Google in Court for Tracking UK iPhone Users

Google is being sued for up to £3.2bn for allegedly covertly tracking and collating the personal information of 4.4 million iPhone users in the UK. The action has been brought by campaign group Google You Owe Us (“GYOU”), led by Richard Lloyd, former director of consumer group Which? in the High Court, with a preliminary hearing having taken place on Monday 21 May 2018.

How did Google track users?

GYOU told the Court that, between August 2011 and February 2012, Google circumvented default privacy settings in Apple’s Safari web browser (the “Workaround”) to track users’ browsing habits. The Workaround was the mischief underlying the landmark 2015 Court of Appeal case Vidal-Hall v. Google Inc. It involved placing code onto an iPhone to bypass the block on third-party cookies. (Read more about third-party cookies on this IP Harbour post.) Google then planted a cookie which relayed information back to them as it followed the user around the web.

Much like a spy sending messages home from abroad, the cookie relayed what websites the user was visiting and when, betraying their personality in the process. By duping Safari’s security settings, Google gathered information relating to the user’s race, physical and mental health, political leanings, sexuality, social class, financial, shopping habits and location– private information which was misused in Vidal-Hall.

They used this information to divide users up into advertisement categories such as “football lovers” and “current affairs enthusiasts”. At the time, this was good business. In Vidal-Hall, the Court heard that 96% of Google’s revenue was generated by advertisement, totalling $36.5bn. Key to this is their “DoubleClick Service” which helps advertisers target iPhone users based on their preferences. The Court of Appeal “inferred that the Defendant makes an annual profit of billions of dollars from the DoubleClick service.”

The Action

GYOU filed their claim in July 2017, just weeks within the six-year limitation period. To continue with the action, they must show that every member, including Mr Lloyd, has the “same interest in the claim.” Google argues that each member has different interests because they each suffered different loss. Although this principle hasn’t been fully tested, the Court of Appeal in the 2010 case Emerald Supplies v. British Airways held that, for similarity of interest, it is sufficient that the damages claimed are equally beneficial to all.

Richard Lloyd says “everyone was affected in the same fundamental way in that their data rights were breached” and as such GYOU are claiming damages for distress, not monetary loss, to the tune of £727 per person.

These damages, totalling £3.2bn are based on Apple’s own calculations and come within the limit of £750 (per person) set by the Court of Appeal in the 2013 case Halliday v. Creation Consumer Finance Ltd. Therefore, it would seem GYOU can satisfy the test of equal benefit set out in Emerald Supplies v. British Airways and that each member has the same interest in the claim.

Who’s funding the Action?

In the UK, it’s normal for the losing party to pay the winner’s costs. When this principle is coupled with the vast asymmetries in power and resources typical to these kind of disputes, it can be difficult for consumers to enforce their rights in court– the risk is simply too high. This risk can be mitigated or eliminated by “third party funders” who cover the costs of litigation in return for a portion of any damages won and if the claim is unsuccessful, the third party will pay the winner’s costs and recoup that money from an insurer.

GYOU’s action is funded by Therium Litigation Funding IC. A founder member of the Association of Litigation Funders of England and Wales, they have funded a 45,000-strong group claim against Volkswagen over the emissions scandal; a shareholder group claim against Lloyds Banking Group over the HBOS acquisition in 2008; the Road Haulage Association’s cartel action against truck manufacturers; and a group claim against Visa and Mastercard.

What next?

Representative actions will likely shape data protection litigation from now on, for three reasons:

• First, is the increased readiness of the courts to award damages for distress, following Halliday and Vidal-Hall.
• Second, it was said in Halliday that breaking European law was sufficient to merit damages for distress. This is more likely now that the GDPR is in force.
• Finally, the rise of third party funding means data subjects will be able to litigate against digital behemoths to enforce their rights.

In the United States, Google have already paid out over this issue. In 2012, they were fined $22.5 million by the Federal Trade Commission and a year later paid out $17m to numerous states, following suit.

If the High Court decide to proceed with the case, Google may face more payouts in the UK. In any case, they will no doubt be pleased that the limitation period has now expired in the UK for claims based on the Workaround, allowing them to draw a line under what has been an expensive and embarrassing issue.

Originally published at ipharbour.com on June 17, 2018.