Australian Competition and Consumer Commission v Google LLC (No 2)
[2022] FCA 1476
•9 December 2022
FEDERAL COURT OF AUSTRALIA
Australian Competition and Consumer Commission v Google LLC (No 2) [2022] FCA 1476
File number: NSD 816 of 2020 Judgment of: YATES J Date of judgment: 9 December 2022 Catchwords: CONSUMER LAW – alleged contraventions of ss 18, 29, and 34 of the Australian Consumer Law (ACL) – where Google displayed a notification to Account Holders seeking their consent to various changes to the settings in their Google Accounts (Notification) – whether, by omission, Google’s conduct in asking for consent, through the medium of the Notification, was misleading or deceptive (or likely to mislead or deceive), or liable to mislead the public – whether Google failed to inform, or adequately inform, Account Holders that it was seeking their consent to: combine or associate their personal information with their activity on Third Party Websites and Apps; allow that information to be used to create or generate personalised advertisements for Google Partner Websites and Apps; and deliver those advertisements across both Google Services and Google Partner Websites and Apps on any device – where Google made a representation that it would not reduce an Account Holder’s rights under Google’s Privacy Policy without obtaining their explicit consent – where Google made a Privacy Update – whether it was necessary for Google to inform Account Holders that giving their consent to the proposed changes affected their privacy – whether Account Holders’ privacy rights were in fact reduced – where alleged contraventions of ss 18, 29, and 34 of the ACL not made out – originating application dismissed Legislation: Australian Consumer Law (Sch 2 to the Competition and Consumer Act 2010 (Cth)) ss 18, 18(1), 29(1)(g), 29(1)(m), 34
Evidence Act 1995 (Cth) s 191
Cases cited: Australian Competition and Consumer Commission v Coles Supermarkets Australia Pty Ltd (2014) 317 ALR 73
Australian Competition and Consumer Commission v Google LLC (No 2) [2021] FCA 367; 391 ALR 346
Australian Competition and Consumer Commission v LG Electronics Australia Pty Ltd [2017] FCA 1047
Australian Competition and Consumer Commission v TPG Internet Pty Ltd [2013] HCA 54; 250 CLR 640
Australian Competition and Consumer Commission v TPG Internet Pty Ltd [2020] FCAFC 130; 278 FCR 450
Butcher v LachlanElder Realty Pty Ltd [2004] HCA 60; 218 CLR 592
Campbell v Backoffice Investments Pty Ltd [2009] HCA 25; 238 CLR 304
Campomar Sociedad, Limitada v Nike International Limited [2000] HCA 12; 202 CLR 45
Parkdale Custom Built Furniture Pty Ltd v Puxu Pty Ltd [1982] HCA 44; 149 CLR 191
Taco Co of Australia Inc v Taco Bell Pty Limited (1982) 42 ALR 177
Division: General Division Registry: New South Wales National Practice Area: Commercial and Corporations Sub-area: Economic Regulator, Competition and Access Number of paragraphs: 291 Date of hearing: 29 November 2021 – 3 December 2021 Counsel for the Applicant: Ms K Morgan SC with Mr D Tynan and Ms A Garsia Solicitor for the Applicant: Norton Rose Fulbright Counsel for the Respondent: Dr R C A Higgins SC with Mr R Yezerski and Ms S Chordia Solicitor for the Respondent: Corrs Chambers Westgarth ORDERS
NSD 816 of 2020 BETWEEN: AUSTRALIAN COMPETITION AND CONSUMER COMMISSION
Applicant
AND: GOOGLE LLC
Respondent
ORDER MADE BY:
YATES J
DATE OF ORDER:
9 DECEMBER 2022
THE COURT ORDERS THAT:
1.The originating application be dismissed.
2.The applicant pay the respondent’s costs.
Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.
REASONS FOR JUDGMENT
INTRODUCTION
[1]
THE EVIDENCE
[12]
The scope of the evidence
[12]
Google’s objections to Associate Professor Payzan-LeNestour’s evidence
[26]
RELEVANT LEGAL PRINCIPLES
[41]
BACKGROUND
[52]
Google Accounts
[53]
Google’s Advertising Services
[56]
Relevant settings and the storage of information
[63]
The WAA and Ad Personalisation Settings
[64]
The SWAA Setting
[67]
The Chrome Sync Setting
[71]
Other collection and storage of information
[74]
Summary
[80]
CHANGES SOUGHT TO BE INTRODUCED BY NARNIA 2.0
[84]
THE NOTIFICATION
[89]
THE NOTIFICATION CONDUCT
[123]
THE GOOGLE DOCUMENTS
[134]
THE EXPERT EVIDENCE
[150]
Associate Professor Payzan-LeNestour’s first report
[150]
Behavioural science principles
[150]
Observations on the form and content of the Notification
[163]
The questions advanced for consideration
[164]
The first question
[165]
The second question
[177]
Professor List’s report
[186]
Associate Professor Payzan-LeNestour’s second report
[222]
The Joint Report
[225]
OBSERVATIONS ON THE EXPERT EVIDENCE
[227]
FINDINGS ON THE NOTIFICATION CONDUCT
[237]
THE NOTIFICATION REPRESENTATIONS
[257]
FINDING ON THE NOTIFICATION REPRESENTATIONS
[259]
GOOGLE’S PRIVACY POLICY
[260]
THE COMMISSION’S CASE BASED ON THE EXPLICIT CONSENT REPRESENTATION
[269]
FINDINGS IN RELATION TO THE EXPLICIT CONSENT REPRESENTATION
[271]
CONCLUSION
[291]
YATES J:
INTRODUCTION
The applicant, the Australian Competition and Consumer Commission (the Commission), alleges that the respondent, Google LLC (Google), contravened the Australian Consumer Law (the ACL) (Schedule 2 to the Competition and Consumer Act 2010 (Cth)) by:
(a)engaging in conduct that was misleading or deceptive, or likely to mislead or deceive, contrary to s 18 of the ACL;
(b)making false or misleading representations about the services it provided concerning the performance characteristics, uses, or benefits of those services, contrary to s 29(1)(g) of the ACL;
(c)making false or misleading representations about the services it provided in relation to the existence, exclusion or effect of a right, contrary to s 29(1)(m) of the ACL; and
(d)engaging in conduct that was liable to mislead the public as to the nature or characteristics of the services it provided, contrary to s 34 of the ACL.
The Commission seeks, amongst other relief, declarations, pecuniary penalties, redress and publication orders, and compliance orders.
