FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

PATRICK CALHOUN; ELAINE No. 22-16993

CRESPO; MICHAEL HENRY;

CORNICE WILSON; RODNEY D.C. No. 4:20-cv-

JOHNSON; CLAUDIA KINDLER, 05146-YGR

Plaintiffs-Appellants,

OPINION

v.

GOOGLE, LLC,

Defendant-Appellee.

Appeal from the United States District Court for the Northern District of California Yvonne Gonzalez Rogers, District Judge, Presiding

Argued and Submitted July 19, 2024 San Francisco, California

Filed August 20, 2024

Before: MILAN D. SMITH, JR., MARK J. BENNETT, and ANTHONY D. JOHNSTONE, Circuit Judges.

Opinion by Judge Milan D. Smith, Jr. 2 CALHOUN V. GOOGLE, LLC

SUMMARY *

Data Collection

The panel reversed the district court’s summary judgment in favor of Google, LLC, in a class action alleging that the company surreptitiously collected users’ data in violation of various state and federal laws, and remanded for further proceedings. Plaintiffs are a group of Google Chrome users who chose not to sync their Chrome browsers with their Google accounts while browsing the web. As they allege in their complaint, Plaintiffs believed, based on the terms of Google’s Chrome Privacy Notice, that their choice not to sync Chrome with their Google accounts meant that certain personal information would not be collected and used by Google. The district court held that Google successfully proved that Plaintiffs consented to its data collection. The panel explained that the district court should have reviewed the terms of Google’s various disclosures and decided whether a reasonable user reading them would think that he or she was consenting to the data collection. By focusing on “browser agnosticism” instead of conducting the reasonable person inquiry, the district court failed to apply the correct standard. Viewed in the light most favorable to Plaintiffs, browser agnosticism is irrelevant because nothing in Google’s disclosures is tied to what other browsers do.

* This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.

CALHOUN V. GOOGLE, LLC 3

Because applying the correct standard reveals disputes of material fact regarding whether “reasonable” users of Google’s product consented to Google’s data collection practices, the panel remanded the issue of consent— assuming a plaintiff class is certified—to the district court for trial.

COUNSEL

Matthew W.H. Wessler (argued), Gupta Wessler LLP, Washington, D.C.; Neil K. Sawhney, Gupta Wessler LLP, San Francisco, California; Jason O. Barnes, Simmons Hanly Conroy, St. Louis, Missouri; Eric S. Johnson and Jennifer M. Paulson, Simmons Hanly Conroy, Alton, Illinois; Thien An Vinh Truong, Simmons Hanly Conroy, New York, New York; Amy E. Keller, Adam J. Levitt, and Adam Prom, DiCello Levitt LLP, Chicago, Illinois; Corban S. Rhodes and David A. Straite, DiCello Levitt LLP, New York, New York; Lesley Weaver, Bleichmar Fonti & Auld LLP, Oakland, California; for Plaintiffs-Appellants. Andrew H. Schapiro (argued) and Joseph H. Margolies, Quinn Emanuel Urquhart & Sullivan LLP, Chicago, Illinois; Stephen Broome, Quinn Emanuel Urquhart & Sullivan LLP, New York, New York; Diane Doolittle, Quinn Emanuel Urquhart & Sullivan LLP, Redwood Shores, California; Alyssa Olson and Viola Trebicka, Quinn Emanuel Urquhart & Sullivan LLP, Los Angeles, California; Christopher G. Michel, Quinn Emanuel Urquhart & Sullivan LLP, Washington, D.C.; Jeffrey M. Gutkin, Cooley LLP, San Francisco, California; for Defendant-Appellee. Jeffrey R. White and Sean Domnick, American Association for Justice, Washington, D.C.; Saveena Takhar, Consumer 4 CALHOUN V. GOOGLE, LLC

