Case Information
*1 1 U NITED S TATES D ISTRICT C OURT
2 N ORTHERN D ISTRICT OF C ALIFORNIA 3 P ATRICK C ALHOUN , ET AL . , Case No.: 4:20-CV-05146-YGR
4
O RDER D ENYING M OTION FOR C LASS C ERTIFICATION 5 Plaintiffs,
6 v. Re: Dkt. Nos. 1058, 1060, 1077, & 1081.
7 G OOGLE LLC , 8 Defendant.
9
In this action, plaintiffs are users of defendant Google LLC’s (“Google’s”) Chrome web 10 browser who allege that their privacy rights were violated when Google appropriated personally
11 identifiable information it had contractually promised to leave untouched. This is one of three 12 actions over which the Court is presiding regarding this genre of allegations. The specific claims at 13 issue here differ significantly from the other two. 14 Having carefully considered the papers submitted and the pleadings in this action, and for 15 the reasons set forth below, the Court hereby D ENIES the motion for class certification W ITHOUT L EAVE TO A MEND . 1 I. B ACKGROUND
A. Factual Background
This case arises from a set of promises Google made to users of its web browser Chrome. More specifically, Google promised it would not collect the personal information (“PI”) of any Chrome user who chose not to “sync” their Chrome browser with their Google account. (Dkt. No. 162-3, First Amended Complaint “FAC”, ¶ 1.) In particular, Google’s Chrome Privacy Notice 1 Plaintiffs seek leave to file additional documents in support of their motion for class certification in order that the Court may take judicial notice of them. (Dkt. No. 1058.) Because the Court finds the motion appropriate for resolution without consideration of the additional documents, the request is D ENIED . Additionally, plaintiffs move to strike the expert reports of two defense experts. (Dkt. Nos. 1077, 1081.) As stated on the record at argument, the Court views these requests as attempts to circumvent the Daubert process. There are no valid grounds to exclude these experts, and plaintiffs’ objections to their reports go to weight, not admissibility. Motions to strike under such circumstances tax judicial resources. The motions are D ENIED .
*2 (“CPN”) promised Chrome users they need not “provide any personal information to use Chrome” and that “the personal information that Chrome stores won’t be sent to Google unless [users] choose to store that data in [their] Google Account by turning on sync.” ( Id . ¶¶ 44-45 (quoting CPN).)
Multiple governing documents are relevant to the instant motion and plaintiffs categorize them thusly:
The Chrome Contract consists of four primary documents: from September 2018 to March 2020, it consisted of (1) the Chrome Terms of Service; (2) the Chrome Privacy Notice; and (3) the Google Privacy Policy. From March 2020 to present, the Chrome Contract consisted of (1) the Google Terms of Service; (2) the Chrome Privacy Notice; and (3) the Google Privacy Policy. For both periods, the Chrome Contract included express integration clauses. (Dkt. No. 1061-1, Motion for Class Certification (“Mtn.”) at 4.) Though different documents comprised the sum total of the contract between Google and plaintiffs, plaintiffs attest that “[t]hroughout the Class Period, the Chrome Contract promised that Chrome would not send personal information to Google unless a person chose to sync their Chrome data with their Google Account.” ( . at 5.) While the CPN contained the promises referenced above, Google disclosed information about data collection in other documents. The Court previously made three relevant findings: One, Google’s “General Privacy Policy discloses that Google collects the at-issue data when users visit websites that use Google services . . . [and] also discloses how Google uses the at-issue data.” Two, the “Consent Bump Agreement . . . disclosed that users generate data when they use Google’s services [and] that Google will use this information to make ads across the web more relevant.” Three, the New Account Agreement “disclosed the type of data that is collected when one uses a Google service” along with how it is used. (Dkt. No. 935, Order Granting Google’s Motion for Summary Judgment (“MSJ Order”) at 17-20 (internal cites omitted).)
