Source: https://www.docketalarm.com/cases/California_Northern_District_Court/5--20-cv-03664/Brown_et_al_v._Google_LLC_et_al/1/
Timestamp: 2020-08-08 09:50:08
Document Index: 553833310

Matched Legal Cases: ['§ 2510', '§ 631', '§ 2511', '§ 1331', '§ 1332', '§ 1367']

Brown et al v. Google LLC et al, 5:20-cv-03664, No. 1 (N.D.Cal. Jun. 2, 2020)
Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 1 of 37
`Mark C. Mao, CA Bar No. 236165
`Sean P. Rodriguez, CA Bar No. 262437
`Alexander J. Konik, CA Bar No. 299291
`BOIES SCHILLER FLEXNER LLP
`44 Montgomery St., 41st Floor
`Tel.: (415) 293-6800
`Fax: (415) 293-6899
`mmao@bsfllp.com
`srodriguez@bsfllp.com
`akonik@bsfllp.com
`James Lee (pro hac admission pending)
`Rossana Baeza (pro hac admission pending)
`100 SE 2nd St., 28th Floor
`Tel.: (305) 539-8400
`Fax: (303) 539-1307
`jlee@bsfllp.com
`rbaeza@bsfllp.com
`CHASOM BROWN, MARIA NGUYEN, and
`WILLIAM BYATT, individually and on
`behalf of all other similarly situated,
`GOOGLE LLC and ALPHABET INC.,
`Case No. 20-3664
`CLASS ACTION FOR
`(1) FEDERAL WIRETAP VIOLATIONS, 18
`U.S.C. §§ 2510, ET. SEQ.;
`(2) INVASION OF PRIVACY ACT
`VIOLATIONS, CAL. PENAL §§ 631 &
`632;
`(3) INVASION OF PRIVACY; AND
`(4) INTRUSION UPON SECLUSION.
`COMPLAINT CASE NO. 20-3664
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 2 of 37
`Plaintiffs Chasom Brown, Maria Nguyen, and William Byatt, individually and on behalf of
`all others similarly situated, file this class action against defendants Google LLC and its parent
`company, Alphabet Inc. (collectively, “Google” or “Defendants”), and in support state the
`Protecting data privacy is critical in our rapidly modernizing society. People
`everywhere are becoming more aware (and concerned) that their personal communications are
`being intercepted, collected, recorded, or exploited for gain by technology companies they have
`come to depend on.
`Well aware of consumers’ legitimate and reasonable concerns over privacy, Google
`assured, and continues to assure, its consumers and users that they, and not Google, are “in control
`of what information [they] share with Google.” Google further represents that “across our services,
`you can adjust our privacy settings to control what we collect and how your information is used.”
`Nothing could be further from the truth.
`As discussed in more detail below, Google tracks and collects consumer browsing
`history and other web activity data no matter what safeguards consumers undertake to protect their
`data privacy. Indeed, even when Google users launch a web browser with “private browsing mode”
`activated (as Google recommends to users wishing to browse the web privately), Google nevertheless
`tracks the users’ browsing data and other identifying information.
`Google accomplishes its surreptitious tracking through means that include: Google
`Analytics, Google Ad Manager, and various other application and website plug-ins, such as Google
`applications on mobile devices and the “Google Sign-In button” for websites. When an internet user
`visits a webpage or opens an app that uses such services (over 70% of all online publishers use such
`a service), Google receives detailed, personal information such as the user’s IP address (which may
`provide geographic information), what the user is viewing, what the user last viewed, and details
`about the user’s hardware. Google takes the data regardless of whether the user actually clicks on a
`Google-supported advertisement—or even knows of its existence. This means that billions of times
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 3 of 37
`a day, Google causes computers around the world to report the real-time internet communications of
`hundreds of millions of people to Google.