Attorneys of California, Sacramento, California; for Amici Curiae American Association for Justice and Consumer Attorneys of California. Kyle D. Highful, Assistant Solicitor General; Bill Davis, Deputy Solicitor General; Lanora C. Pettit, Principal Deputy Solicitor General; Aaron L. Nielson, Solicitor General; Brent Webster, First Assistant Attorney General; Ken Paxton, Attorney General of Texas; Office of the Attorney General, Austin, Texas; Treg R. Taylor, Attorney General of Alaska; Kris Mayes, Attorney General of Arizona; Kathleen Jennings, Attorney General of Delaware; Anne E. Lopez, Attorney General of Hawaii; Theodore E. Rokita, Attorney General of Indiana; Brenna Bird, Attorney General of Iowa; Daniel Cameron, Attorney General of Kentucky; Jeff Landry, Attorney General of Louisiana; Anthony G. Brown, Attorney General of Maryland; Dana Nessel, Attorney General of Michigan; Lynn Fitch, Attorney General of Mississippi; Aaron D. Ford, Attorney General of Nevada; Raul Torrez, Attorney General of New Mexico; Drew H. Wrigley, Attorney General of North Dakota; Dave Yost, Attorney General of Ohio; Marty J. Jackley, Attorney General of South Dakota; Sean D. Reyes, Attorney General of Utah; Jason S. Miyares, Attorney General of Virginia; for Amici Curiae the State of Texas and 18 Other States. Alan J. Butler, Sara Geoghegan, and Suzanne Bernstein, Electronic Privacy Information Center, Washington, D.C.; for Amicus Curiae Electronic Privacy Information Center. Cory L. Andrews and John M. Masslon II, Washington Legal Foundation, Washington, D.C.; for Amicus Curiae Washington Legal Foundation.

CALHOUN V. GOOGLE, LLC 5

Stephanie A. Joyce, Potomac Law Group PLLC, Washington, D.C.; for Amicus Curiae The Computer & Communications Industry Association.

OPINION

M. SMITH, Circuit Judge:

Plaintiff-Appellants Patrick Calhoun, Elaine Crespo, Michael Henry, Cornice Wilson, Rodney Johnson, and Claudia Kindler brought this class action lawsuit against Defendant-Appellee Google, LLC, alleging that the company surreptitiously collected users’ data in violation of various state and federal laws. The district court granted summary judgment in favor of Google, holding that Google had successfully proven that Plaintiffs consented to its data collection. For the reasons explained below, we reverse and remand.

FACTUAL AND PROCEDURAL BACKGROUND

Plaintiffs are a group of Google Chrome users who “chose not to ‘Sync’ their [Chrome] browsers with their Google accounts while browsing the web from July 27, 2016 to the present.” As they allege in their complaint, Plaintiffs believed that their choice not to sync Chrome with their Google accounts meant that certain “personal information” would not be collected and used by Google. Their belief was based on the terms of Google’s “Chrome Privacy Notice,” which “describes features that are specific to Chrome,” and states in relevant part:

You don’t need to provide any personal information to use Chrome, but Chrome has 6 CALHOUN V. GOOGLE, LLC

different modes you can use to change or improve your browsing experience. Privacy practices are different depending on the mode that you’re using. Basic Browser Mode The basic browser mode stores information locally on your system [. . .] The personal information that Chrome stores won’t be sent to Google unless you choose to store that data in your Google Account by turning on sync . . . Sign-in and Sync Chrome Modes You also have the option to use the Chrome browser while signed in to your Google Account, with or without sync enabled. [. . .] Sync. When you sign in to the Chrome browser or a Chromebook and enable sync with your Google Account, your personal information is saved in your Google Account on Google’s servers so you may access it when you sign in and sync to Chrome on other computers and devices. This personal information will be used and protected in accordance with the Google Privacy Policy. This type of information can include: • Bookmarks • Tabs • Passwords and Autofill information

CALHOUN V. GOOGLE, LLC 7

• Other browser settings, like installed extensions Sync is only enabled if you choose . . . How Chrome handles your synced information When you enable sync with your Google Account, we use your browsing data to improve and personalize your experience within Chrome . . . You can change this setting on your Account History page or manage your private data whenever you like. If you don’t use your Chrome data to personalize your Google experience outside of Chrome, Google will only use your Chrome data after it’s anonymized and aggregated with data from other users . . .

