• by Wendy Davis  @wendyndavis, April 1, 2024

Google has agreed to destroy or “remediate” data it collected from Chrome users who browsed in “incognito” mode prior to December, in order to settle a class-action privacy lawsuit.

The settlement terms, unveiled Monday, also require Google to revise is disclosures about “incognito” mode. 

If accepted by U.S. District Court Judge Yvonne Gonzalez Rogers in Oakland, California, the deal will resolve a battle dating to June 2020, when California residents Chasom Brown and Maria Nguyen and Florida resident William Byatt alleged in a class-action complaint that they were tracked by Google even though they used the Chrome browser's incognito mode to navigate the web.

They specifically alleged that even in incognito mode, visiting a site that uses Google Analytics or Google Ad Manager results in Google's collection of IP addresses, browser and device information, and web pages' content. Information about users' IP addresses, browsers and devices can power “digital fingerprinting,” a controversial tracking technique that enables companies to compile information about users based on the characteristics of their devices.

The users argued that Google's representations about incognito mode didn't adequately convey to users that their data would be collected. The complaint included claims that Google violated its contract with users, and ran afoul of the federal wiretap law and various California laws. 

Google argued the case should be dismissed on the grounds that users “expressly consented” to data collection by accepting Google's privacy policy and other terms of service.

Rogers rejected Google's stance last August, writing that the company's privacy policies didn't “unambiguously” disclose that it would collect data from people who browsed in incognito mode.

She noted in the ruling that Google's privacy policy told users they could "choose to browse the web in a private mode, like Chrome Incognito mode."

Counsel for Google and the Chrome users revealed last December that they had agreed to resolve the litigation, but the terms weren't made available until now.

The proposed settlement requires Google to shed some information collected from incognito users that can be used for device fingerprinting -- including portions of IP addresses -- and to delete detailed URLs that reveal the specific web pages incognito users visited.

The potential deal also requires Google to modify its disclosures, including by telling Chrome users that browsing in incognito mode won't change how outside sites and services -- including Google's -- collect data. 

A Google spokesperson stated Monday that it was "happy to delete old technical data that was never associated with an individual and was never used for any form of personalization."

Rogers had ruled earlier in the case that the plaintiffs could seek an injunction against Google, but couldn't seek monetary damages on a class-wide basis.

The proposed agreement would allow users to pursue individual lawsuits against Google for monetary damages. Lawyers for the plaintiffs said in Monday's court papers that a "very large number" of individual Chrome users plan to do so.