The conduct in question is alleged to have occurred in the period between 28 June 2016 and at least 10 December 2018 (the relevant period) in connection with a global project which was known within Google as, variously, “Narnia 2.0”, “NS”, “N20” or, simply, “Narnia” (Narnia 2.0). In implementing the project, Google sought the permission of its account holders (Account Holders) to make changes to the settings in their Google Accounts which, if agreed to, authorised Google to:
(a)combine or associate Account Holders’ personal information with their activity on Third Party Websites and Third Party Apps, in addition to combining or associating Account Holders’ personal information with their activity on Google Services;
(b)allow that combined or associated information to be used to create or generate Account-based Advertising for Google Partner Websites and Google Partner Apps; and
(c)deliver Account-based Advertising to signed-in Account Holders on both Google Services and Google Partner Websites and Google Partner Apps on any of their devices.
In order to obtain permission to make these changes, Google displayed a notification on the desktop and mobile devices of its Account Holders who had signed-in to their Google Accounts and who had already enabled various settings in respect of those accounts (the Notification). The Notification appeared in different ways depending on the Account Holder’s device and the Google Service that was being used at the time. I will discuss the form and content of the Notification in greater detail below: [89] – [122].
The Commission’s case is that the Notification failed to inform, or adequately inform, Account Holders that Google was seeking consent to undertake the activities referred to above and that, according to the Commission, Google had made a change to its Privacy Policy (which I discuss below) (the Notification conduct).
The Commission alleges that, as a consequence, Google engaged in conduct that was misleading or deceptive, or likely to mislead or deceive (s 18(1)), and which was liable to mislead the public as to the nature or characteristics of Account Holders’ Google Accounts and Google Services (s 34).
The Commission also alleges that, by displaying the Notification, Google represented that it was only seeking the consent of Account Holders to “turn on” new features that would result in:
(a)more information being visible in Account Holders’ Google Accounts, making it easier to review and control that information; and
(b)Google using that information to make advertisements across the internet more relevant to Account Holders,
(the Notification Representations).
The Commission alleges that, as a consequence, Google made a false or misleading representation as to the performance characteristics, uses or benefits of Account Holders’ Google Accounts and Google Services (s 29(1)(g)), and engaged in conduct that was misleading or deceptive or likely to mislead or deceive (s 18(1)) or was liable to mislead the public as to the nature or characteristics of Account Holders’ Google Accounts and Google Services (s 34).
As to the changes to Google’s Privacy Policy, the Commission alleges that, in the face of an express statement that it would not reduce Account Holders’ rights under the policy without Account Holders’ explicit consent (the Explicit Consent Representation), Google did, in fact, reduce those rights in three ways.
The Commission alleges that, as a consequence, Google made a false or misleading representation as to the performance characteristics, uses or benefits of Account Holders’ Google Accounts and Google Services (s 29(1)(g)), and made a false or misleading representation concerning the existence, exclusion or effect of a right in relation to Account Holders’ Google Accounts and Google Services (s 29(1)(m)). The Commission also alleges that, as a consequence, Google engaged in conduct that was misleading or deceptive or likely to mislead or deceive (s 18(1)) and was liable to mislead the public as to the nature or characteristics of Account Holders’ Google Accounts and Google Services (s 34).
For the following reasons, I am not satisfied that the Commission has established that Google contravened the ACL as alleged.
THE EVIDENCE
The scope of the evidence
The evidence comprises a Statement of Agreed Facts dated 12 March 2021, prepared pursuant to s 191 of the Evidence Act 1995 (Cth) (the Evidence Act), and a number of documentary tenders. The Statement of Agreed Facts annexes a collection of screenshots depicting the various forms in which the Notification was given to Account Holders, Google’s Privacy Policy, and Google’s Terms of Service (the Screenshot Bundle). I have reproduced the Screenshot Bundle in Schedule A to these reasons.
Each party also called expert evidence. The Commission called Associate Professor Elise Payzan-LeNestour. Google called Professor John List.
Associate Professor Payzan-LeNestour is a behavioural scientist who undertook her PhD research at the Swiss Finance Institute at the École Polytechnique Fédérale de Lausanne in 2009 in Neurofinance. She completed the first part of her PhD at the London School of Economics.
Associate Professor Payzan-LeNestour commenced as a Senior Lecturer at the University of New South Wales (UNSW) in the School of Banking and Finance in 2010, and was promoted to the position of Associate Professor in 2018. She currently teaches in the Behavioural Finance course offered at undergraduate and Masters levels at the UNSW Business School.
As explained by Associate Professor Payzan-LeNestour, Neurofinance is a new kind of behavioural economics that consists of integrating insights from psychological research into economic science. She explained that, while standard behavioural economics focuses on describing how individuals behave, Neurofinance addresses the origins of observed behaviour at the neurobiological level.
Associate Professor Payzan-LeNestour also described Neurofinance as a subfield of Neuroeconomics, which involves “the application of insights from decision neuroscience to predict economic behaviour both at the individual and collective/aggregate levels”.
According to Associate Professor Payzan-LeNestour, her expertise in Neurofinance encompassed all that concerns individual decision-making under uncertainty: that is, how individuals acquire and process information to form an opinion when they have to decide under uncertainty, and how they make a decision on the basis of their opinion.
Associate Professor Payzan-LeNestour prepared two reports, dated 26 July 2021 (first report) and 3 September 2021 (second report) respectively. Her second report responded to a report prepared by Professor List.
Among other appointments, Professor List is the Kenneth C. Griffin Distinguished Service Professor in Economics at the University of Chicago and the Distinguished John Mitchell Professor of Economics in the Research School of Economics at Australian National University. He has a PhD in Economics. He is the recipient of a number of Honorary Doctorates. In addition to his academic responsibilities, Professor List is currently the Chief Economist at Lyft Inc. and a Senior Consultant at Compass Lexecon.
Professor List said that his research makes extensive use of behavioural economics and experimental economics to evaluate a wide variety of issues, including how individuals make decisions, the external validity of behavioural and experimental economic analysis, the valuation of environmental amenities, education outcomes, and charitable giving.
Professor List has received numerous awards for his scholarship, including being named in the “Top 25 Behavioural Economists” by TheBestSchool.org.
Professor List’s report is dated 9 August 2021. It responded to Associate Professor Payzan-LeNestour’s first report.
Associate Professor Payzan-LeNestour and Professor List prepared a Joint Expert Report. They gave their oral evidence concurrently.
No consumer evidence (from Account Holders) was called.
Google’s objections to Associate Professor Payzan-LeNestour’s evidence
At the commencement of the hearing, Google objected to the admissibility of Associate Professor Payzan-LeNestour’s reports and to her comments in the Joint Expert Report. Amongst other objections, Google raised a number of “global” objections.
One “global” objection was that the questions asked of Associate Professor Payzan-LeNestour (to which her first report was directed) sought an opinion that was not based, wholly or substantially, on her “specialised knowledge”, within the meaning of s 79 of the Evidence Act.
