Written By: Theresa M. Staab
Google is an all-knowing search engine, one that knows no bounds. When Google users switch their “Web & App Activity” (WAA) to private, they are under the impression that they “turned off” the company’s ability to collect and track their data. In reality, this privacy switch simply provides a false sense of control and security, as Google continued to collect personal data across third-party apps.
Users’ expectation of privacy is at the center of Rodriguez v. Google LLC, and while it may not be Google’s most recent privacy case, it does set a new standard for the promise of privacy. Google stated its privacy tools “give people control over their data.” However, if users were really in control, would this lawsuit have ever happened?’
“Opt Out” for Users Means “Opt In” to Companies.
For eight years, Google collected and saved mobile device data from users who opted out of tracking under the WAA, making billions of dollars. The privacy class action was originally filed in July 2020, alleging Google improperly collected data from 98 million users and 174 million devices. This collection was through third-party applications, including —but not limited to—Uber, Lyft, Amazon, Venmo, and Meta’s social media platforms. In January 2025, the U.S. District Court for the Northern District of California denied Google’s motion for summary judgment, allowing the case to go to trial.
On September 3, 2025, the San Francisco Federal Court jury found Google liable for two of the three claims: invasion of privacy under California’s constitution and common law intrusion upon seclusion. Both invasion of privacy claims stem from similar elements: whether users had a reasonable expectation of privacy and if the intrusion was highly offensive. As a result, Google must pay $425 million for this invasion. However, punitive damages were not allowed because the jury found Google did not act with malicious intent. Google has now announced its intention to appeal, arguing the verdict “misunderstands how our products work.”
Notably, this is the second privacy lawsuit Google has faced this year. Just four months ago, Google settled with the state of Texas, agreeing to pay $1.375 billion over alleged violations of consumer protection laws. Google’s spokesperson then stated, “…we will continue to build robust privacy controls into our services.” Yet, it appears these “robust privacy controls” only led Google to face more legal issues.
Settings are Not Suggestions.
The concern for digital users’ privacy rights is at the forefront of this trial. Google did not deny the collection of WAA-off data. They asserted that the tracking and collection was lawful since it was ‘nonpersonal, pseudonymous’ data not associated with anyone’s identity. During the trial, the plaintiff’s computer science expert testified that the data collected was stored in a ‘shadow account’ and used for profit. This ‘shadow account’ stored app activity from each user device and was used for product analysis, development, and ad revenue.
As a defense, Google’s lawyers argued that users consented to this tracking. They claimed the privacy policies stated that the feature to turn off the toggle does not prohibit the anonymous collection of data. This defense was rooted in Google consent language in the WAA setting and pop-ups with additional information. Jurors concluded Google’s “Are You Sure?” windows and additional data detail links were ineffective. There must be consent policies implemented that an average user can actually comprehend.
The jury rejected the explanation of Google’s privacy system process. The focus was on how the company misled its users because when they opted out of tracking, there was a reasonable expectation of a promise of privacy. Even though the data appeared to be non-personal information, it still tracked users’ activity and provided companies with insight into how their apps were utilized.
Privacy Must Mean Private.
This verdict is one of the largest against a major tech company for privacy violations. A model for future digital privacy class actions. Google’s intentions to appeal do not change the fact that this case serves as a warning to large and small tech companies: significant legal consequences can and will occur for improper data collection. As a result, there will be increased pressure to hold tech companies accountable for breaking their promises of privacy.
The case is anticipated to impact the structure and functionality of companies’ consent methods and privacy standards. Tech companies should be more transparent in their definition of “private” in at least one of two ways: make all users aware of their continuous data collection, or honor the user’s decision to opt out of tracking. Greater scrutiny is expected from the courts when examining a company’s privacy controls, as well as large financial penalties for promoting misleading controls. The deceptive tactics companies use are being exposed for their ambiguity. Complex control systems will no longer serve as an excuse for violations of users’ right to privacy.
Sources:
Rodriguez v. Google LLC, U.S. Dist. LEXIS 3238 (N.D. Ca 2025)
Isaiah Portiz et al., Google’s Trial Loss Shows Distaste of Complicated Privacy Terms, Bloomberg L. (Sept. 5, 2025, 3:00 PM), https://news.bloomberglaw.com/business-and-practice/googles-trial-loss-shows-distaste-of-complicated-privacy-terms
Google Privacy Lawsuit: $425 Million Verdict and What It Means for Digital Rights in 2025, Accelerate IP (Sept. 4, 2025), https://accelerateip.com/google-privacy-lawsuit-425-million-verdict-and-what-it-means-for-digital-rights-in-2025/
Deborah Sophia et al., Google must pay $425 million in class action over privacy, jury rules, Reuters (Sept. 3, 2025, 9:01 AM)
Bonnie Eslinger, Google Owes Over $425M For Collecting App Data, Jury Says, LAW 360 (Sept. 3, 2025, 6:57 PM)
Michael Hill, Federal Court Orders Google to Pay $425 Million in Major Privacy Case, Tech Rsch. Online (Sept. 4, 2025), https://techresearchonline.com/news/google-privacy-lawsuit-court-ruling/
Costas Pitas & Tom Hals, Texas secures $1.38 billion settlement with Google over data privacy,
Reuters (May 9, 2025, 7:42 PM)