Notwithstanding the above statements, Plaintiffs allege that “Google intentionally and unlawfully causes Chrome to record and send users’ personal information to Google regardless of whether a user elects to Sync or even has a Google account.” Specifically, Plaintiffs allege that “Chrome sends the following personal information to Google when a user exchanges communications with any website that includes Google surveillance source code— 8 CALHOUN V. GOOGLE, LLC

again, regardless of whether a user is logged-in to Google Sync or not”:

a. The user’s unique, persistent cookie 1 identifiers; b. The user’s browsing history in the form of the contents of the users’ GET requests 2 and information relating to the substance, purport, or meaning of the website’s portion of the communication with the user; c. In many cases, the contents of the users’ POST 3 communications; d. The user’s IP address 4 and User-Agent information about their device; and e. The user’s x-client-data identifier. 5

1 Cookies are “small text files stored on the user’s device.” In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 596 (9th Cir. 2020). 2 “When an individual internet user visits a web page, his or her browser sends a message called a ‘GET request’ to the web page’s server. The GET request serves two purposes: it first tells the website what information is being requested and then instructs the website to send the information back to the user. The GET request also transmits a referer header containing the personally-identifiable URL information.” Internet Tracking Litig., 956 F.3d at 607. 3 “Like a GET request, a POST request is one of ‘[t]he basic commands that Chrome uses to send the users’ side of a communication.’” 4 “An ‘IP address’ is a numerical identifier for each computer or network connected to the Internet.” Internet Tracking Litig., 956 F.3d at 596 n.2. 5 “The x-client-data header is an identifier that when combined with IP address and user-agent, uniquely identifies every individual download[ed] version of the Chrome browser.”

CALHOUN V. GOOGLE, LLC 9

A. Motion to Dismiss At the motion to dismiss stage, Google did not deny collecting Plaintiffs’ data while using Chrome in an un- synced mode. Instead, it asserted that Plaintiffs consented to this data collection when they agreed to Google’s Privacy Policy, 6 which policy is cross-referenced in the part of the Chrome Privacy Notice discussing “Sign-in and Sync Chrome modes.” Google argued that the Policy “disclosed the alleged data collection” per the following terms:

We collect information about the services that you use and how you use them, like when you . . . visit a website that uses our advertising services, or view and interact with our ads and content. This information includes: . . . device- specific information . . . When you use our services or view content provided by Google, we automatically collect and store certain information in server logs, [including] details of how you used our service, such as your search queries . . . device event information such as . . . the date and time of your request and referral URL [and] cookies that may uniquely identify your browser or your Google Account.

6 The Privacy Policy is incorporated in Google’s Terms of Service (TOS), which all Plaintiffs agreed to. 10 CALHOUN V. GOOGLE, LLC

While the district court recognized that consent is a valid legal defense to Plaintiffs’ claims, it rejected Google’s arguments that it had met its burden to establish the defense. First, the court noted that Google’s General Terms of Service (TOS), which incorporates the Privacy Policy, states that where “these terms conflict with the service-specific additional terms, the additional terms will govern for that service.” It further noted that the Privacy Policy directed readers to “additional terms for particular services,” and included a hyperlink to the Chrome Privacy Notice. These statements—combined with Google’s more specific representation in the Chrome Privacy Notice that “the personal information that Chrome stores won’t be sent to Google unless you . . . turn[] on sync”—led the court to conclude that a reasonable user would not think they were consenting to the data collection at issue. The court noted that a reasonable user viewing these disclosures might think “that if he or she used Chrome without sync, his or her personal information would not be sent to Google.” Second, the court rejected Google’s argument that the Chrome Privacy Notice was accurate regarding how Google would treat “the personal information that Chrome stores” because “readers would understand that ‘the personal information that Chrome stores’” does not include the data collection at issue in this case. The court rejected this argument because the data collection “falls within the definition of personal information under California law, which governs Google’s [TOS],” and the terms of Google’s own privacy policy. In sum, the court concluded that “Google cannot show that Plaintiffs expressly consented to Google’s collection of data,” and that “[t]o the contrary, Google’s representations

CALHOUN V. GOOGLE, LLC 11

might have led a reasonable user to believe that Google did not collect his or her personal information when the user was not synced.” It thus denied Google’s motion to dismiss on its consent defense. 7 B. Motion for Summary Judgment Google moved for summary judgment. In its summary judgment briefing, Google introduced two additional notices in support of its consent defense: the “Consent Bump Agreement,” which it launched in June 2016, and the “New Account Creation Agreement,” updated in June 2016. The “Consent Bump Agreement” “is a push down banner that Google showed to account holders either when they visited a ‘Google owned-and-operated property’ while signed into their account or when users signed into their account for the first time after June 2016.” It reads in relevant part:

[W]hen you use[] Google services like Search and YouTube, you generate data— things like what you’ve searched for and videos you’ve watched. You can find and control that data in My Account under the Web & App Activity setting. With this change, this setting may also include browsing data from Chrome and activity from sites and apps that partner with Google, including those that show ads from Google.