`Google has anticipated that consumers are understandably concerned that Google is
`tracking their personal information and browsing history. To assuage them, Google promises
`consumers that they can “browse the web privately” and stay in “control of what information [users]
`share with Google.” To prevent information from being shared with Google, Google recommends
`that its consumers need only launch a browser such as Google Chrome, Safari, Microsoft Edge, or
`Firefox in “private browsing mode.” Both statements are untrue. When users undertake either—or
`both—of the aforementioned steps, Google continues to track, collect, and identify their browsing
`data in real time, in contravention of federal and state laws on wiretapping and in violation of
`consumers’ rights to privacy.
`Google’s practices infringe upon users’ privacy; intentionally deceive consumers;
`give Google and its employees power to learn intimate details about individuals’ lives, interests,
`and internet usage; and make Google “one stop shopping” for any government, private, or criminal
`actor who wants to undermine individuals’ privacy, security, or freedom. Through its pervasive
`data tracking business, Google knows who your friends are, what your hobbies are, what you like
`to eat, what movies you watch, where and when you like to shop, what your favorite vacation
`destinations are, what your favorite color is, and even the most intimate and potentially
`embarrassing things you browse on the internet—regardless of whether you follow Google’s advice
`to keep your activities “private.” Indeed, notwithstanding consumers’ best efforts, Google has made
`itself an unaccountable trove of information so detailed and expansive that George Orwell could
`never have dreamed it.
`Google must be held accountable for the harm it has caused to its users in order to
`ensure it cannot continue to engage in the covert and unauthorized data collection from virtually every
`American with a computer or phone. This action arises from Google’s unlawful and intentional
`interception and collection of individuals’ confidential communications without their consent, even
`when those individuals expressly follow Google’s recommendations to prevent the tracking or
`collection of their personal information and communications. Beyond the California Constitution,
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 4 of 37
`federal and state privacy laws recognize individuals’ reasonable expectations of privacy in
`confidential communications under
`these circumstances. Federal privacy
`laws prohibit
`unauthorized interception, access, and use of the contents in electronic communications. California
`law similarly prohibits, among other things, eavesdropping, recording, and sharing of confidential
`communications without the consent of all parties to the communication.
`Plaintiffs are Google subscribers whose internet use was tracked by Google between
`June 1, 2016 and the present (the “Class Period”), while browsing the internet from a browser in
`“private browsing mode.” They bring federal and California state law claims on behalf of other
`similarly-situated Google subscribers in the United States (the “Class”) arising from Google’s
`knowing and unauthorized interception and tracking of users’ internet communications and activity,
`and knowing and unauthorized invasion of consumer privacy.
`Plaintiff Mr. Chasom Brown (“Brown”) is an adult domiciled in Los Angeles,
`California. Brown had an active Google account during the entire Class Period.
`Plaintiff Ms. Maria Nguyen (“Nguyen”) is an adult domiciled in Los Angeles,
`California. Nguyen had an active Google account during the entire Class Period.
`Plaintiff Mr. William Byatt (“Byatt”) is an adult domiciled in Florida. Byatt had an
`active Google account during the entire Class Period.
`Defendant Google is a Delaware limited liability company with a principal place of
`business at what is officially known as The Googleplex, 1600 Amphitheatre Parkway, Mountain
`View, California 94043. Google regularly conducts business throughout California and in this
`judicial district. Google is one of the largest technology companies in the world and conducts product
`development, search, and advertising operations in this district.
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 5 of 37
`Defendant Alphabet Inc. is a Delaware corporation, organized and existing under the
`laws of the State of Delaware, with its principal place of business at what is officially known as The
`Googleplex, 1600 Amphitheatre Parkway, Mountain View, California 94043. Alphabet Inc. is the
`parent holding company of Google LLC. Alphabet Inc. owns all the equity interests in Google
`LLC.1
`This Court has personal jurisdiction over Defendants because their principal place
`of business is in California. Additionally, Defendants are subject to specific personal jurisdiction
`in this State because a substantial part of the events and conduct giving rise to Plaintiffs’ and the
`Class’ claims occurred in this State.
