• by Wendy Davis  @wendyndavis, March 20, 2017

A federal judge has rejected a settlement of a class-action lawsuit alleging that Google violates people's privacy by scanning emails for ad-targeting purposes.

The settlement called for Google to pay up to $2.2 million to the lawyers who brought the case on behalf of the class, but nothing to individual users. The deal also called for some technical changes to its email scanning system.

"Based on the parties' current filings, the court cannot conclude that the settlement is 'fundamentally fair, adequate, and reasonable,'" U.S. District Court Judge Lucy Koh said in a decision issued last week.

The rejected deal stems from a complaint filed in September 2015 by San Francisco resident Daniel Matera, who alleged that Google violates a California privacy law and the federal wiretap law by intercepting messages without people's consent.

Google's terms of service disclose that it analyzes the contents of email messages for features including "tailored advertising." But Matera alleged that he didn't have a Gmail account, and therefore never agreed to those terms.

In her decision denying preliminary approval to the settlement, Koh specifically criticized the deal for failing to require Google to inform the public that it scans emails sent by non-Gmail users in order to send targeted ads to people with Gmail accounts.

She also said that it wasn't clear how Google's proposed technical changes to its scanning system would remedy any violations of the federal wiretap law or California's privacy statute.

Koh also said that a proposed public notification about the settlement terms was not adequate. "The notice does not clearly disclose that Google intercepts, scans, and analyzes the content of emails sent by non-Gmail users to Gmail users for the purpose of creating user profiles of the Gmail users to create targeted advertising for the Gmail user," she wrote.

Koh previously approved Yahoo's settlement of a similar lawsuit. That deal required Yahoo to add new language to its privacy policy, and to make some technical changes to the way it scans emails, but didn't require the company to otherwise change its ad-targeting efforts. The agreement also did not call for Yahoo to pay monetary damages to Web users whose privacy allegedly was violated, but provided for payments of up to $4 million to the attorneys who brought the case.

Koh said last week that circumstances surrounding the Yahoo settlement justified that deal, noting that more evidence had been developed in that matter than in the Google battle. 

"The Yahoo settlement took place after more than two years of litigation," she wrote. "The parties and the Court had much more information to assess the risks of litigation and determine whether the class action settlement was fair and reasonable under the circumstances."

Koh also noted that Yahoo's privacy policy disclosed that the company scanned non-users' emails, and that the agreement "included additional important disclosures regarding scanning of incoming and outgoing emails and the sharing of information with third parties."