7 This case was originally assigned to Judge Lucy H. Koh. After the motion to dismiss order was issued, however, Judge Koh was elevated to the Ninth Circuit, and Judge Yvonne Gonzalez Rogers was assigned to adjudicate the case. 12 CALHOUN V. GOOGLE, LLC

The “New Account Creation Agreement” incorporates the Privacy Policy, and states:

When you search for a restaurant on Google Maps or watch a video on YouTube, for example, we process information about that activity—including information like the video you watched, device IDs, IP addresses, cookie data, and location. We also process the kinds of information described above when you use apps or sites that use Google services like ads, Analytics, and the YouTube video player . . . We also combine data among our services and across your devices for these purposes.

The district court referred to these agreements, along with the Privacy Policy, collectively, as “Google’s general policies” to distinguish them from the Chrome-specific Privacy Notice. Assuming that only Google’s “general policies” or the Chrome Privacy Notice could govern Google’s conduct in this case, the court identified the threshold issue at summary judgment as “which agreement controls the at-issue data collection.” “Plaintiffs contend[ed] that the Chrome Privacy Notice applie[d] because they are Chrome users using the Chrome browser.” “Google . . . argue[d] that because the data collection at issue . . . is ‘browser-agnostic,’ Google’s general policies apply.” After holding a lengthy evidentiary hearing on the issue, the court found that the collection of data listed in Plaintiffs’ complaint (the “at-issue data” collection) was “browser-

CALHOUN V. GOOGLE, LLC 13

agnostic,” except for the X-client-data-header. 8 In other words, the court found that the data Plaintiffs complained was improperly collected was “transmitted to Google regardless of the browser used.” The court then explained the significance of the “browser-agnostic” finding: “Because the Court finds that the at-issue data collected is not specific to Chrome but browser agnostic, the Court also finds that Google’s general policies apply.” “More specifically, the General Privacy Policy, New Account Creation Agreement, and Consent Bump Agreement governs the collection of those categories of information identified by plaintiffs.” The district court then explained that all Plaintiffs had consented to the general Privacy Policy, and at least some had agreed to the Consent Bump Agreement and the New Account Creation Agreement. Based on the terms of these agreements, the district court explained that “a reasonable person viewing those disclosures would understand that Google maintains the practices of (a) collecting its users’ data when users use Google services or third party sites that use Google’s services and (b) that Google uses the data for advertising purposes.” Finally, the district court rejected Plaintiffs’ arguments to the contrary. Most notably, the district court held that the Chrome Privacy Notice did “not negate []” Plaintiffs’ consent to the general policies outlined above. The district

8 The district court held that “plaintiffs agreed to Google’s use of the X- Client-header data when they agreed to the Chrome Privacy Notice.” 14 CALHOUN V. GOOGLE, LLC

court entered judgment for Google. 9 Plaintiffs have timely appealed.

JURISDICTION AND STANDARD OF REVIEW

We have jurisdiction pursuant to 28 U.S.C. § 1291. We review de novo the district court’s summary judgment order. 2-Bar Ranch Ltd. P’ship v. U.S. Forest Serv., 996 F.3d 984, 990 (9th Cir. 2021).