There were two aspects to this objection. The first aspect was that Associate Professor Payzan-LeNestour’s opinions were based on her own, non-expert reading of the Notification. The second aspect was that Associate Professor Payzan-LeNestour’s first report was directed, in part, to answering a particular question by reference to “the principles applying to information acquisition and processing in the context of navigating through screens on a desktop or mobile device”. Google submitted that Associate Professor Payzan-LeNestour had no specialised knowledge in relation to that particular matter, and had referred to no such principles in her reports.
This objection was made in the following context. On 15 September 2021, I made orders by consent that provided for the convening of a joint conference of experts to prepare a joint report identifying, in summary form, the principal areas of agreement between them, and the principal areas of disagreement between them (including the reasons for that disagreement). The joint report was also to identify whether, and in what respects, the experts’ respective opinions departed from the opinions they had expressed in their reports.
By the time these orders were made, Associate Professor Payzan-LeNestour’s two reports had been served. Professor List’s responding report had also been served. Significantly, at that time, Google had not raised any objection that the opinions expressed in Associate Professor Payzan-LeNestour’s two reports were not based wholly or substantially on her specialised knowledge.
Pursuant to the orders made on 15 September 2021, Associate Professor Payzan-LeNestour and Professor List met, online, on 5 October 2021 and 15 October 2021, and prepared the Joint Expert Report.
The first time that an objection to the admissibility of Associate Professor Payzan-LeNestour’s reports was raised with the Court was in Google’s written opening submissions dated 22 November 2021, five business days before the commencement of the final hearing.
Section 192A of the Evidence Act provides the facility for the Court to give a ruling on the admissibility of evidence, in advance of that evidence being adduced, should the Court consider it appropriate to do so. Google did not seek to use that facility, even though the basis for objecting to Associate Professor Payzan-LeNestour’s reports, on the ground that the opinions she expressed were not based wholly or substantially on specialised knowledge, must have been apparent to it relatively shortly after the service of Associate Professor Payzan-LeNestour’s first report in July 2021.
There is an oddity in objecting to the admissibility of opinion evidence, on the basis that the opinion is not wholly or substantially based on specialised knowledge, after the party objecting to the evidence has not only engaged, substantively, with the opinion by filing a responding expert’s report, but has also engaged with the opinion through participation, without objection, in a conference of experts directed to preparing a joint report of the kind sought by the orders made on 15 September 2021.
The objection that Associate Professor Payzan-LeNestour’s opinions were not based wholly or substantially on her specialised knowledge was not clear cut—although, as I explain in a later section of these reasons, I accept that her opinions proceeded from her own, non-expert reading of the Notification.
Google made other “global” objections to the admissibility of Associate Professor Payzan-LeNestour’s reports, including that, should the Court come to the view that Associate Professor Payzan-LeNestour had specialised knowledge relevant to the determination of the matters in issue in the proceeding, her opinions: (a) were not expressed in a manner which permitted the Court to be satisfied that they were based on that specialised knowledge; and (b) trespassed beyond the matters pleaded in the Amended Concise Statement. Once again, the basis for these objections would also have been apparent to Google relatively shortly after the service of Associate Professor Payzan-LeNestour’s first report in July 2021.
It is important to note that success on any of these objections would not have led, necessarily, to the rejection of Associate Professor Payzan-LeNestour’s reports, or her comments in the Joint Expert Report, in their entirety.
At the time when these objections were raised in opening, I expressed my concern that, in order to rule on them, it would be necessary for me to have a deep understanding of not only Associate Professor Payzan-LeNestour’s first report (which was complex), but also Professor List’s responding report, Associate Professor Payzan-LeNestour’s second report, and the Joint Expert Report. I was concerned that dealing with Google’s “global” objections at that time would be a significant undertaking that would adversely impact on the trial schedule. I suggested that the better course, in the present case, was to admit all the expert evidence, leaving it to the parties to address me in closing submissions on the weight I should give it.
Google expressed its concern that, if it acquiesced in that course, it might be taken as consenting to an “enlarged case” which, it contended, Associate Professor Payzan-LeNestour had addressed. In response, I made it clear that I would not countenance any suggestion that the case that Google was required to meet was something other than the case presented in the Amended Concise Statement.
In light of that indication, Google did not proceed with its objections. Associate Professor Payzan-LeNestour’s reports, and her comments in the Joint Expert Report, were admitted into evidence accordingly.
RELEVANT LEGAL PRINCIPLES
As the parties recognised, the present case does not involve any novel question of law. The relevant legal principles are well-settled. Nevertheless, the Commission called in aid the following uncontentious principles.
First, conduct will be misleading or deceptive if it induces or is capable of inducing error or has a tendency to lead into error: Australian Competition and Consumer Commission v TPG Internet Pty Ltd [2013] HCA 54; 250 CLR 640 (TPG) at [39].
Secondly, whether particular conduct is misleading or deceptive is a question of fact to be determined having regard to the context in which the conduct takes place and the surrounding facts and circumstances: Parkdale Custom Built Furniture Pty Ltd v Puxu Pty Ltd [1982] HCA 44; 149 CLR 191 (Puxu) at 198 – 199; Taco Co of Australia Inc v Taco Bell Pty Limited (1982) 42 ALR 177 at 202.
In this connection, the Commission submitted that the assessment of Google’s conduct should not be limited to the text of the Notification. Rather, regard should be had to all the surrounding facts and circumstances. The Commission submitted that this included Google’s business records which, the Commission submitted, revealed that the Notification was designed to maximise the number of people who clicked “I AGREE”. The Commission submitted that the Notification was not designed to maximise the number of people who understood the implications of agreeing to Notification. I observe, however, that no such allegation is made in the Amended Concise Statement.
Thirdly, the Commission submitted that half-truths may amount to misleading representations. In this connection, the Commission referred to the following passage in Australian Competition and Consumer Commission v LG Electronics Australia Pty Ltd [2017] FCA 1047 (LG Electronics) at [53]:
53It can readily be accepted that a half a truth may be worse than a blatant lie. A half-truth may beguile the receiver of the half-truth into a false sense that he or she is receiving the whole truth and nothing but the truth – and hence is under the understanding, and reasonable and legitimate expectation, that the person giving the information is presenting all the information necessary for the recipient to act accordingly.
Fourthly, the Commission submitted that the conduct in question must be considered by reference to the class of consumers likely to be affected by the conduct.
