Google sued over data collection from users in incognito mode

The lawsuit was filed this week by Boies Schiller Flexner in the District Court of Northern California in San Jose, on behalf of three plaintiffs.

“[Google] cannot continue to engage in the covert and unauthorised data collection from virtually every American with a computer or phone,” the complaint said.

Entering incognito mode in Google’s Chrome browser allows users to browse the internet without their activity being saved locally e.g.: the URLs they visit will not appear in their browsing history. However, user activity can still be tracked using services like Google Analytics, Google Ad Manager, and Google Sign-In.

The complaint says that when a user visits a website or opens any app which uses these services (reportedly used by over 70 per cent of all online publishers) personal data such as IP address and browser activity are sent to Google’s servers. It argues that this is almost always done without the user’s knowledge and consent as Google does not require websites to disclose upfront that Google is harvesting user data.

“Google takes the data regardless of whether the user actually clicks on a Google-supported advertisement – or even knows of its existence. This means that billions of times a day, Google causes computers around the world to report the real-time internet communications of hundreds of millions of people to Google,” the complaint says.

It accuses Google’s behaviour of infringing on privacy; intentionally deceiving users; collecting insights into the “intimate details” of users’ lives; and makes Google “one stop shopping” for any entity which intends to undermine individual privacy, security, and freedom.

The lawsuit alleges that users are largely unaware that their private activity is tracked in incognito mode. Google argues that this is legal, and it is transparent about the data it collects in incognito mode. A Google spokesperson pointed towards the disclaimer displayed in a newly-opened incognito tab which states that websites may be able to collect data about the user’s browsing activity.

The class action is open to Android device owners and Google account holders who have viewed a website containing services such as Google Analytics in incognito mode. It seeks $5,000 in damages per user or three times actual damages, which could mount to costs above $5bn (£4bn) for Google.

Google is facing a cascade of legal challenges all around the world over its intrusive data collection practices, including a lawsuit filed by the Attorney General of Arizona last week, which accuses Google of fraudulently and non-consensually tracking user location via “deceptive practices”.