ANALYSIS

At summary judgment, the following causes of action remained: (1) violation of the California Invasion of Privacy Act; (2) intrusion upon seclusion; (3) breach of contract; (4) breach of the implied covenant of good faith and fair dealing; (5) statutory larceny; and (6) violation of California’s Unfair Competition Law. The parties do not dispute that consent is a valid defense to these claims, and that the contours of the defense as established in the Restatement (Second) of Torts. 10 and in state law are as follows. First, consent “can be [express] or implied, but any consent must be actual.” In re Google Inc., No. 13-MD- 02430-LHK, 2013 WL 5423918, at *12 (N.D. Cal. Sept. 26, 2013) (citing United States v. Van Poyck, 77 F.3d 285, 292 (9th Cir. 1996)); see also Pinnacle Museum Tower Ass’n v. Pinnacle Mkt. Dev. (US), LLC, 282 P.3d 1217, 1224 (Cal. 2012) (stating that general principles of contract law include

9 The district court denied Plaintiffs’ motion for class certification as moot. California courts are generally guided by the principles outlined in the 10

Restatement (Second) of Torts. See, e.g., Korea Supply Co. v. Lockheed Martin Corp., 63 P.3d 937, 951 (Cal. 2003).

CALHOUN V. GOOGLE, LLC 15

express or implied consent). For consent to be actual, the disclosures must “explicitly notify” users of the conduct at issue. In re Google Inc., 2013 WL 5423918, at *13. Moreover, “[c]onsent is only effective if the person alleging harm consented ‘to the particular conduct, or to substantially the same conduct’ and if the alleged tortfeasor did not exceed the scope of that consent.” Tsao v. Desert Palace, Inc., 698 F.3d 1128, 1149 (9th Cir. 2012) (“To be effective, consent must be . . . to the particular conduct, or substantially the same conduct.”) (quoting Restatement (Second) of Torts § 892A(2)(b) (1979))). The parties agree that consent is “an affirmative defense for which defendant bears the burden of proof.” Van Patten v. Vertical Fitness Grp., LLC, 847 F.3d 1037, 1044 (9th Cir. 2017). In determining consent, courts consider “whether the circumstances, considered as a whole, demonstrate that a reasonable person understood that an action would be carried out so that their acquiescence demonstrates knowing authorization.” Smith v. Facebook, Inc., 745 F. App’x 8, 8 (9th Cir. 2018). See, e.g., Long v. Provide Com., Inc., 200 Cal. Rptr. 3d 117, 125 (Ct. App. 2016) (disagreeing that a “hyperlink was sufficiently conspicuous to ‘put a reasonable user on notice of the Terms of Use’”). If that user could have plausibly understood the disclosures “as not disclosing that [the defendant] would engage in particular conduct,” then the disclosures are insufficient to establish consent. In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 789 (N.D. Cal. 2019). Before the district court, Plaintiffs had argued that they did not consent to Google’s conduct because a reasonable user viewing the disclosures would not have concluded that they unambiguously disclosed the data collection at issue. See, e.g., Plaintiffs’ Opposition to Summary Judgment, 16 CALHOUN V. GOOGLE, LLC

Calhoun v. Google, 5:20-cv-05146, at 5-6 (Jan. 2, 2022). Specifically, Plaintiffs asserted that the explicit statements in the Chrome Privacy Notice would actually give a reasonable user the opposite impression regarding Google’s data collection practices. Further, Plaintiffs argued that—to the extent Google relied on the Privacy Policy to argue otherwise—that Policy also contained statements in favor of Plaintiffs’ interpretation, such as: “the activity information we collect may include . . . Chrome browsing history you’ve synced with your Google Account,” and “[y]our Chrome browsing history is only saved to your account if you’ve enabled Chrome synchronization with your Google Account.” Google argues that the General Privacy Policy addresses the “at-issue” data, such as IP addresses and cookies, while the Chrome Privacy Notice reference to “personal information” addresses only Sync-enabled data like browsing history, bookmarks, tabs, passwords and autofill information, and other browser settings. But the parties dispute whether a reasonable person would understand, in the context of all of Google’s representations in its privacy policies, what “personal information” means. Plaintiffs also argue that Google’s Chrome Privacy Notice also makes representations about data collection beyond Sync-enabled data. For example, the Chrome Privacy Notice states that “[y]ou don’t need to provide any personal information to use Chrome” and that “[p]rivacy practices are different depending on the mode you’re using.” It goes on to state that in “Basic browser mode,” information such as passwords and “cookies or data from websites that you visit” are stored locally on a user’s system. The Notice then provides that “[t]he personal information that Chrome stores won’t be sent to Google unless you . . . turn[] on