The Commission relied on the following passage from Australian Competition and Consumer Commission v TPG Internet Pty Ltd [2020] FCAFC 130; 278 FCR 450 at [22(e)]:
22The applicable principles concerning the statutory prohibition of misleading or deceptive conduct (and closely related prohibitions) in the ACL are well known and there was no dispute between the parties concerning those principles. The central question is whether the impugned conduct, viewed as a whole, has a sufficient tendency to lead a person exposed to the conduct into error (that is, to form an erroneous assumption or conclusion about some fact or matter): Taco Co of Australia Inc v Taco Bell Pty Ltd (1982) 42 ALR 177 (Taco Bell) at 200 per Deane and Fitzgerald JJ; Parkdale Custom Built Furniture Pty Ltd v Puxu Pty Ltd (1982) 149 CLR 191 (Puxu) at 198 per Gibbs CJ; Campomar Sociedad, Limitada v Nike International Ltd (2000) 202 CLR 45 (Campomar) at [98]; Australian Competition and Consumer Commission v TPG Internet Pty Ltd (2013) 250 CLR 640 (TPG Internet) at [39] per French CJ, Crennan, Bell and Keane JJ; Campbell at [25] per French CJ. A number of subsidiary principles, directed to the central question, have been developed:
…
(e)… where the impugned conduct is directed to the public generally or a section of the public, the question whether the conduct is likely to mislead or deceive has to be approached at a level of abstraction where the Court must consider the likely characteristics of the persons who comprise the relevant class to whom the conduct is directed and consider the likely effect of the conduct on ordinary or reasonable members of the class, disregarding reactions that might be regarded as extreme or fanciful: Campomar at [101]–[105]; Google at [7] per French CJ and Crennan and Kiefel JJ.
Fifthly, and relatedly, the Commission submitted that it is not necessary to approach the analysis of the conduct in question by isolating one hypothetical person within the class who had one response or reaction to the conduct to determine whether there has been a contravention: Australian Competition and Consumer Commission v Google LLC (No 2) [2021] FCA 367; 391 ALR 346 at [87] – [98].
In relation to s 18 of the ACL, Google also referred to the first and fourth principles noted above. In addition, it submitted that while conduct which has a tendency to lead a consumer into error might be misleading or deceptive or likely to mislead or deceive, the causing of confusion or questioning is insufficient: Australian Competition and Consumer Commission v Coles Supermarkets Australia Pty Ltd (2014) 317 ALR 73 at [39]. Further, it submitted that whether conduct is misleading or deceptive is a question of fact to be determined objectively. Google accepted that there was no need for the Commission to prove that any person was actually misled or deceived (Puxu at 199) or that Google acted with an intention to mislead or deceive (TPG at [56]).
Google submitted that, where conduct is directed to the public at large, or to a section of the public, rather than to identified individuals, the conduct in question should be tested against an ordinary or reasonable member of that class, disregarding assumptions by persons whose reactions are extreme or fanciful. The class does not include consumers who fail to take reasonable care of their own interests: Puxu at 199; Campomar Sociedad, Limitada v Nike International Limited [2000] HCA 12; 202 CLR 45 at [105].
Finally, Google submitted that, where the Court is concerned to ascertain the mental impression created by a number of representations conveyed by one communication, it is wrong to attempt to analyse the separate effect of each representation. Rather, the conduct must be viewed as a whole. Viewing isolated parts of the conduct “invites error”: Puxu at 199; Butcher v LachlanElder Realty Pty Ltd [2004] HCA 60; 218 CLR 592 at [109]; Campbell v Backoffice Investments Pty Ltd [2009] HCA 25; 238 CLR 304 at [102]; TPG at [52].
BACKGROUND
To appreciate the significance of the changes that Google sought to introduce by Narnia 2.0, it is necessary to understand the nature of the various services that Google provides; the settings presently relevant to the use of Google Accounts by signed-in Account Holders; the information in relation to Account Holders which, before the relevant period, Google was entitled to collect and store; and the information which, before the relevant period, Google was entitled to combine or associate with other information.
Google Accounts
To create an account with Google (a Google Account), a person is required to create a username and password and to provide personal information, such as the person’s name and date of birth. The person is prompted to provide additional personal information, such as the person’s gender and location. The person is also required to accept Google’s Terms of Service and Privacy Policy. The Account Holder’s personal information is then associated with that person’s Google Account.
Google supplies a range of services which include an internet search engine (Google Search); a mapping service (Google Maps); an email service (Gmail); an online video platform (YouTube); an online entertainment store (Google Play); and an internet web browser (Google Chrome) (together, Google Services).
Some Google Services, like Gmail and Google Play, require Account Holders to be signed-in to their Google Account to use the service. Other Google Services, such as YouTube and Google Maps, can be used without a Google Account, but may have reduced functionality if an Account Holder is not signed-in to their Google Account when using the service.
Google’s Advertising Services
Google provides online display advertising and analytics services to individuals and businesses. Google derives the majority of its revenue from these services.
Online display advertising services connect website and app publishers to advertisers for the purposes of utilising advertising space. The services match the criteria of advertisers with the criteria of the website or app publishers, so as to display advertisements that are likely to be of interest to the person viewing the website or app in question.
For present purposes, online display advertising may be classified as Pseudonymous Advertising or Account-based Advertising.
Pseudonymous Advertising is informed by the pseudonymous usage history of a particular browser on a particular computer or particular mobile device. The usage history is collected from the browser used on a computer via “cookies” or from the mobile device using equivalent technology.
Cookies are small pieces of text sent to a user’s browser by the website that is being visited. The cookies can be configured to record a unique identifier that helps a website remember information about a user’s visit using a particular browser and enables content or advertisements to be delivered (“served”) to users of that browser based on those visits. Cookies (and the equivalent technology on mobile devices and apps) do not require a Google Account to function.
Pseudonymous Advertising is tailored to an individual user only to a limited extent. It is informed only by the usage history of a particular browser on a particular computer or particular mobile device. There may be more than one user of the particular browser on the particular computer or the particular mobile device. Further, a person’s usage of their browser on, say, a work computer cannot inform the advertising served to that person on their home computer.
Account-based Advertising is informed by information that includes account activity (such as IP address, time/date, URL and advertisements served) stored in an Account Holder’s account. Once again, this information is recorded via cookies on browsers, or equivalent technology (in the case of mobile devices). Unlike Pseudonymous Advertising, Account-based Advertising serves advertisements regardless of the device used. For example, in relation to Google Accounts, Account-based Advertising on an Account Holder’s personal mobile phone or home computer may be informed by that person’s usage on their work computer or mobile phone, if that person is signed-in to their Google Account on all of those devices and has other relevant settings enabled.
Relevant settings and the storage of information
The following settings in respect of Account Holders’ Google Accounts are relevant to the present case:
(a)the WAA (Web and App Activity) Setting;
(b)the Ad Personalisation Setting;
(c)the Chrome Sync Setting; and
(d)the SWAA (Supplemental Web & App) Setting.