`This Court has subject matter jurisdiction over the federal claims in this action,
`namely the Federal Wiretap Act, 18 U.S.C. § 2511 (the “Wiretap Act”) pursuant to 28 U.S.C.
`§ 1331.
`This Court has subject matter jurisdiction over this entire action pursuant to the
`Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1332(d), because this is a class action in which
`the amount in controversy exceeds $5,000,000, and at least one member of the class is a citizen
`of a state other than California or Delaware.
`This Court also has supplemental jurisdiction over the state law claims in this
`action pursuant to 28 U.S.C. § 1367 because the state law claims form part of the same case or
`controversy as those that give rise to the federal claims
`Venue is proper in this District because a substantial portion of the events and
`actions giving rise to the claims in this matter took place in this judicial District. Furthermore,
`Defendants Alphabet Inc. and Google LLC are headquartered in this District and subject to personal
`jurisdiction in this District.
`1 During the 2015 reorganization, certain of Google LLC’s business segments were spun off and
`separated into independent entities under the ownership of Alphabet Inc. At various times during
`the Class Period, certain of the business segments re-merged with Google LLC under one corporate
`structure. Accordingly, Alphabet Inc. and Google LLC both have been named as defendants in
`order to ensure all corporate entities who may be found liable for any portion of the alleged
`wrongdoing are part of this lawsuit.
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 6 of 37
`Intradistrict Assignment. A substantial part of the events and conduct which give
`rise to the claims herein occurred in Santa Clara County.
`Google’s Persistent Tracking Through Its Analytics and Ad Manager
`Over 70% of online websites and publishers on the internet (altogether “Websites”)
`utilize Google’s website visitor-tracking product, “Google Analytics.” Google Analytics is a
`“freemium” service Google makes available to Websites that provides data analytics and
`attribution about the origins of a Website’s traffic, demographics, frequency, browsing habits on
`the Website, and other data about visitors.
`Google Analytics is “free” to implement, but the associated data and attribution
`reports come at a price tag when Websites want more specific information. Websites can obtain
`free general reports with pseudo-anonymous data regarding visitors. To obtain more specific and
`granular data about visitors, Websites must pay a substantial fee, such as by paying for Google’s
`DV360, Ad Hub, or Google Audience products.
`To implement Google Analytics, Google asks that Websites embed Google’s own
`custom code into their existing webpage code. When a consumer visits a Website, his or her
`browser communicates a request to the Website’s servers to send the computer script to display
`the Website. This communication and request for content from the consumer is often referred to
`as a HTTP GET request, to which the Website’s servers respond with the computer code script to
`display the contents of the Website. The consumer’s browser then begins to read Google’s custom
`code along with the Website’s own code when loading the Website from the Website’s server.
`Two sets of code are thus automatically run as part of the browser’s attempt to load and read the
`Website pages—the Website’s own code, and Google’s embedded code.
`Google designed its Analytics code such that when it is run, Google causes the
`user’s browser to send his or her personal information to Google and its servers in California, such
`as the user’s IP address, URL address and particular page of the Website that is being visited, and
`other information regarding the user’s device and browser. This is almost always done without
`the user’s knowledge, in response to the consumer’s request for information from the Website’s
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 7 of 37
`server. Google does not require that Websites disclose upfront that Google is collecting the
`visitors’ information regardless of what they do, and as further discussed below, Google does not
`tell its users which websites implement Google Analytics. There is no effective way for consumers
`to avoid Google Analytics.
`This practice allows Google to intercept, track, and collect more communications
`that reveal personal and consumer data than any company in the world. Since more than 70% of
`Websites use Google Analytics, Google is able to track a staggering amount of personal and
`consumer data online in real time. With virtually every click of the mouse to initiate a consumer’s
`request, Google intercepts a signal and sends it to its own servers. Those signals contain
`consumers’ personal viewing information and requests, which Google collects, reads, analyzes the
`contents of, and organizes based on consumers’ prior histories. Google then uses the personal
`information obtained through this routine practice of interception to advance its business interests.