CALHOUN V. GOOGLE, LLC 17

sync.” Although Google argues that the reference to “personal information” is sufficient to indicate which subset of data the Notice controls, together, these statements could suggest that the “personal information” the Chrome Privacy Notice addresses includes cookies and IP addresses. Based on these arguments, the district court should have reviewed the terms of the various disclosures and decided whether a reasonable user reading them would think that he or she was consenting to the data collection, which collection Google has not disputed. See, e.g., In re Facebook, Inc. Internet Tracking Litig., 956 F.3d 589, 602 (9th Cir. 2020) (identifying “the relevant question” as “whether a user would reasonably expect that Facebook would have access to the user’s individual data,” and reviewing the terms of “Facebook’s privacy disclosures” to answer that question). However, rather than trying to determine how a reasonable user would understand Google’s various privacy policies, the district court held a 7.5-hour evidentiary hearing which included expert testimony about “whether the data- collection at issue [is] . . . browser-agnostic.” The district court thus made the case turn on a technical distinction unfamiliar to most “reasonable user[s].” If “the data collection at-issue [wa]s specific to Chrome,” the court believed, then the Chrome-specific promises in the Chrome Privacy Notice applied. But if it was “browser-agnostic”— if Google collected the same data from non-Chrome browsers—then all that mattered were the company’s generalized statements in the terms of service and Privacy Policy. Having determined that the data collection was “browser agnostic,” the district court held that Plaintiffs consented to this collection when they agreed to Google’s general privacy 18 CALHOUN V. GOOGLE, LLC

policies, because under the “browser agnostic terms” of those policies, the data collection was disclosed. The district court therefore did not consider the terms of the Chrome Policy Notice in its analysis. To the extent the district court considered those terms at all, it only mentioned them to say they did not “negate” Plaintiffs’ consent. By focusing on “browser agnosticism” instead of conducting the reasonable person inquiry, the district court failed to apply the correct standard, despite its recitation of it. Viewing this in the light most favorable to Plaintiffs, browser agnosticism is irrelevant because nothing in Google’s disclosures is tied to what other browsers do. And that is because the governing standard is what a “reasonable user” of a service would understand they were consenting to, not what a technical expert would. To resist this conclusion, Google cites our unpublished decision in Smith to argue that the district court did not err. The Smith panel held that “[a] reasonable person viewing [Facebook’s] disclosures would understand that Facebook maintains” certain data collection practices based on the terms of its disclosures. 11 Smith, 745 F. App’x at 8-9. Google argues that the reasoning in Smith applies here because “[t]he transmissions at issue in Smith were materially indistinguishable from those in this case.”

11 The relevant disclosure in Smith stated: “We collect information when you visit or use third-party websites and apps that use our Services . . . This includes information about the websites and apps you visit, your use of our Services on those websites and apps, as well as information the developer or publisher of the app or website provides to you or us,” and “we use all of the information we have about you to show you relevant ads.” Smith, 745 F. App’x at 8.

CALHOUN V. GOOGLE, LLC 19

But the panel in Smith did not hold that plaintiffs consented to the data collection because it determined that the data collection at issue was “agnostic.” Rather, it held that plaintiffs consented to the data collection because, analyzing the terms of Facebook’s Terms and Policies, “a reasonable person viewing those disclosures would understand” that Facebook engaged in the contested practices. Id. More to the point, Smith, and our recent unpublished decision in Hammerling v. Google, LLC, No. 22-17024, 2024 WL 937247, at *2 (9th Cir. Mar. 5, 2024) 12 are inapposite, because plaintiffs in those cases had not argued that Facebook or Google had service-specific privacy policies that could reasonably be read to say the opposite of what its general privacy policies disclosed. The panel in Smith, for example, specifically explained that Facebook was not bound by the contrary assurances of other websites’ policies because “Facebook’s Terms and Policies make no such assurance, and Facebook is not bound by promises it did not make.” Smith, 745 F. App’x at 9. By contrast, and at least in the light most favorable to plaintiffs, Google did make a promise in its Chrome Privacy Policy that it would not collect certain information absent a user’s voluntary decision to sync, so Google may be “bound by [those] promises.” Id. Google’s “affirmative statement that it would not receive information” in its Chrome Privacy Notice puts this case more in line with Internet Tracking Litigation than with Smith or Hammerling. Internet Tracking Litig., 956 F.3d at 603. There, a panel of our court reversed a district court’s

