Google fails to neutralize lawsuit that complains Chrome's incognito mode isn't very private at all

Judge Lucy Koh allows legal challenge to move forward

Netizens who say Google continued to track them around the web even when using Chrome's incognito mode can proceed with their privacy lawsuit against the internet giant, a judge has ruled.

The decision by Judge Lucy Koh, based in a San Jose federal district court just down the road from Google HQ, once again sees the internet titan and its data-snaffling policies under the microscope. Specifically, the judge denied Google’s motion to dismiss the class-action-seeking lawsuit, stating: “The court concludes that Google did not notify users that Google engages in the alleged data collection while the user is in private browsing mode.”

The plaintiffs in the case – Chasom Brown, Maria Nguyen, William Byatt, Jeremy Davis, and Christopher Castillo – complain that people who used Chrome's incognito mode expected to be just that – incognito – but in reality Google still observed them to provide targeted advertising; Google’s main revenue source. According to the lawsuit:

Google collects data from them while they are in private browsing mode "through means that include Google Analytics, Google 'fingerprinting' techniques, concurrent Google applications and processes on a consumer’s device, and Google’s Ad Manager."

Google argued users had agreed to the mode’s terms of service, which allows Google to gather at least some browsing activities: an argument that, we imagine for many, does not pass the sniff test. One of whom at least is, unfortunately for Google, the judge presiding over their case.

“Google cannot demonstrate that plaintiffs expressly consented because Google did not notify users that it would be engaging in the alleged data collection while Plaintiffs were in private browsing mode,” she wrote [PDF] in her judgment late last week. “Google’s privacy policy does not disclose Google’s alleged data collection while Plaintiffs were in private browsing mode.”

The plaintiffs claimed Google, through Chrome's private browsing mode, performed unauthorized interception under America's Wiretap Act, though the web colossus argued this cannot be so because the biz is exempt if someone agrees to have their data intercepted.

The judge also rejected that argument, agreeing with the plaintiffs that they had never “consented to, or even knew about, the interception of their communications with users who were in private browsing mode.” She also rejected a statute of limitations argument.

Fundamentally, the judge took the position of the ordinary internet user when she noted that people expected to get privacy when they actively entered a special privacy browsing mode. And, as a result, there were entitled to push forward an invasion of privacy claim if it appeared Google was still tracking them.

After months of stalling, Google finally revealed how much personal data they collect in Chrome and the Google app

The case will now move onto discovery where Google will be obliged to hand over relevant documents that explain what exactly it harvests when people are browsing in incognito mode.

Google is notoriously unwilling to share any of that sort of information, and just today competing search engine DuckDuckGo, which actually does provide privacy to users, noted with regard to Google's privacy labels on its iOS software: “After months of stalling, Google finally revealed how much personal data they collect in Chrome and the Google app,” adding. “No wonder they wanted to hide it.” It provides a graphic showing, in broad terms at least, exactly how much data Google gathers and stores on its users.

However, discovery would likely give the lawsuit’s plaintiffs a further look behind the scenes: something that could well result in a slew of new lawsuits. For that reason, some observers predict a generous settlement offer from the tech giant. ®