`In addition to Google Analytics, over 70% of online publishes utilize another
`Google tracking and advertising product, called “Google Ad Manager” (formerly known as
`“DoubleClick For Publishers” or “DFP”).
`Like Google Analytics, Google Ad Manager requires Google code to be embedded
`into the Website’s code, which is also run automatically whenever a user’s browser loads the
`Website, as part of the consumer’s request for the contents of the Website from the Website
`servers. The code essentially tells the browser what Google advertisements to display along with
`the Website’s actual content, so that ads are served on behalf of Google’s advertising customers.
`In addition to serving ads, however, the Ad Manager code also causes users’
`browsers to send their personal information to Google and its servers in California, allowing
`Google to track visitors and traffic in much the same way as Google Analytics. To display a
`webpage with an ad served by Ad Manager, Google’s code again extracts the visitor’s IP address,
`browser and device information, the URL page, and content the visitor’s device is displaying in
`real time. This occurs every time a user opens a Website containing the Google Ad Manager code.
`As with Google Analytics, Google does not require that Websites disclose upfront that Google is
`collecting the visitors’ information regardless of what they do, and as further discussed below,
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 8 of 37
`Google does not tell its users which websites implement Google Ad Manager. There is no effective
`way for consumers to avoid Google Ad Manager.
`Thus, unbeknown to most consumers, Google constantly tracks what they request
`and read, click by click and page by page, in real time.2
`Google’s Misrepresentations About Data Privacy
`Over the last few years, the public, legislators, and courts have become increasingly
`aware of online threats to consumer privacy—including threats posed by powerful technology
`companies that have become household names. Google has responded by giving users the false
`impression that they can prevent Google from tracking their browsing history and collecting their
`personal data online. In Google’s Privacy Policy, Google makes numerous assurances about how
`users can “control” the information users share with Google, and that they can surf the web
`anonymously and without their communications with websites being intercepted.
`Google’s Privacy Policy explicitly states that “you can adjust your privacy settings
`to control what we collect and how your information is used.”
`On the “Go to My Activity” page of the Privacy Policy, Google reiterates that
`“My Activity allows you to review and control data that’s created when you use Google
`services, like searches you’ve done.”
`2 The technical explanation is that when an individual internet user visits a web page, his or her
`browser sends a message called a “GET request” to the web page’s server. The GET request serves
`two purposes: it first tells the website what information is being requested and then instructs the
`website to send the information back to the user. The GET request also transmits a referer header
`containing the personally-identifiable URL information. Typically, this communication occurs
`only between the user’s web browser and the third-party website. On websites with Google code
`such as Google Analytics and Ad Manager, however, Google’s code directs the user’s browser to
`copy the referer header from the GET request and then send a separate but identical GET request
`and its associated referer header to Google’s server. It is through this duplication and collection
`of GET requests that Google compiles users’ browsing histories.
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 9 of 37
`32. When users click on “Go to My Activity” to control their data, they are presented
`with the option to “Learn more.” When users click on “Learn more,” they are taken to a page
`where they are supposed to be able to “View & control activity in your account.” On that page,
`Google states that you may “[s]top saving activity temporarily. . . . You can search and browse the
`web privately,” embedding a hyperlink to the “Search & Browse Privately” page. See SEARCH &
`BROWSE PRIVATELY, https://support.google.com/websearch/answer/4540094?hl=en&ref_topic
`=3036132 (last visited May 29, 2020).
`On the “Search & Browse Privately” page, Google once again reiterates that the
`user, not Google, is “in control of what information [a user] . . . share[s] with Google . . . .” Google
`states simply that consumers enabling “private browsing mode” on their browsers will allow
`consumers to “browse the web privately”:
`Search & browse privately
`You’re in control of what information you share with Google when you search. To
`browse the web privately, you can use private browsing, sign out of your account,
`change your custom results settings, or delete past activity.
