113 F.4th 1141
9th Cir.2024Background
- Plaintiffs are users of Google Chrome who did not activate the "sync" feature linking their browser activity with their Google accounts.
- Plaintiffs allege that, based on Chrome's Privacy Notice, they understood that not syncing would prevent Google from collecting certain personal data.
- Despite these representations, plaintiffs claim Google still collected personal information, such as cookies, browsing history, and IP addresses, even from non-synced users.
- The district court granted summary judgment to Google, holding that users had consented to the data collection through Google's broad privacy policies and other consent-related agreements.
- The appellate panel reviewed whether the district court used the correct legal standard to decide if plaintiffs genuinely consented to the data collection under the meaning of a "reasonable user."
- The Ninth Circuit reversed and remanded, finding disputed material facts as to user consent under the proper standard.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Did users consent to Google's data collection? | Users believed, per Chrome Privacy Notice, that non-syncing meant data would not be sent. | Consent was given through acceptance of Google's general Privacy Policy and related notices. | Court found factual disputes exist; correct standard is what a reasonable user would think. |
| Proper standard to determine consent | Standard is whether a reasonable user, reading all disclosures, would conclude consent. | Technical distinction: General policies apply when data collection is browser-agnostic. | Court: "Reasonable user" inquiry must guide, not technical browser-agnostic analysis. |
| Applicability of Chrome Privacy Notice or general policy | Chrome-specific disclosures govern Chrome user conduct, especially around syncing. | General policies govern, as the data collection is not specific to Chrome. | Court: Chrome-specific notice may bind Google if it contains contra promises; remand. |
| Effectiveness of disclosures in establishing consent | Disclosures did not unambiguously alert users to contested data collection. | Disclosures (Privacy Policy, Consent Bump, New Account) made practice clear and binding. | Court: Disclosures present factual disputes; reasonable user might not expect collection. |
Key Cases Cited
- In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589 (9th Cir. 2020) (reasonable user standard applies to disclosure of post-logout data collection)
- Pinnacle Museum Tower Ass’n v. Pinnacle Mkt. Dev. (US), LLC, 282 P.3d 1217 (Cal. 2012) (general contract law includes express or implied consent)
- Tsao v. Desert Palace, Inc., 698 F.3d 1128 (9th Cir. 2012) (effectiveness of consent hinges on specificity and scope)