Google to Pay $22.5 Million to Settle FTC Charges of Misrepresenting Internet Tracking

This posting was written by John W. Arden.

Google, Inc. has agreed to pay a $22.5 million civil penalty to settle Federal Trade Commission misrepresentation charges concerning its promise not to place tracking “cookies” on the computers of users of Apple Inc.’s Safari Internet browser and not to direct targeted ads to those users, the FTC announced today.

The Commission charged Google with violating an October 2011 settlement, in which the company agreed not to misrepresent the extent that it protected the privacy and confidentiality of any information it collected from those visiting Google and partner websites and the extent to which consumers may exercise control over the collection, use, or disclosure of such information.

According to the FTC complaint, Google informed Safari Internet browser users that they did not need to take any action to be opted out of DoubleClick targeted advertisements and that it would not (1) place DoubleClick Advertising cookies on a user’s browser, (2) collect interest category information about the user, or (3) serve targeted advertisements to the user.

Despite these representations, Google overrode the Safari default browser setting and placed the cookies on Safari browsers, the FTC charged. The initial cookie enabled Google to collect, store, and transmit a user’s Google account ID. After the Safari browser accepted the initial cookie, Google set additional third-party cookies onto the user’s browser, it was alleged. Setting these cookies on users’ Safari browsers enabled Google to collect information and serve targeted advertisements to the users, the FTC said.

Besides making misrepresentations about its information collection and ad targeting practices, Google misrepresented that it adhered to the National Advertising Initiative’s Self-Regulatory Code of Conduct, which required the posting of a notice describing a company’s data collection, transfer, and use practices, the FTC claimed.

The civil penalty to be paid by Google is the largest the agency has ever obtained for a violation of an FTC consent order. In addition to the civil penalty, the consent order required Google to disable all the tracking cookies it said it would not place on consumer computers.

“The record setting penalty in this matter sends a clear message to all companies under an FTC privacy order,” said FTC Chairman Jon Leibowitz. “No matter how big or small, all companies must abide by FTC orders against them and keep their privacy promises to consumers or they will end up paying many times what it would have cost them to comply in the first place.”

The Commission voted 4-1 to authorize the staff to refer the complaint to the Department of Justice and to approve the proposed consent decree. Commissioner J. Thomas Rosch dissented.

In a statement, the Commission said that the settlement was in the public interest because there was strong reason to believe that Google violated the October 2011 consent order and the $22.5 million fine was an appropriate remedy. In his dissenting statement, Commissioner Rosch objected to Google’s denial of liability in the consent decree. Rosch saw “no reason why the more common ‘neither admits nor denies liability’ language would not adequately protect Google from collateral estoppel in [civil] lawsuits.”

The Commission strongly disagreed with the view that if it allowed a defendant to deny the complaint’s substantive allegations that the settlement would not be in the public interest.

The complaint is United States v. Google, Inc., filed yesterday by the Department of Justice in federal district court in San Jose, California. Text of the complaint and the proposed stipulated order appear on the FTC website, along with a news release on the case.

Further information will appear in CCH Trade Regulation Reporter.

EU Adopts New Rules on Data Breaches, Cookies, Spyware

This posting was written by Thomas A. Long, Editor of CCH Privacy Law in Marketing.

Telecommunications service providers in European Union member states will be required to notify customers of security breaches that compromise their personal data, under new amendments to the EU’s Directive on Privacy and Electronic Communications ("ePrivacy Directive,” CCH Privacy Law in Marketing ¶40,110).

The amendments to the ePrivacy Directive were part of a sweeping telecommunications reform package approved by the European Parliament on November 24, 2009.

The breach notification rules are the first of their kind in Europe, although unlike breach notification laws in the United States, the ePrivacy Directive’s notice requirements will be limited to telecommunications providers.

The legislation also reinforces protection against the interception of users’ communication through the use of spyware and cookies stored on a user’s computer or other device. The amended ePrivacy Directive requires websites to provider users with better information and easier ways to control whether they want cookies stored on their computers.

The amendments also (1) give Internet service providers the right to protect their business and their customers through legal action against spammers and (2) substantially strengthen the enforcement powers of national data protection authorities.

“The new provisions will bring vital improvements in the protection of the privacy and personal data of all Europeans active in the online environment,” according to European Data Protection Supervisor Peter Hustinx.

“The improvements relate to security breaches, spyware, cookies, spam, and enforcement of rules,” he said. “But it is now crucially important to broaden the scope of the security breach provisions to all sectors and further define the procedures for notification.”

The revised ePrivacy Directive, as amended by the European Parliament and adopted by the European Council, must be implemented by the member states within 18 months.

The amendments to the ePrivacy Directive will be reflected in CCH Privacy Law in Marketing. They appear on pages 71 to 83 of the telecom legislation found here on the European Union website.