`If you want to search the web without saving your search activity to your account,
`you can use private browsing mode in a browser (like Chrome or Safari).
`How private browsing works
`Private browsing works differently depending on which browser you use. Browsing
`in private usually means:
`• The searches you do or sites you visit won't be saved to your device or browsing
`history.
`• Files you download or bookmarks you create might be kept on your device.
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 10 of 37
`• Cookies are deleted after you close your private browsing window or tab.
`• You might see search results and suggestions based on your location or other searches
`you've done during your current browsing session.
`Important: If you sign in to your Google Account to use a web service like Gmail,
`your searches and browsing activity might be saved to your account.
`There is nothing on this page about Google Analytics or Google Ad Manager, or where and which
`websites online implement such data collection tools.
`From the “View & control activity in your account” page referenced above, a
`consumer can also click the link, “See & control your Web & App Activity” on the right-hand
`side. See SEE & CONTROL YOUR WEB & APP ACTIVITY, https://support.google.com/websearch/
`answer/54068?visit_id=6372555086257257422105376128&hl=en&rd=1 (last visited May 29,
`2020). On that page, Google again represents that searching and browsing in “private browsing
`mode” will “turn off” any “search customization” “using search-related activity”:
`How Web & App Activity works when you’re signed out
`Your search and ad results may be customized using search-related activity even if
`you're signed out. To turn off this kind of search customization, you can search and
`browse privately. Learn how.
`35. When users click the “Learn how” link, they are again redirected back to the
`“Search & Browse Privately” page. In other words, with Google repeatedly touting that users can
`“control” the information they share with Google, and with Google constantly referring back to its
`recommendations on how users may “browse the web privately,” the only reasonable impression
`that users are left with is the following: if they are searching or browsing the web in “private
`browsing mode,” Google will honor their request to be left alone and in private without further
`tracking.
`As further explained herein, Google’s representations about how it does not track
`users under these conditions are completely false. Not only do consumers not know about what
`Google is doing to collect data on them, they have no meaningful way of avoiding Google’s data
`collection practices, even if they are following Google’s instructions to “browse the web
`privately.”
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 11 of 37
`Google Refuses to Turn Off Its Tracking of Users When They Are Browsing
`in “Private Browsing Mode”
`Despite its representations that users are in control of what information Google will
`track and collect, Google’s various tracking tools, including Google Analytics and Google Ad
`Manager, are actually designed to automatically track users when they visit webpages—no matter
`what settings a user chooses. This is true even when a user browses in “private browsing mode.”
`Take, for example, someone who visits The New York Times website in private
`mode with his Google Chrome browser. Indeed, even when he is browsing with “private browsing
`mode” enabled, Google Analytics and Google Ad Manager continue to track his data, as
`demonstrated by the following screenshot:
`Plaintiffs are informed and believe that even when users are browsing the internet
`in “private browsing mode,” Google continues to track them when they visit a Website that uses
`Google Analytics or Google Ad Manager. Google does so by collecting, at minimum, the
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 12 of 37
`consumer’s IP address, browser and device information, and the webpage content that the
`consumer is actually looking at. This is precisely the type of private, personal information users
`wish and expect to protect when they have taken these steps to control what information is shared
`with Google. Google’s tracking occurred and continues to occur no matter how sensitive or
`personal users’ online activities are. By tracking, collecting, and intercepting Plaintiffs’ personal
`communications indiscriminately—regardless of whether Plaintiffs have attempted to avoid such
`tracking pursuant to Google’s instructions—Google has gained a complete, cradle-to-grave profile
`of Plaintiffs without their consent.