Notwithstanding these other disclosures, plaintiffs allege that Google’s data collection
practices violated its agreement with Chrome users throughout the class period. Thus: “Using
Google source code, Chrome is designed to—and does—send class members’ PI to Google,
*3
whether a Chrome user has enabled Chrome’s Sync feature.” (Mtn. at 5 (internal cites omitted).)
The FAC identifies the relevant transmitted PI for Chrome users as unique, persistent cookie
identifiers; browsing history in the form of the contents of the users’ GET requests and POST
communications; IP addresses; User-Agent information about users’ devices; and x-client-data
identifiers. (FAC ¶ 141.) Plaintiffs allege Chrome users’ PI is valuable to Google, who uses it “to
create detailed dossiers about [an] individual’s personal information” for targeted advertising. (
Id
. ¶
258.) For purposes of this motion only, the Court accepts as true that Google collects the data
identified above when Chrome users are not synced.
See Calhoun v. Google, LLC
,
B. Procedural Background The Court granted Google’s summary judgment motion on consent grounds, finding that “the documents plaintiffs cite[d], viewed individually and holistically, [were] insufficient to establish a genuine material dispute as to whether plaintiffs consented to Google’s conduct.” (MSJ Order at 27.) This Court’s decision rested on a finding that Google collected the at-issue data regardless of which browser was in use, and therefore its collection and use was governed by the “browser-agnostic” general privacy policies, not the Chrome-specific CPN. ( See id . at 16 (“Because the Court finds that the at-issue data collected is not specific to Chrome but browser agnostic, the Court also finds that Google’s general policies apply.”).
On appeal, the Ninth Circuit reversed. The Court of Appeals held this Court “should have
reviewed the terms of the various disclosures and decided whether a reasonable user reading them
would think that he or she was consenting to the data collection.”
Calhoun
,
Following the remand order, plaintiffs now move to certify a class of All Google Accountholders who accepted Google’s U.S. Terms of Service prior to October 4, 2023 and who used the Chrome Browser in the (1) Basic Browser and/or (2) Signed In, But Not Consented for Sync modes from September 23, 2018 to the present. *4 (Mtn. at 1.) Plaintiffs move for certification under Rule 23(b)(3) and 23(b)(2) or, alternatively, an issue class under Rule 23(c)(4) “as to any claim for which the Court determines one or more issues are not appropriate for (b)(3) certification.” ( .)
II. L EGAL F RAMEWORK
A class action is “an exception to the usual rule that litigation is conducted by and on behalf
of the individual named parties only.”
Wal-Mart Stores, Inc. v. Dukes,
“Before certifying a class, the trial court must conduct a rigorous analysis to determine
whether the party seeking certification has met the prerequisites of Rule 23.”
Mazza v. Am. Honda
Motor Co., Inc.,
Rule 23 is satisfied when a party demonstrates meeting all four prerequisites of Rule 23(a) plus one of three factors in Rule 23(b). Specifically, Rule 23(a) requires a showing that: (1) the class is so numerous that joinder of all members is impracticable; (2) common questions of law or fact as to the class exist; (3) the claims or defenses of the representative parties are typical of those of the class; and (4) the representative parties will fairly and adequately protect the interests of the class. Fed. R. Civ. P. 23(a). Relevant here, certification under Rule 23(b)(3) is appropriate only if “the questions of law or fact common to class members predominate over any questions affecting only individual members” and “a class action is superior to other available methods for fairly and *5 efficiently adjudicating the controversy.” Fed. R. Civ. P. 23(b)(3). Rule 23(b)(2) permits certification of a class when “the party opposing the class has acted or refused to act on grounds that apply generally to the class, so that final injunctive relief or corresponding declaratory relief is appropriate respecting the class as a whole.”
Finally, “[w]hen appropriate, an action may be brought or maintained as a class action with
respect to particular issues.” Fed. R. Civ. P. 23(c)(4). Certification of an issue class is “appropriate”
only if it “materially advances the disposition of the litigation as a whole.”
