google, Jose Castaneda, expressed the company's satisfaction in resolving the lawsuit, which it consistently deemed without merit. Castaneda reiterated Google's position that it does not associate data with individual users during Incognito mode usage and stated the company's readiness to delete outdated technical data unrelated to personalization.

David Boies, legal representative for the plaintiffs, hailed the settlement as "a historic step" towards ensuring transparency and accountability from dominant technology firms. A preliminary agreement was reached in December, preventing a scheduled trial on February 5, 2024. Financial terms of the settlement reached in December were not disclosed at that time, though the plaintiffs' legal team intends to pursue unspecified legal fees from Google in the future.

Alphabet, Google's parent company, is headquartered in Mountain View, California. The case is recorded as Brown et al v Google LLC et al, in the U.S. District Court, Northern District of California, under case number 20-03664.