The WAA and Ad Personalisation Settings
The WAA Setting and the Ad Personalisation Setting are enabled by default during the sign-up process for a Google Account. When enabled, the WAA Setting permits Google to store, in association with the Account Holder’s Google Account, information about the activity of the signed-in Account Holder across Google Services, including:
(a)searches in Google Search;
(b)activity in Google Maps;
(c)activity in Google Play;
(d)articles read in Google News;
(e)commands given to Google Assistant and its response;
(f)any advertisements clicked on by the Account Holder; and
(g)data such as an Account Holder’s location, language and IP address.
When the Ad Personalisation Setting is also enabled, Google is permitted to deliver Account-based Advertising using that information to the signed-in Account Holder across Google Services.
This was the position both before and after 28 June 2016. It is important to note that, both before and after 28 June 2016, Account Holders could access, manage, and therefore change, their WAA Setting and Ad Personalisation Setting.
The SWAA Setting
The SWAA Setting can only be enabled if the WAA setting is enabled.
If enabled, the SWAA Setting permits Google to associate with the Account Holder’s Google Account, information that includes: (a) certain app data from Android devices on which the Account Holder is signed-in (such as, whether the Account Holder has viewed multiple pages or sections of an app); and (b) the Account Holder’s Chrome internet browsing history (if the Chrome Sync Setting is enabled and the Account Holder has chosen to “sync” that person’s Chrome internet browsing history, as to which see [71] – [73] below).
This was the position both before and after 28 June 2016. Once again, it is important to note that, both before and after 28 June 2016, Account Holders could access, manage, and therefore change, their SWAA Setting.
Prior to 28 June 2016, information stored because the SWAA Setting was enabled (excluding information collected via the Google Mobile Ads SDK), was not used by Google to serve Account-based Advertising on Google Partner Websites and Google Partner Apps. However, I infer that this information could be used to serve Pseudonymous Advertising on Google Partner Websites and Google Partner Apps.
The Chrome Sync Setting
The Chrome Sync Setting enables Account Holders to choose whether Google can associate various aspects of their use of the Chrome internet browser with their Google Accounts, including their Chrome internet browsing history and other “synced” information (for example, bookmarks, passwords, and other settings on the their devices).
This was the position both before and after 28 June 2016.
During the relevant period, information stored because Chrome Sync was enabled was not used by Google to serve either Pseudonymous Advertising or Account-based Advertising on Google Partner Websites or Google Partner Apps. I infer it could, however, be used to serve advertisements to Account Holders on Google Services.
Other collection and storage of information
If websites elect to use Google advertising cookie technology, Google collects information (as Account Holders’ browser settings permit) about users’ and Account Holders’ internet browsing activities on Google Partner Websites via cookies set in the doubleclick.net web domain. This information is stored on a pseudonymous basis in association with an identifier unique to a user’s browser.
This was the position both before and after 28 June 2016.
If apps elect to use Google Mobile Advertising technology, Google collects information (as Account Holders’ browser settings permit) about users’ and Account Holders’ activities on third-party mobile device-based apps (such as in-app purchases, and views and interactions with in-app advertisements) using the Google Mobile Ads SDK (software development kit).
Before 28 June 2016, information collected using the Google Mobile Ads SDK was stored by Google on a pseudonymous basis in association with an identifier unique to the mobile device used, and was used by Google to deliver Pseudonymous Advertising on Google Partner Apps subsequently accessed using that mobile device. The information was not stored by Google in association with Account Holders’ Google Accounts (or any other personal information) without their consent, and was not used to serve Account-based Advertising.
This remained the position after 28 June 2016 if Account Holders did not turn on the “new features” in response to the Notification.
Prior to 28 June 2016, Google did not combine the information it collected about Account Holders’ activities on Third Party Websites and Third Party Apps with personal information in Account Holders’ Google Accounts, unless Account Holders enabled and permitted Google to do so by means of the Chrome Sync Setting and/or the SWAA Setting.
Summary
Before 28 June 2016, if the WAA and Ad Personalisation Settings were enabled (as they were by default), Google was permitted to serve Account-based Advertising to Account Holders across Google Services using information based on their activity on Google Services.
In addition, if the SWAA Setting was enabled, prior to 28 June 2016, Google was permitted to associate supplementary information with Account Holders’ Google Accounts, which included certain app data and, if the Chrome Sync Setting was enabled and Account Holders had chosen to “sync” data, certain other data including their Chrome internet browsing history, to serve advertisements to them on Google Services.
Further, information collected by Google using the Google Mobile Ads SDK was stored by Google on a pseudonymous basis. This information was used by Google to serve Pseudonymous Advertising on Google Partner Apps subsequently accessed using the mobile device.
Therefore, before 28 June 2016, the only place where Account-based Advertising was served was on Google Services.
CHANGES SOUGHT TO BE INTRODUCED BY NARNIA 2.0
An internal Google document dated 18 July 2016 described the key goals of Narnia 2.0 as including:
• Holistic identity - Unifying our view of users’ cross-device identity and data across Google’s advertising and consumer products around GAIA. For display ads, we will enable GAIA-Keyed Serving (GKS) for millions of third party properties where Google’s display systems serves ads (e.g. NYTimes, BBC, Farmville, Weather.com’s app etc.).
• Informed consent - Obtaining users’ opt-in consent to unify Display Ads and Google identity per Google’s privacy policy. This consent is the legal and privacy foundation for GAIA-keyed serving, making it the lynchpin of Narnia 2. We get informed consent as part of the new account sign-up process, and via the “consent bump” for existing accounts.
• Better controls - Improving transparency and control for users over how Google uses their data across all their devices. With a signed-in experience, we can be much more transparent sharing user activity and exposing detailed controls. Without signed-in, we never know if a machine is shared. And these controls work only on a single browser or mobile device.
• Improved ad offerings - Building better ads products. Since significant user data at Google is GAIA-keyed data, leveraging this data for display ads will provide opportunities for improved personalization. Moreover, new ads capabilities, such as click-to-buy ads that connect to a user’s Google account, become possible in a GAIA-keyed system. Note: Our Moment of Consent (MOC) launch includes no substantial changes to our ad offerings -- these will come later.
The fundamental change introduced by Narnia 2.0, with the Account Holder’s explicit consent, was to expand the use of Account-based Advertising to Google Partner Websites and Google Partner Apps, taking into consideration information about the Account Holder’s activity on Third Party Websites and Third Party Apps stored by Google in association with personal information in the Account Holder’s Google Account.
Specifically, if the Account Holder agreed to the proposed changes, the WAA Setting and the Ad Personalisation Setting were enabled to permit Google to serve Account-based Advertising using the information described at [64] above (i.e., information about the activity of a signed-in Account Holder across Google Services) across Google Partner Websites and Google Partner Apps as well as across Google Services.