`Google’s justifications for doing so are baseless. Plaintiffs are informed and
`believe that Google has contended in private industry conversations, and in internal meetings and
`documents, that such surreptitious data collection is permissible, as it “aggregates the data” after
`the data has already been intercepted, collected, reviewed, and analyzed by Google. This does not
`mean that Google does not utilize and/or monetize this data in any way. Google does. It merely
`changes the form of storage after the data has served Google’s nefarious uses. In any event, what
`Google says it does with users’ communications with Websites after it has intercepted, analyzed,
`and used them for certain of its business purposes is cold comfort for those whose privacy it has
`already violated, because Google has repeatedly promised not to intercept or collect such
`communications in the first place. By doing so, it has already breached its users’ expectations of
`privacy (that Google itself had created).
`Plaintiffs are informed and believe that Google has also claimed in private industry
`conversations and in internal meetings and documents that its data collection practices are
`acceptable and not impermissible interceptions of communications, because Google is “acting on
`behalf of the website(s)”, as their vendor. But that is simply not true. Instead, Google tells the
`Website owners—and their other advertisement vendors, which are often Google competitors—
`that data Google collects “on behalf of the website” actually belongs to Google, and not the
`website.
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 13 of 37
`Google Can Track on Websites Using Other Methods as Well
`In addition to Google Analytics and Ad Manager, Google actively and
`automatically tracks users who visit Websites in other ways, despite its assurances to the contrary.
`43. Much like other social media giants, Google has a “single sign on” button (the
`“Google Button”) that it causes various Websites to encode onto their webpages:
`Like other social media buttons, the Google Button has numerous tracking
`functions embedded into its code, which include the same type of automatic data collection
`implemented by Google’s Analytics and Ad Manager products described above. When a visitor’s
`browser loads the Google Button on the screen, Google’s code is called from its servers, which
`helps Google track the consumer.
`Google also allows “approved third parties” (such as Comscore, a data broker
`registered with California’s CCPA data broker registry) to provide digital pixels (“Google
`Approved Pixels”) to be embedded within the Websites’ code. See, e.g., USE TRACKING PIXELS,
`https://support.google.com/news/publisher-center/answer/9603438?hl=en (last visited May 29,
`2020). When the code for such pixels is run by user browsers, the pixels are displayed uniquely
`by each browser/device combination because of certain digital signatures unique to each browser
`and device. By tracking these pixels and the unique resulting displays, Google and its data-broker
`partners are able to track and “measure” consumers across the web.
`Like Google Analytics and Ad Manager, the Google Button and Google Approved
`Pixels help the tech giant track consumers across the web in real time, even when they are in
`private mode.
`Perhaps most troubling is Google’s ability to match its web tracking capabilities
`with its Android operating system data and various Google application data on mobile devices. In
`Case 5:20-cv-03664-SVK Document 1 Filed 06/02/20 Page 14 of 37
`a 2018 white paper entitled “Google Data Collection,”3 Professor Douglas C. Schmidt of
`Vanderbilt University concluded that Google’s Android operating system, and several of Google’s
`mobile applications, are constantly sending system and location data to Google’s servers.
`Specifically, Professor Schmidt wrote:
`Both Android and Chrome send data to Google even in the absence
`of any user interaction. Our experiments show that a dormant,
`stationary Android phone (with Chrome active in the background)
`communicated location information to Google 340 times during a
`24-hour period, or at an average of 14 data communications per
`hour. In fact, location information constituted 35% of all the data
`samples sent to Google.
`Indeed, now that Google has acquired Nest and merged Nest’s data with data obtained via Google
`Home, Professor Schmidt’s analysis regarding Google’s ability to identify and track who and
`where we are is even more persistent and pernicious.
`Through its passive data collection practices employed by Android, Google
`applications (e.g., Chrome and Maps), Google Home, and other Google applications and services,
`Google constantly collects users’ system and geolocation data. Plaintiffs are informed and believe
`that such passive collection happens even when a consumer is in the web browser’s “private
`browsing mode.” Indeed, the Arizona Attorney General recently filed a complaint against Google
`alleging that