Rahman v. Mott’s LLP
,
23(b)(3). “An individual question is one where ‘members of a proposed class will need to present
evidence that varies from member to member,’ while a common question is one where ‘the same
evidence will suffice for each member to make a prima facie showing [or] the issue is susceptible to
generalized, class-wide proof.’”
Tyson Foods, Inc. v. Bouaphakeo
,
Google challenges the damages class certification under 23(a)’s typicality prong and 23(b)’s predominance prong. Here, the Court finds the latter dispositive as to all four causes of action.
According to Google, the affirmative defense of implied consent defeats predominance in
this matter. In
Brown v. Google LLC
, this Court noted that the Ninth Circuit “instructs that a
defendant must present non-speculative evidence that an affirmative defense would require
individualized inquiries to defeat the predominance inquiry.”
We collect information about your activity in our services, which we use to do things like recommend a YouTube video you might like. The activity information we collect may include . . . Terms you search for[,] . . . Activity on third-party sites and apps that use our service[, and] Chrome browsing history you’ve synced with your Google Account.
(Dkt. No. 1074, Declaration of Gregory Fair In Support of Google’s Opposition to Plaintiffs’ Renewed Motion for Class Certification (“Fair Decl.”) ¶ 70.) Google notes it “keeps statistics on how many times its Privacy Policy and other disclosure pages are viewed and how much time users *7 spent on the page” and states the policy “was viewed more than 225 million times” between March 2018 and July 2020. ( Id . ¶ 75.)
Second, anyone with a Google account may have signed one or more “Account Holder Agreements” which disclosed its data collection practices. ( Id . ¶ 17.) By way of example, Google points to its “Consent Bump Agreement” which stated, for example:
When you use Google services like Search and YouTube, you generate data — things like what you’ve searched for and videos you’ve watched. You can find and control that data in My Account under the Web & App Activity setting. With this change, this setting may also include browsing data from Chrome and activity from sites and apps that partner with Google, including those that show ads from Google. (Dkt. No. 1074-19; Fair Decl., Ex. 18 at 13.) This particular agreement allowed readers to click through to a FAQ page further disclosing the collection of certain data. “As of October 31, 2016, holders of tens of millions of U.S. Accounts had seen the Consent Bump Agreement,” and “[a]pproximately 89% of those Accounts consented” to it.” (Fair Decl. ¶ 33.) Third, any user creating a Google account after June 2016 signed a New Account Creation Agreement. ( Id . ¶ 44.) This agreement disclosed the collection and subsequent use of certain user data, “including information like the video you watched, device IDs, IP address, cookie data, and location[,] … when [account holders] use apps or sites that use Google services like ads, Analytics, and the YouTube video player.” (Dkt. No. 1074-19; Fair Decl., Ex. 18 at 6.) At least four named plaintiffs, and users representing hundreds of millions of U.S. accounts, consented to this agreement. (Fair Decl. ¶¶ 57, 62.)
Fourth, Google’s help center contains several articles “direct[ing] users to their My Activity pages.” ( . ¶ 93.) These articles allow users to view what sorts of data Google collects and offers instructions on how to delete much of it. ( See id . ¶¶ 93-110.) 2
2 Google provides copies of these articles, titled: “How Google helps you manage data with My Activity,” “Delete Your Activity,” “View & control activity in your account,” “Find, control & delete the info in your Google Account,” “Control what activity gets saved to your account,” “Find & control your Web & App Activity,” “Clear browsing data,” and “Delete your Chrome browsing history.” ( See id ., Exs. 17, 102-06, 108-09; Dkt. Nos. 1074-18, 1074-107 – 1074-111, 1074-113- 1074-114.)
*8 Fifth, and finally, “Google’s agreements with websites that use its services require those websites to make certain disclosures” about data collection practices. ( . ¶ 113.) For example, websites using Google Analytics must
post a Privacy Policy and that Privacy Policy must provide notice of [the third-party websites’] use of cookies, identifiers for mobile devices (e.g., Android Advertising Identifier or Advertising Identifier for iOS) or similar technology used to collect data. [The websites] must disclose the use of Google Analytics, and how it collects and processes data.
