Google has been ordered by a US federal court to pay $425 million for breaching users’ privacy by collecting data from millions of users who had disabled a tracking feature in their accounts.

The ruling, delivered in San Francisco on Wednesday, follows a class-action lawsuit filed in July 2020 on behalf of approximately 98 million Google users and 174 million devices.

The plaintiffs alleged that Google unlawfully accessed their devices and data, including app activity data on mobile devices, in violation of privacy assurances under the tech giant’s Web & App Activity setting. The lawsuit claimed Google continued to collect, store, and use data related to user activity on non-Google apps that incorporated Google software codes, even after users had switched off the tracking feature.

The jury found Google liable for two out of three claims of privacy violations but did not find that the company had acted with malice, so no punitive damages were awarded. Users had initially sought damages of more than $31 billion. At trial, Google argued that the collected data was “nonpersonal, pseudonymous, and stored in segregated, secured, and encrypted locations,” and not associated with individual users’ identities or Google accounts.

A Google spokesperson said the company would appeal, stating: “This decision misunderstands how our products work. Our privacy tools give people control over their data, and when they turn off personalisation, we honour that choice.”

The verdict comes amid heightened regulatory scrutiny of Google’s data practices. Earlier this week, Google avoided a forced breakup after a Washington, DC judge ruled that the search giant may keep both its Chrome browser and Android mobile software, though it must loosen distribution contracts and share key search data with rivals.

The court barred Google from striking exclusive deals to set its services as the default on devices but allowed non-exclusive agreements, such as those with Apple for preferential placement.

Google continues to face a series of privacy-related lawsuits globally, including a $1.4 billion settlement with Texas over alleged violations of the state’s privacy laws and a recent agreement to destroy billions of data records relating to users’ private browsing activities.

---