Further, the SWAA Setting (which sat below the WAA Setting) was enabled to permit Google to associate, with the Account Holder’s Google Account, information from Third Party Websites visited when the Account Holder was signed-in to their Google Account, as well as the information referred to at [64] above. From 28 June 2016, this information also included information collected via the Google Mobile Ads SDK. The information stored (because the SWAA Setting was enabled) could be used by Google to serve Account-based Advertising on Google Partner Websites and Google Partner Apps.
For new Account Holders (i.e., persons who signed up for a Google Account from 28 June 2016), these changes were enabled by default. The present case, however, is only concerned with the position of those persons who were Account Holders as at 28 June 2016.
THE NOTIFICATION
As I have said, the Notification appeared in different ways, depending on the Account Holder’s device and the Google Service they were using at the time.
The Screenshot Bundle shows the various forms in which the Notification was given to an existing Account Holder:
(a)using a web browser on a desktop device or web browser on a mobile device (screens A.1 – A.4 were the screens shown to signed-in Account Holders and screens A.5 – A.17 were the screens shown to Account Holders once signed-in);
(b)during the sign-in process on a non-Android mobile device (screens B.1 – B.6);
(c)during the sign-in process on an Android mobile device (screens C.1 – C.8); and
(d)on an Android mobile device as an Operating System notification (screens D.1 – D.22).
The parties advanced screens D.2 – D.5 as representative of the “main body” of the Notification (i.e., that part of the Notification that appeared to Account Holders without the Account Holder clicking additional links). Although four screens are depicted, screens D.2 – D.5 represent, in fact, one page through which Account Holders were required to scroll. This appears to have been the inevitable consequence of limited screen real estate. This page was referred to by the parties and expert witnesses as page 1 of the Notification:
Page 1 of the Notification commences with the heading “Some new features for your Google Account” (screen D.2). Icons for the Google Services are depicted above the heading.
The text proceeds by referring to the fact that there are some new features for the Account Holder’s Google Account that are “optional” features. The text conveys that the optional features concern how Google collects and uses data, and the control which the Account Holder has in respect of that data. The text also conveys that this relates to advertisements that Google shows to the Account Holder.
The question is posed: “What changes if you turn on these new features?” The use of the word “if” reiterates that the new features are optional for the Account Holder. As the Account Holder scrolls down page 1, the question is answered by reference to the numbered headings depicted in screens D.3 and D.4 and the text appearing under those headings.
The first numbered heading (screen D.3) refers to the fact that, if the Account Holder turns on the new features, more information will be available in the Account Holder’s account which, it is said, will make it easier for the Account Holder to review and control. The reference to the availability of “more” information in the Account Holder’s Google account is then explained.
In this connection, the Account Holder is told that, when they use Google Services, data is generated and that this data can be found and controlled by the Account Holder using the WAA Setting. Importantly, however, the Account Holder is also told that, “with this change”—clearly a reference to the change for which Google was seeking consent—other data may be included, namely the Account Holder’s browsing data from Chrome and data from their activity on websites and apps that partner with Google, including those that show ads from Google. It is important to note that, here, Google is addressing the Account Holder personally and referring to the Account Holder’s personal activity, not someone else’s browsing activity.
The diagram under the first numbered heading shows data from the Account Holder’s browsing activity on a mobile phone, tablet device, and a computer going into the Account Holder’s Google Account. The Account Holder’s Google Account is represented by some of the icons that depict Google Services, as well as the Google Account Holder icon (or “avatar”) itself.
The second numbered heading (screen D.4) tells the Account Holder that “this information” (obviously meaning all the information collected by Google as discussed in relation to the first numbered heading) will be used by Google to “make ads across the web more relevant for you [the Account Holder]”.
As to this, the Account Holder is told that the Ad Personalisation Setting “currently” allows Google to use data in the Account Holder’s account to tailor ads that appear in Google “products”. This is a reference (although not by name) to the Account-based Advertising served by Google when the Account Holder is using Google Services.
Importantly, however, the Account Holder is told that, “with this change” the Ad Personalisation Setting will allow Google to use the data in the Account Holder’s Google Account to tailor advertisements on websites and apps that partner with Google. In other words, if the Account Holder turns on the new features, all the data that would then be available in the Account Holder’s Google Account will also be used in this way.
The diagram under the second numbered heading shows the expanded data in the Account Holder’s Google Account serving advertisements to a mobile phone and a computer (representing the Account Holder’s signed-in devices).
The Account Holder is also told that these settings will apply across all of their signed-in devices, but that “you [the Account Holder] can change them [the settings] at any time” (screens D.4 and D.5).
Then, the question is posed: “What’s still the same?” The Account Holder is told that the practice of their personal information not being sold to anyone, and their ability to control the types of information Google collects and uses, will remain the same.
Finally, the Account Holder is told to choose the “I AGREE” button to turn on the new features or to click the “MORE OPTIONS” button for “more choices and information”.
I have used screens D.2 – D.5 as the starting point for my analysis of the Notification. It is appropriate that I record the following further facts concerning the form and structure of the Notification in the various forms in which it was provided to Account Holders.
Signed-in Account Holders using a web browser on a desktop or web browser on a mobile device received an alert shown in screens A.1 – A.3 of the Screenshot Bundle. If Account Holders chose “Learn More”, they were shown the Notification in screens A.5 and A.6. However, Account Holders did not have to choose “Learn More”. Account Holders could navigate away from the alert.
Account Holders with a non-Android device were shown the Notification in screens B.3 – B.5 during the sign-in process to their Google Accounts.
Account Holders with a mobile device using the Android Operating System (Android device) were shown the Notification in screens C.4 – C.6 during the sign-in process to their Google Account.
Account Holders with an Android device may have been alerted to the Notification with an Android Operating System prompt shown in screen D.1 of the Screenshot Bundle. If Account Holders tapped on the prompt, they were shown the Notification set out in screens D.2 – D.5 (for Account Holders who had not enabled the Chrome Sync Setting) or screens D.6 – D.9 (for Account Holders who had enabled the Chrome Sync Setting).
If Account Holders selected “MORE OPTIONS”—as shown in screen A.6 (for Account Holders using a web browser on a desktop or a web browser on a mobile device (including a non-Android device)), screen D.5 (for Account Holders using an Android device who had not enabled Chrome Sync and saw the Notification as an Operating System notification), and screen D.9 (for Account Holders using an Android device who had enabled Chrome Sync and saw the Notification as an Operating System notification)—they were shown a new page titled “Choose what’s right for you”, which contained a link titled “Learn more about these features”.
For Account Holders:
(a)who were using a web browser on a desktop or mobile device (including a non-Android device), this was shown in screen A.7; or
(b)who were using an Android device, this was shown in screen D.10.