(Fair Decl., Ex. 115; Dkt. No. 1074-122 at 5.) So, too, with websites using Google Ad Manager,
which requires “a privacy policy that clearly discloses any data collection, sharing and usage that
takes place on any site, app, email publication or other property as a consequence of [the] use of
Google products,” and “must disclose to users that third parties may be placing and reading cookies
on [their] browsers, or using web beacons to collect information as a result of ad serving.” (Fair
Decl., Ex. 117; Dkt. No. 1074-124 at 7.)
Google has met its burden of presenting concrete evidence sufficient to show individualized
inquiries as to each user’s subjective understanding of its data collection practices. The proposed
class contains millions of Chrome users, each of whom was exposed to, and may have explicitly or
implicitly consented to, varying disclosures potentially providing notice that their use of Chrome
meant their data would be collected. In this regard, this case is identical to this Court’s previous
adjudication in
Brown v. Google.
23 3 Plaintiffs take issue with Google’s focus on “data collection,” arguing that this mis-frames 24 the real inquiry, which asks whether the personal information of Chrome users was sent to Google in both synced and un-synced modes. (Dkt. No. 1080, Plaintiffs’ Reply In Support of Renewed 25
Motion for Class Certification (“Reply”) at 3.) To the extent the argument is intended to negate the 26 Court’s consideration of the panoply of sources of information Google provides, the Court disagrees. Implied consent asks about a user’s subjective understanding of the terms of the relevant 27 agreement; it is “an intensely factual question that requires consideration of the circumstances surrounding the alleged privacy violation” that takes into account “a broad set of materials.” In re 28
Google RTB Consumer Priv. Litig.
,
First, plaintiffs urge that implied consent is not a defense to the four causes of action. The
Court disagrees.
See Brown
,
the Court of Appeals’ decision so broadly. The Ninth Circuit found that “when the disclosures are
read together and in the light most favorable to Plaintiffs, a reasonable user would not
necessarily
understand that they were consenting to the data collection at issue.”
Calhoun
,
4 For this reason, plaintiffs’ citation to a quote from
RTB
stating that extrinsic evidence is
irrelevant is misplaced. (
See
Reply at 6.) In context, that quote spoke about the injunctive relief
inquiry under Rule 23(b)(2), and specifically contrasted that inquiry from the implied consent
analysis, where extrinsic evidence was deemed relevant.
See RTB
,
5 That material disputes of fact are questions for the jury is not the issue. ( See Reply at 1.) To satisfy Rule 23, a plaintiff must still show predominance. The Ninth Circuit recognized the *10 Third, plaintiffs raise certain arguments going to the reasonableness of any putative class member’s understanding that Google collected their PI. 6 These arguments require interpretation of the various sources of information proffered by Google, the precise sort of inquiry that is likely to overwhelm questions common to the class.
***
For the reasons enumerated above, the Court finds as it did in both Brown and RTB , namely inquiries relating to Google’s implied consent defense will overwhelm the damages claims for all causes of action. The motion to certify a Rule 23(b)(3) damages class is D ENIED WITH P REJUDICE . B. Rule 23(b)(2)
Unlike a damages class, a Rule 23(b)(2) class does not require
predominance or superiority.
Rule 23(b)(2) allows class treatment when the party opposing the class
has acted or refused to act on grounds that apply generally to the class,
so that final injunctive relief or corresponding declaratory relief is
appropriate respecting the class as a whole. . . . the focus is not on the
claims of the individual class members, but rather whether [defendant]
has engaged in a common policy.
Des Roches v. Cal. Physicians’ Serv.,
distinction.
Calhoun
,
6 For example, plaintiffs posit that here, the CPN made Chrome-specific promises and stated that document controlled over others, and thus it would be unreasonable for a user to impliedly consent based on other documents. ( See Reply at 6-7.) Even if a reasonable proposition, the Court cannot make that finding as a matter of law, and eliminate the evidence of all the other documents to the issue at hand.
