Affirmative Defense of Consent Leads to 23(b)(3) Class Certification Denial in Google Ad Bidding Privacy Litigation

A district court judge in the Northern District of California recently denied class certification in a putative privacy class action against Google and its Real Time Bidding ("RTB") advertising system. Plaintiffs moved to certify both damages and injunctive relief classes based on allegations that Google shared personal information through its RTB system. The court denied with prejudice certification under Rule 23(b)(3), finding that individual questions about class member's past consent to-and subjective understanding of-Google's disclosures would predominate. The district court also denied the proposed injunctive relief class on the grounds that the proposed class definition was "fail-safe" and that plaintiffs had not met their burden to prove that their data was representative of the proposed class, but the court did so with leave to amend and requested further briefing. Plaintiffs subsequently petitioned for leave to appeal the denial to the Ninth Circuit.

As alleged by plaintiffs in In re Google RTB Consumer Privacy Litigation, 4:21-cv-02155, Google states in its Terms of Service, Privacy Policy, and other disclosures that it does not sell Google account holders' personal information. However, plaintiffs contend that Google's RTB auction system in fact shares and sells such personal information to advertisers participating in RTB. Plaintiffs moved for class certification under Fed. R. Civ. P. 23(b)(2) and (b)(3) asserting California law claims for breach of contract, violation of the California Information Privacy Act ("CIPA"), Cal. Pen. Code § 631, and certain other state law claims.

The court denied certification under both provisions of Rule 23 and denied the Rule 23(b)(3) class with prejudice on the grounds that plaintiffs could not establish predominance. For the damages claim that formed the basis for the Rule 23(b)(3) proposed class, Google raised an affirmative defense of implied consent, which in privacy litigation may apply where "surrounding circumstances demonstrate that the party whose person information was collected knew it." In support of this defense, Google pointed to its public disclosures about data use, the privacy policies of RTB participants, third-party news articles and nonprofit reports, and consumer surveys as publicly available evidence of the RTB data collection about which plaintiffs now complain. The court concluded that plaintiffs could not establish predominance because "a factfinder will need to assess each account holder's individual, and subjective, understanding" of the various disclosures available to them, and therefore "individualized issues will predominate over plaintiffs' damages claims." As this issue could not be overcome with further analysis, the court denied the Rule 23(b)(3) class with prejudice.

The court also denied the proposed Rule 23(b)(2) injunctive relief class but did so without prejudice. The court did so on two grounds: (1) the class definition was fail-safe, and (2) plaintiffs had not sustained their burden to prove commonality.

In its analysis of the first issue, the court focused on the proposed class definition, which was "limited to Google account holders whose 'personal information' was sold or shared." The court found this to be an inappropriate fail-safe class definition because it incorporated the merits "question on which this suit hinges." Rather than attempt to refine the definition to see if this issue could be resolved without creating other problems under Rule 23, the court denied certification with leave to amend and requested further briefing.

On the issue of commonality, the court concluded that the discovery provided to date regarding the individual named plaintiffs showed that their RTB data was "uniformly personally identifying," but found the evidence presented insufficient to show whether this plaintiff-specific RTB data was representative of the class as a whole. As that element is plaintiffs' burden to prove, the court denied certification on that ground as well, although it did so without prejudice.