Google must pay $425 million in class action over privacy, jury rules

A federal jury has ordered Alphabet's Google to pay $425 million for invading user privacy by continuing to collect data from millions who had disabled tracking features over an eight-year period. This verdict, stemming from a class action lawsuit, is significantly less than the $31 billion sought by plaintiffs, as the jury did not find malice, precluding punitive damages. The ruling highlights ongoing regulatory and legal scrutiny over Google's data collection practices, adding to its history of privacy-related settlements.

Analysis

A federal jury has ordered Alphabet's Google to pay $425 million for violating user privacy, a figure that is substantial but represents only a fraction of the over $31 billion sought by plaintiffs in the class-action lawsuit. The key mitigating factor for Alphabet is the jury's finding that Google did not act with malice, which precluded the award of punitive damages and contained the financial impact. This verdict, concerning the collection of data from 98 million users even when tracking was disabled, is not an isolated event but rather the latest in a series of significant privacy-related legal challenges. It follows a nearly $1.4 billion settlement with Texas and a separate agreement to destroy billions of data records from private browsing sessions. While Google maintained that the collected data was non-personal and pseudonymous, the liability verdict underscores a persistent legal and regulatory risk tied to its core data collection practices, suggesting that such defenses may not fully insulate the company from future litigation and financial penalties.

Key Decisions for Investors

• The $425 million penalty is financially immaterial for Alphabet and should be treated as a manageable cost of doing business, especially as the market may have been pricing in a much higher risk given the initial $31 billion claim.
• Investors must factor in the recurring nature of legal and regulatory actions related to data privacy as an ongoing operational risk that could lead to further fines and necessitate costly changes to Google's business practices.
• The absence of a 'malice' finding is a crucial positive detail, as it significantly limited the damages in this case and may temper the financial risk from similar future lawsuits, provided the company's actions are not deemed intentionally harmful.
• It is prudent to closely monitor the evolving regulatory landscape for data privacy, as new legislation could impose more restrictive and expensive compliance burdens on Google's core advertising and analytics services.