• by Wendy Davis  @wendyndavis, April 5, 2024

A federal judge on Thursday declined to grant class-action status to six Google account holders who brought privacy related claims against the company stemming from its real-time bidding system.

But the ruling, issued by U.S. District Court Judge Yvonne Gonzalez Rogers in the Northern District of California, allows the account holders to gather more evidence and renew their request to proceed as a class for purposes of obtaining an injunction against the company.

What's more, Rogers appeared to endorse the idea that Google should revise some real-time bidding practices.

“The injunctive relief sought would be an important step toward choice, accountability, and transparency,” she wrote.

But in a partial victory for Google, the judge prohibited the plaintiffs from renewing a request for monetary damages on a class-wide basis. While the decision allows users to seek damages on an individual basis, doing so can be prohibitively expensive.

The decision stems from a lawsuit brought against Google in March 2021, when Missouri resident Kimberley Woodruff and other users alleged the company's real-time bidding ad system violates people's privacy by sharing their personal information with “thousands” of outside companies. Other Google users, including California and out-of-state residents, later joined in the complaint.

Among other claims, the users said Google violated representations that it wouldn't share people's personal information.

Two years ago, Rogers rejected Google's request to throw out the lawsuit at an early stage of the proceeding. She said at the time that the allegations in the complaint, if proven true, could show that Google violated federal and California privacy laws, as well as promises to avoid sharing personal information.

Since then, Google and the plaintiffs have been exchanging evidence relating to the dispute, and battling in court over whether the matter should proceed as a class-action.

The users sought to represent a class of all Google account holders whose personal information was sold or shared by Google through real-time bidding after June 28, 2016 -- the date Google revised its privacy policy in a way that allowed the company to combine data about pseudonymous web-browsing activity with personally identifiable information.

Google opposed class-certification for several reasons. Among other arguments, the company said that questions about whether users consented to information sharing required individualized determinations.

Rogers agreed that claims for monetary damages would require individual evaluation, but disagreed regarding a request for an injunction.

“There is evidence before the court which already shows that Google shares enough information that [real-time bidding] participants can discern what an account holder is reading online, even when it is on a religious or medical topic; exactly where they are reading it, including the coordinates of an account holder’s home or work; and their background, which allows for a detailed, demographic profile of the account holder,” Rogers wrote in a 26-page ruling.

“Google cannot run away from the common question of whether it promises its account holders that it would not sell their personal information and, if so, it violates that promise billions of times a day,” she added.