Account Holders who were shown the Notification in the form of screens B.3 – B.5 (i.e. the Notification shown to existing Account Holders during the sign-in process on a non-Android device) and screens C.4 – C.6 (i.e. the Notification shown to existing Account Holders during the sign-in process on an Android device), were given the option to select “Ask me later” (rather than “MORE OPTIONS”).
If Account Holders selected “Learn more about these features”, as contained in screen A.7 (for Account Holders who were using a web browser on a desktop or web browser on a mobile device (including a non-Android device)), and screen D.10 (for Account Holders using an Android device and who saw the Notification as an Operating System notification), they were shown a new webpage titled “More about these new features”, which provided them with links to obtain additional information.
For Account Holders:
(a)using a web browser on a desktop or web browser on a mobile device (including a non-Android device), this was shown in screen A.11; and
(b)using an Android device, this was shown in screen D.14.
After reviewing the “Choose what’s right for you” page, on screen A.7 (for Account Holders using a web browser on a desktop or web browser on a mobile device (including a non-Android device)) and screen D.10 (for Account Holders using an Android device and who saw the Notification as an Operating System notification), Account Holders could select “BACK” to return to the Notification, as displayed on screen A.5 (shown to Account Holders once signed-in), screen D.2 (if the Account holder had not enabled Chrome Sync), or screen D.6 (if the Account Holder had enabled Chrome Sync), or they could select one of the three options listed and click “Done” or “Continue”.
Account Holders selecting one of the three options on the “Choose what’s right for you” page:
(a)using a web browser on a desktop or web browser on a mobile device (including a non-Android device), were shown screens A.8 – A.10;
(b)using an Android device were shown screens D.11 – D.13.
Similarly, if Account Holders clicked on “Learn more” (which appeared before “about these features” and under the subheading “2. Google will use this information to make ads across the web more relevant for you”) in screen A.6 (for Account Holders who were using a web browser on a desktop or web browser on a mobile device (including a non-Android device)), screen B.4 (for Account Holders using a non-Android device and who were shown the Notification during the sign-in process), screen C.6 (for Account Holders using an Android device and who were shown the Notification during the sign-in process), screen D.5 (for Account Holders using an Android device who had not enabled Chrome Sync and who saw the Notification as an Operating System notification), and screen D.9 (for Account Holders using an Android device who enabled Chrome Sync and who saw the Notification as an Operating System notification), they were shown the webpage titled “More about these new features”.
For Account Holders:
(a)using a web browser on a desktop or web browser on a mobile device (including a non-Android device), this was shown in screen A.11;
(b)using a non-Android device who had enabled Chrome Sync, this was shown in screen B.6 (Account Holders using a non-Android device who had not enabled Chrome Sync, were shown a screen similar to B.6 that did not include the drop-down heading titled “How does this change affect your synced Chrome browsing history?”); and
(c)using an Android device who had enabled Chrome Sync, this was shown in screens C.8 and D.14 (Account Holders using an Android device who had not enabled Chrome Sync, were shown a screen similar to C.8 and D.14 that did not include the drop-down heading titled “How does this change affect your synced Chrome browsing history?”).
If Account Holders selected “I AGREE” to the Notification, changes were made to their settings that permitted Google to combine the information it collected about their activity on Third Party Websites and Third Party Apps with their personal information. These changes included:
(a)the SWAA Setting being enabled or the functionality of the SWAA Setting being expanded (if the Account Holder had already enabled the SWAA Setting); and
(b)a new feature of the Ad Personalisation Setting (i.e. a checkbox labelled “Also use your activity & information from Google services to personalize ads on websites and apps that partner with Google to show ads”) being enabled that permitted Google to serve Account-based Advertising on Google Partner Websites and Google Partner Apps to the Account Holder.
In relation to Account Holders who clicked “I Agree” or “Yes, I’m in – turn on these new features” and “Done” to accept the new features, Google considered itself authorised to:
(a)combine or associate Account Holders’ personal information with their activity on Third Party Websites and Third Party Apps, in addition to combining or associating their personal information with their activity on Google Services; and
(b)allow that combined or associated information to be used to create or generate Account-based Advertising for Google Partner Websites and Google Partner Apps; and
(c)deliver Account-based Advertising to signed-in Account Holders on both Google Services and Google Partner Websites and Google Partner Apps on any of their devices.
An internal Google document makes clear what Google was trying to convey to Account Holders by the Notification:
We’re trying to emphasize a couple key points that we really want the user to understand.
⸰First, that a user’s activity information on 3rd party sites and apps will now be associated with their account and not, say, a browser cookie or mobile identifier.
⸰And second, that their account information, including this “web traversal” or “app traversal” data, will be used to improve the ads the user sees on 3rd party sites and apps.
As Senior Counsel for the Commission put the matter in closing submissions (with reference to this document):
The debate between us is that we say the [N]otification did not actually tell users that that was what was happening.
THE NOTIFICATION CONDUCT
The Commission’s case on the Notification has two aspects—the Notification Conduct and the Notification Representations.
The case with respect to the Notification Conduct is advanced in the Commission’s Amended Concise Statement as one of omission:
26 In relation to Account Holders who clicked “I Agree” or “Yes, I’m in – turn on these new features” and “Done” to accept the ‘new features’ (Turned on the New Features), Google considered itself authorised to:
(a) combine or associate the Account Holder’s personal information with their activity on Third Party Websites and Apps, in addition to combining or associating the Account Holder’s personal information with their activity on Google Services;
(b) allow that combined or associated information to be used to create or generate personalised advertisements for Google Partner Websites and Apps; and
(c) deliver those advertisements to signed in Account Holders on both Google Services and Google Partner Websites and Apps on any device.
27 By the Notification, Google failed to inform, or adequately inform, Account Holders that:
(a) Google had made the June 2016 Privacy Update to the Privacy Policy; and
(b) Google was seeking the Account Holder’s consent to be able to undertake the matters set out in paragraph 26 above,
(the Notification Conduct).
The Commission contends that Google’s conduct, in publishing the Notification, was misleading or deceptive in that it had the tendency to lead to a reasonable and legitimate expectation or understanding by Account Holders that the information being presented about the positive changes to their access to the data that Google was collecting, was all the information that was necessary for them to consider.
In opening its case, the Commission advanced five principal submissions in support of this contention.
First, the Commission submitted that the Notification did not say that Google would now combine the personal information in Account Holders’ Google Accounts with information about their activities on Third Party Websites and Third Party Apps. The Commission submitted that, although Account Holders were told that “more information will be available in your Google Account, making it easier for you to review and control” and that “Google would use this information to make ads across the web more relevant for you” (see, for example, screens D.3 and D.4), Google did not explain that the additional data it would be collecting would be data about the Account Holder’s activity on Third Party Websites and Third Party Apps. The Commission also submitted that Google did not explain that it could serve more targeted advertisements because it was collecting that information and combining it with the Account Holder’s personal information.