*11
As a threshold matter, defendant asserts named plaintiffs are atypical and therefore cannot
satisfy Rule 23(a) because they did not actually read the CPN. Typicality is a “permissive” standard
and requires the claims of named class members be “reasonably co-extensive with those of absent
class members.”
Rodriguez v. Hayes
,
coupled with a sufficient likelihood that [they] will again be wronged in a similar way.”
Backhaut
v. Apple Inc.
,
Second, as to the non-contractual claims, plaintiffs argue their injuries are ongoing because
(i) Google continues to take PI without consent and (ii) the new disclosures are unintelligible. The
evidentiary record compels a different conclusion. Plaintiffs’ case rests on a theory of liability
grounded in the synced/not-synced distinction found in the CPN. Because the CPN no longer
exists, however, the alleged harm from lack of disclosure about this distinction cannot flow from
the surviving documents. (
Cf
, MSJ Order at 17 (finding that the Google Privacy Policy adequately
“discloses that Google collects the at-issue data when users visit websites that use Google
services.”);
see also Calhoun
,
Chrome browsing history, and the data that Google receives through the Google Services (i.e., the data at issue here), are different. Chrome browsing history does not include the disputed data—cookie identifiers; GET or POST requests; IP address and user-agent information; or X-Client-Data Headers. . . . Chrome browsing history consists of a list of all the webpages (URLs) visited within the last 90 days (unless the user has deleted her history within that window) and the time when they were visited. This includes visits to websites that do not use Google Services. Google does not receive Chrome browsing history from Chrome users who have not enabled Sync. (Fair Decl. ¶ 12.) From the evidentiary record before the Court, therefore, plaintiffs have failed to identify any surviving promise in Google’s various disclosures that evidence an ongoing promise to avoid collecting data that Google does, in fact, surreptitiously collect. As a result, injunctive relief is not warranted. Plaintiffs’ motion to certify an injunctive class under Rule 23(b)(2) is D ENIED . C. Rule 23(c)(4)
Plaintiffs’ final request is for certification of an issue class under Rule 23(c)(4). Predominance is not strictly a requirement in order to certify a Rule 23(c)(4) issue class, but a district court is within its discretion to refuse to certify one where "numerous individualized issues affect[] determinations of liability [and therefore] make Rule 23(c)(4) certification inefficient.” Reitman v. Champion Petfoods USA, Inc. , 830 F. App’x. 880, 882 (9th Cir. 2020). “Rule 23(c)(4) enables a district court to certify an issue class [w]hen appropriate, but a court does not abuse its discretion when it declines to do so because certifying a class does not materially advance[ ] the disposition of the litigation as a whole.” Id. (internal cites omitted).
*13
Plaintiffs argue that an issue class would materially advance the litigation from an
efficiency perspective because a
prima facie
case for liability can be established through classwide
proof. As other courts have found, issue class certification is ineffective in efficiently driving the
litigation where individualized issues impact the underlying liability determination.
See, e.g.
,
Reitman
, 830 Fed. App’x. at 882;
Backhaut
,
Though implied consent is an affirmative defense, it still means liability in this case ultimately turns on each class member’s subjective understanding of defendant’s promises.
The motion to certify an issue class under Rule 23(c)(4) is D ENIED .
IV. C ONCLUSION For the reasons stated above, plaintiffs’ motion for class certification is D ENIED W ITH P REJUDICE . Within twenty-one (21) days of the issuance of this Order, parties shall meet and confer and submit a joint scheduling proposal for the remainder of this action. The parties’ pending motions to seal will be addressed by separate court order. This terminates Dkt. Nos. 1058, 1060, 1077, & 1081. I T I S S O O RDERED . Date: _______________________________________ June 9, 2025 Y VONNE G ONZALEZ R OGERS U NITED S TATES D ISTRICT C OURT J UDGE