Google has agreed to delete billions of data records collected from 136 million Chrome users in the United States, as part of a lawsuit settlement regarding alleged undisclosed browser data collection while in Incognito mode.
The case concerns a class-action lawsuit filed in June 2020 against Google, targeting the inadequate disclosure of data collection practices and lack of privacy controls in Chrome’s Incognito mode.
The plaintiffs accused Google of tracking users and logging their activity even when they were using Chrome’s Incognito mode, which they were made to believe was offering protection from such surveillance.
Google rejected the lawsuit’s merits and attempted to achieve dismissal of the case in August 2023, following extensive negotiation rounds and targeted motions, but these efforts proved unsuccessful.
A new court filing published yesterday revealed the settlement terms, which many view as a big win for privacy, especially when considering that the tech giant accepts to wipe user data it collected in previous years.
Key elements of the Settlement include changes to Google’s disclosures regarding its data collection practices, the deletion of billions of data records, implementing measures to curb the future accumulation of personal information, and eliminating mechanisms that enabled the tracking of users in Incognito mode without their knowledge.
Google also agreed to delete data older than nine months that was collected in December 2023 and earlier, with the process required to finish within 275 days of the Settlement’s approval.
“The Settlement also provides relief for Google’s past collection of private browsing data through data deletion and remediation. This portion of the Settlement relies on the framework developed by Special Master Douglas Brush,” reads the court filing.
“For every data source identified in the Special Master’s preservation order (Dkts. 524, 587-1) that could include private browsing data pre-dating the disclosure changes, Google must delete or remediate all entries that might contain users’ at-issue private browsing data.”
Any data collected after December is already subject to Google’s new and revised disclosures, which were rolled out after both parties signed the Term Sheet on December 22, 2023.
According to the plaintiffs, the changes imposed on Google due to the proposed Settlement have a conservatively estimated value of at least $4.75 billion.
In response to a request for comment by BleepingComputer on the course of the litigation, a Google spokesperson responded with the following statement.
We are pleased to settle this lawsuit, which we always believed was meritless. The plaintiffs originally wanted $5 billion and are receiving zero. We never associate data with users when they use Incognito mode. We are happy to delete old technical data that was never associated with an individual and was never used for any form of personalization. – Google spokesperson.
It should be noted that the Settlement preserves the right of class members to pursue individual damages claims.
Judge Yvonne Gonzalez Rogers of the U.S. District Court of the Northern District of California is scheduled to review the agreement on July 30, 2024, so the courts have not officially approved the Settlement.