Opinion ID: 3153537
Heading Depth: 2
Heading Rank: 2

Heading: Cookie Blocking, Circumvention, Deceit, and

Text: Discovery Individually tailored webpage advertisements are now ubiquitous. But, where cookie-based tracking is concerned, leading web browsers have designed built-in features to prevent the installation of cookies by third-party servers. The 2 Compl. ¶ 45. 3 Compl. ¶ 46. 7 complaint calls them “cookie blockers.” The cookie blockers of two browsers are at issue in this case. One is Microsoft’s Internet Explorer, which featured an “opt-in” cookie blocker that a user could elect to activate. The other is Apple’s Safari browser, which featured an “opt-out” cookie blocker that was activated by default. The complaint notes that the main Apple website page dedicated to Safari advertised its opt-out cookie blocker as a unique feature, stating that, “to better protect[] your privacy[,] Safari accepts cookies only from the websites you visit.”4 Likewise, the Safari browser labeled its default cookie setting as “Block cookies: From third parties and advertisers.”5 According to the complaint, the Safari and Internet Explorer cookie blockers were well-known to industry participants, including as to their existence, functionality, and purpose. More is alleged about Google in particular. Google’s Privacy Policy explained that “most browsers are initially set up to accept cookies, but you can reset your browser to refuse all cookies or to indicate when a cookie is being sent.”6 Google provided further assurances about the Safari cookie blocker specifically. Google offered a proprietary cookie blocker, a so-called “opt-out cookie” that, when downloaded, would prevent the installation of tracking cookies. On the public webpage Google maintained to describe its opt-out cookie, Google assured visitors that “Safari is set by default 4 Compl. ¶ 69. 5 Compl. ¶ 71. 6 Compl. ¶ 80. 8 to block all third party cookies. If you have not changed those settings, this option essentially accomplishes the same thing as setting the opt-out cookie.”7 In February 2012, Stanford graduate student Jonathan Mayer published an online report revealing that Google and the other defendants had discovered, and were surreptitiously exploiting, loopholes in both the Safari cookie blocker and the Internet Explorer cookie blocker.8 Safari’s cookie blocker turns out to have had a few exceptions, one of which was that it permitted third-party cookies if the browser submitted a certain form to the third-party. Because advertisement delivery does not, in the ordinary course, involve such forms, the exception ought not have provided a pathway to installing advertiser tracking cookies. But according to Mayer’s report, Google used code to command users’ web browsers to automatically submit a hidden form to Google when users visited websites embedded with Google advertisements. This covert form triggered the exception to the cookie blocker, and, used widely, enabled the broad placement of cookies on Safari browsers notwithstanding that the blocker—as Google publicly acknowledged—was designed to prevent just that. The other defendants, meanwhile, accomplished similar circumventions. As a result, the defendants could—and did— place third-party cookies on browsers with activated blockers. 7 Compl. ¶ 79. 8 Compl. ¶ 75; Jonathan Mayer, Web Policy Blog, Safari Trackers (Feb. 17, 2012), http://webpolicy.org/2012/02/17/safari-trackers/. 9 Mayer’s findings were concurrently published in the Wall Street Journal9 and drew the attention of the Federal Trade Commission and a consortium of state attorneys general. The Department of Justice filed suit under the Federal Trade Commission’s authorizing statute in the Northern District of California, and the action resolved by way of a stipulated order providing for a $22.5 million civil penalty.10 Google further agreed to certain forward-looking conditions related to internet privacy, but admitted no past acts or wrongdoing.11 Google similarly reached a $17 million 9 Compl. ¶ 74; Julia Angwin & Jennifer Valentino-Devries, Google’s iPhone Tracking: Web Giant, Others Bypassed Apple Browser Settings for Guarding Privacy, Wall Street Journal (Feb. 17, 2012), http://www.wsj.com/article_email/SB1000142405297020488 0404577225380456599176. 10 Compl. ¶¶ 166-68; United States v. Google, Inc., N.D. Cal. No. 12-cv-4177, Docs. 1, 30; see also Press Release, Federal Trade Commission, Google Will Pay $22.5 Million to Settle FTC Charges it Misrepresented Privacy Assurances to Users of Apple’s Safari Internet Browser: Privacy Settlement is the Largest FTC Penalty Ever for Violation of a Commission Order (Aug. 9, 2012), https://www.ftc.gov/newsevents/press-releases/2012/08/google-will-pay-225-millionsettle-ftc-charges-it-misrepresented. 11 Compl. ¶ 169; Google, N.D. Cal. No. 12-cv-4177, Docs. 30, 32. 10 settlement with 38 state attorneys general, including the California Attorney General.12