Google agrees to delete Incognito data despite prior claim that’s “impossible”

What a lawyer calls "a historic step," Google considers not that "significant."

To settle a class-action dispute over Chrome's "Incognito" mode, Google has agreed to delete billions of data records reflecting users' private browsing activities.

In a statement provided to Ars, users' lawyer, David Boies, described the settlement as "a historic step in requiring honesty and accountability from dominant technology companies." Based on Google's insights, users' lawyers valued the settlement between $4.75 billion and $7.8 billion, the Monday court filing said.

Under the settlement, Google agreed to delete class-action members' private browsing data collected in the past, as well as to "maintain a change to Incognito mode that enables Incognito users to block third-party cookies by default." This, plaintiffs' lawyers noted, "ensures additional privacy for Incognito users going forward, while limiting the amount of data Google collects from them" over the next five years. Plaintiffs' lawyers said that this means that "Google will collect less data from users’ private browsing sessions" and "Google will make less money from the data."

"The settlement stops Google from surreptitiously collecting user data worth, by Google’s own estimates, billions of dollars," Boies said. "Moreover, the settlement requires Google to delete and remediate, in unprecedented scope and scale, the data it improperly collected in the past."

Google had already updated disclosures to users, changing the splash screen displayed "at the beginning of every Incognito session" to inform users that Google was still collecting private browsing data. Under the settlement, those disclosures to all users must be completed by March 31, after which the disclosures must remain. Google also agreed to "no longer track people’s choice to browse privately," and the court filing said that "Google cannot roll back any of these important changes."

Notably, the settlement does not award monetary damages to class members. Instead, Google agreed that class members retain "rights to sue Google individually for damages" through arbitration, which, users' lawyers wrote, "is important given the significant statutory damages available under the federal and state wiretap statutes."

"These claims remain available for every single class member, and a very large number of class members recently filed and are continuing to file complaints in California state court individually asserting those damages claims in their individual capacities," the court filing said.

While "Google supports final approval of the settlement," the company "disagrees with the legal and factual characterizations contained in the motion," the court filing said. Google spokesperson José Castañeda told Ars that the tech giant thinks that the "data being deleted isn't as significant" as Boies represents, confirming that Google was "pleased to settle this lawsuit, which we always believed was meritless."

"The plaintiffs originally wanted $5 billion and are receiving zero," Castañeda said. "We never associate data with users when they use Incognito mode. We are happy to delete old technical data that was never associated with an individual and was never used for any form of personalization."

While Castañeda said that Google was happy to delete the data, a footnote in the court filing noted that initially, "Google claimed in the litigation that it was impossible to identify (and therefore delete) private browsing data because of how it stored data." Now, under the settlement, however, Google has agreed "to remediate 100 percent of the data set at issue."

Mitigation efforts include deleting fields Google used to detect users in Incognito mode, "partially redacting IP addresses," and deleting "detailed URLs, which will prevent Google from knowing the specific pages on a website a user visited when in private browsing mode." Keeping "only the domain-level portion of the URL (i.e., only the name of the website) will vastly improve user privacy by preventing Google (or anyone who gets their hands on the data) from knowing precisely what users were browsing," the court filing said.

Because Google did not oppose the motion for final approval, US District Judge Yvonne Gonzalez Rogers is expected to issue an order approving the settlement on July 30.

Source : https://arstechnica.com/tech-policy/2024/04/google-agrees-to-delete-private-browsing-data-to-settle-incognito-mode-lawsuit/