Secondly, the Commission submitted that the “new features” to which the Notification referred (see, for example, screen D.2) were described “beneficially to the Account Holder”. The Commission submitted that, by framing the Account Holder’s choice in this way, Google suggested that the changes were for the sole benefit of the Account Holder, such that adopting the changes would enhance the Account Holder’s use of Google without any cost or effect on the Account Holder more specifically. The Commission did not expand on what the other “cost or effect” was beyond the fact that Google would be using the combined information to show the Account Holder “more relevant ads”. The significance of this submission to the case articulated in the Amended Concise Statement is not apparent.
Thirdly, and relatedly, the Commission submitted that the language used to describe the detail of the first feature (“more information will be available in your Google Account, making it easier for you to review and control”) would have left Account Holders with the impression that the change was about the Account Holder’s access to information and data that Google was already collecting, and not that Google was collecting and combining additional information and data. In other words, the Notification did not indicate that the “more information” was information that Google had not previously associated with the Account Holder’s Google Account. Rather, the suggestion was that this was information that had not previously been available to the Account Holder to review.
Fourthly, the Commission submitted that, to the extent that Google informed Account Holders that their activities on other sites and apps would be associated with their personal information, it was only framed as beneficial for the second feature, namely “in order to improve Google’s services and the ads delivered by Google”. Once again, the Commission did not expand on this submission. Its significance to the case articulated in the Amended Concise Statement is not apparent.
Fifthly, the Commission submitted that the Notification did not inform Account Holders that there was a change to Google’s Privacy Policy. As I have noted, there is no dispute about this fact. There is, however, a dispute as to the effect of the June 2016 Privacy Update—a matter to which I will return.
It is important to understand that Google had told existing Account Holders that it would not reduce their rights under the Privacy Policy without their explicit consent. Google did not say that it would not alter the text of its Privacy Policy without the Account Holders’ explicit consent. Google’s internal documents show that it considered the change in text introduced by the June 2016 Privacy Update to be a minor change associated with the explicit consent it was simultaneously seeking from Account Holders to implement the proposed changes referred to in the Notification.
Although the text of Google’s Privacy Policy changed, I accept Google’s submission that the change of text made by the June 2016 Privacy Update did not mean that Google reduced its existing Account Holders’ rights under the Privacy Policy. Once again, it was not the change in text that permitted Google to combine information it collected about the activity of Account Holders on Third Party Websites and Third Party Apps with the personal information in their Google Accounts. Rather, Google’s permission to combine information was provided only by obtaining Account Holders’ explicit, opt-in consent through the Notification. The change in the text in the June 2016 Privacy Update (which I have quoted at [267]) was no more than a reflection of whether or not Google had obtained that consent.
I now turn to paragraph 31(a) of the Amended Concise Statement. The allegation here is that Google deleted the DoubleClick Statement in the June 2016 Privacy Update without obtaining the explicit consent of Account Holders and, as a consequence, reduced Account Holders’ rights under the Privacy Policy, contrary to the Explicit Consent Representation.
In order to analyse this allegation it is necessary to bear in mind (as I have discussed above) that, if websites elect to use Google advertising “cookie” technology, Google collects information (as Account Holders’ browser settings permit) about users’ and Account Holders’ internet browsing activities on Google Partner Websites via cookies set in the doubleclick.net web domain. This information is stored on a pseudonymous basis in association with an identifier unique to a user’s browser and can be used for Pseudonymous Advertising. This was the position before 28 June 2016. It remained (and remains) the position after 28 June 2016.
I am not persuaded that, by deleting the DoubleClick Statement and replacing it with the text of the June 2016 Privacy Update (as quoted at [267] and as shown on screen E.7), Google reduced Account Holders’ rights under the Privacy Policy without their explicit consent.
It is important to return to the text quoted at [267] above. Google’s statement—“your activity on other sites and apps may be associated with your personal information to improve Google’s services and the ads delivered by Google”—uses language that is technologically neutral. It is not limited to personal information obtained from the use of DoubleClick cookies. It extends to personal information obtained from cookies and other technologies: see screens E.2 – E.5 (especially screen E.5) which is that section of the Privacy Policy dealing with “Information we collect”.
However, significantly, this statement is prefaced by: “Depending on your account settings …”. These words recognise that Account Holders have the decisional freedom to choose, through their account settings, the information that Google can combine. It is not a matter for Google, but for Account Holders, to decide what those settings should be. Implicit in that decisional freedom is the notion of Account Holder consent. And, if given, that consent will, necessarily, be explicit consent given that, under the June 2016 Privacy Update, it is Account Holders who change and manage those settings, not Google.
As Google put it in opening submissions:
The revised Privacy Policy expressly contemplates that Account Holders have the right to prevent Google from associating information about Account Holders’ activity on Third Party Websites and Apps (which necessarily encompasses information of the kind collected and stored via DoubleClick cookies) with their personal information through their settings. That is, the very protection afforded by the DoubleClick Statement was both preserved (in respect of DoubleClick cookies) and expanded (in relation to activity on Third Party Websites and Apps captured through technologies other than DoubleClick cookies).
I accept that submission.
Therefore, although the text of Google’s Privacy Policy changed, its effect both before and after the June 2016 Privacy Update was that Google could not combine DoubleClick cookie information with personally identifiable information without Account Holders’ opt-in consent. Once again, the revised wording in the June 2016 Privacy Update, as quoted at [267] above, was no more than a reflection of the fact that Account Holders either consented to, or did not consent to, the proposed changes explained in the Notification, which included associating Account Holders’ activity on Third Party Websites and Third Party Apps with the personal information in their Google Accounts.
I do not accept, therefore, that, by deleting the DoubleClick Statement in the June 2016 Privacy Update, Google reduced Account Holders’ rights under the Privacy Policy.
In any event, the evidence is that, regardless of the consents obtained through the Notification, Google has not combined DoubleClick cookie information with Account Holders’ personally identifiable information in their Google Accounts. To be clear, the evidence is that, before the June 2016 Privacy Update, Google did not associate DoubleClick cookie information with personally identifiable information in Account Holders’ Google Accounts. This remained (and remains) the position after the June 2016 Privacy Update. There has been no change in Google’s practice in that regard. Thus, the Commission’s factual proposition that Google has reduced Account Holders’ privacy rights as a consequence of deleting the DoubleClick Statement is not made out in the evidence.
CONCLUSION
I am not satisfied that the Commission has established that Google contravened the ACL as alleged. It follows that the originating application must be dismissed. The Commission is to pay Google’s costs.
I certify that the preceding two hundred and ninety-one (291) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Yates. Associate:
Dated: 9 December 2022
SCHEDULE A
0
10
2