Google users sue over changes to privacy policy

Lawsuits accuse Google of violating users' privacy rights and of deceptive business practices in regard to new privacy policy changes.

Elinor Mills Former Staff Writer
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service and the Associated Press.
Elinor Mills
3 min read

California and New York residents have filed two separate lawsuits this week against Google alleging that changes to the company's privacy policy violate users' privacy rights. The suits seek class-action status.

The New York lawsuit, the text of which is available on The Los Angeles Times Web site, says the change in Google's guidelines enacted March 1 "violates Google's prior privacy policies, which deceived and misled consumers by stating that Google would not utilize information provided by a consumer in connection with his or her use of one service, with any other service, for any reason, without the consumer's consent."

"It also violates consumers' privacy rights, allowing Google to take information from a consumer's Gmail account and Google+ account, which may have one expectation of privacy, and use it in a different context,..." the suit says. This is in violation of a consent decree Google reached with the Federal Trade Commission last year, claims the suit, filed on Tuesday by three New York residents.

The California lawsuit, which two plaintiffs filed Tuesday in federal court in San Jose, makes the same arguments. "Google is now aggregating consumers' personal information without consumers' consent; has failed to provide a simple, effective opt-out mechanism,..." the suit claims.

The lawsuits claim violations of the Federal Wiretap Act, the Stored Electronic Communications Act, and the Computer Fraud Abuse Act, among other counts.

"We don't have any comment on the litigation. We haven't yet been served with it," Google spokesman Chris Gaither told CNET today.

Since it first announced the change in January, Google has gotten heat for its plan to consolidate its numerous services under one privacy policy and combine information for each user across all its services. Several dozen state attorneys general asked Google last month why the firm doesn't give users the chance to opt out of the changes.

Meanwhile, several privacy groups are challenging the change, claiming it violates a privacy agreement Google reached to settle a complaint with the FTC over privacy issues related to Google Buzz. The opponents claim that increased advertising opportunities are the reason for the changes, but Google says the changes will allow it to provide a better experience for users.

Heavy criticism also is coming from the European Union. France's data protection authority, known as the Nationale de l'Informatique et des Libertes (CNIL), recently contacted Google executives about the change, saying several agencies across the Eurozone have serious concerns about the move.

"We have received the letter from the CNIL, and we will respond in due course. We are confident that our new simple, clear, and transparent privacy policy respects all European data protection laws and principles," Gaither said today. "It provides all the information required in Articles 10 and 11 of the directive, plus much additional information, and it follows the guidelines (PDF) published by the Article 29 Working Party in 2004."

Update, March 23, 10:35 a.m. PT: Google provided this statement after being served with the lawsuits:

We believe these cases are without merit, and we intend to defend them vigorously. Our updated Privacy Policy makes our privacy practices easier to understand, and it reflects our desire to create a seamless experience for our signed-in users. We undertook the most extensive notification effort in Google's history, and we're continuing to offer choice and control over how people use our services.

(A tip of the hat to IDG News Service)