• by Wendy Davis  @wendyndavis, April 3, 2015

A judge has signed off on a deal requiring Google to pay $8.5 million for allegedly “leaking” the names of people who used the company's search engine.

The settlement, approved this week by U.S. District Court Judge Edward Davila in San Jose, Calif., requires Google to pay around $6 million to nonprofits and $2.1 million to the attorneys who brought the lawsuit. The organizations slated to receive funds are Carnegie Mellon University, World Privacy Forum, Chicago-Kent College of Law, Stanford Law, Harvard's Berkman Center and the AARP Foundation.

The agreement also requires Google to tell users how it treats their search queries, but doesn't force the company to change any practices.

The settlement resolves a class-action lawsuit alleging that Google violated its privacy policy by including search queries in "referrer headers" -- the information that is automatically transmitted to sites that users click on when they leave Google. Some queries, like people's vanity searches on their own names, can offer clues to users' identities.

The case dates to 2010, when Google user Paloma Gaos alleged in a class-action lawsuit that she conducted searches for her own name and then clicked on links on the Google search results. She argued that Google disclosed her "sensitive personal information" to third parties -- the sites she clicked on after conducting searches -- by transmitting her queries in the referrer headers.

The settlement agreement doesn't require Google to change its practices, but does call for the company to rework its privacy policy. But as a practical matter, Google no longer transmits search queries when people click on organic search links. The company still transmits search queries to AdWords advertisers, when users click on paid-search ads.

When the deal was initially announced two years ago, it drew criticism from privacy advocates who said it would enable Google to continue with the same practices that spurred the lawsuit. The Electronic Privacy Information Center, Consumer Watchdog, Center for Digital Democracy, Patient Privacy Rights and Privacy Rights Clearinghouse argued in a September 2013 letter to Davila that the settlement would allow the company to continue leaking users' names and other personal information to publishers.

Davila wrote that those concerns were not reason to scuttle the deal. “Considering all of the circumstances which led to a compromise here, the relief obtained for the class falls within a reasonable range of possible settlements since it was entirely possible that nothing would be obtained if the case were to proceed further,” he wrote this week in a 20-page approval order. “Future users of Google's website will receive something from the injunctive relief: the capability to better understand Google’s disclosure practices before conducting a search on its website, and the ability to make a better informed choice based on that information.”