12 Google filed a 28(j) letter notifying the court about this March 4, 2024 unpublished decision. 20 CALHOUN V. GOOGLE, LLC

decision to dismiss a complaint in which users of Facebook alleged that the social media site continued to collect their data even after they had logged out. Id. at 596. The panel began by assessing “whether a user would reasonably expect that Facebook would have access to the user’s individual data after the user logged out of the application.” Id. at 602. It did this by reviewing Facebook’s various “privacy disclosures” id., rather than looking at browser agnosticism. The panel noted that Facebook’s general Data Use Policy stated that Facebook “receive[s] data whenever you visit a game, application or website that uses [Facebook’s services].” Id. To the extent the policy mentioned log in/log out, it stated that the data collection could include “the date and time you visit the site; the web address, . . . and, if you are logged in to Facebook, your user ID.” Id. (emphasis omitted). The panel also noted that Facebook’s “Help Center” answered the more specific question of data collection at log in/log out: “[i]f you are logged into Facebook, we also see your user ID number and email address. . . . If you log out of Facebook, we will not receive this information about partner websites but you will also not see personalized experiences on these sites.” Id. Based on these disclosures—including the applicable Help Center page which “affirmatively stated that logged-out user data would not be collected,”—the panel held that a reasonable user would not necessarily expect that Facebook would have access to the data after logging out of the site. Id. Discussing other cases on this topic, the panel noted: “[t]hat users in those cases explicitly denied consent does not render those cases distinguishable from the instant case, given Facebook’s affirmative statements that it would not receive information from third-party websites after users had logged out. Indeed, in those cases, the critical fact was that

CALHOUN V. GOOGLE, LLC 21

the online entity represented to the plaintiffs that their information would not be collected, but then proceeded to collect it anyway.” Id. at 603 (discussing In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 129, 151 (3d Cir. 2015) and In re Nickelodeon Cons. Priv. Litig., 827 F.3d 262, 293–94 (3d Cir. 2016)). Here, Google’s general Privacy Policy broadly states “that Google collects data about users’ ‘[a]ctivity on third- party sites and apps that use [Google’s] services.’” Hammerling, 2024 WL 937247, at *1 (analyzing same Privacy Policy). Like the general policy in Facebook which only briefly discussed the log in/log out distinction, the Privacy Policy here only briefly mentions the sync/non-sync distinction. Like the “Help Center” in Facebook, the Chrome Privacy Notice includes more detail on the distinctions between Chrome browsing modes, and includes an “affirmative statement[] that it would not receive information,” Internet Tracking Litig., 956 F.3d at 603, from users “unless you choose to . . . turn[] on sync.” Thus, when the disclosures are read together and in the light most favorable to Plaintiffs, a reasonable user would not necessarily understand that they were consenting to the data collection at issue. It was the district court’s failure to apply the correct standard that led to the opposite conclusion. This point is illustrated by the outcome of a related case, Brown v. Google LLC, 685 F. Supp. 3d 909, 930 (N.D. Cal. 2023). In Brown, the same district court presided over a related class action lawsuit brought by users of Google Chrome’s “incognito” mode. Id. at 919. As in this case, plaintiffs alleged that Google surreptitiously collected their data, notwithstanding statements in the same Chrome Privacy Notice (and on the incognito splash screen) that within Incognito mode “Chrome won’t store certain 22 CALHOUN V. GOOGLE, LLC

information.” Id. at 930. As in this case, Google asserted that the Brown plaintiffs consented to the Privacy Policy, which Policy disclosed the data collection challenged. Id. at 926. But unlike in this case, the district court rejected Google’s “agnosticism” reasoning, instead properly turning to the disclosures at issue and assessing whether a reasonable user reading them might believe they were consenting to certain practices. Brown, 685 F. Supp. 3d at 927-28. Here, Google had a general privacy disclosure yet promoted Chrome by suggesting that certain information would not be sent to Google unless a user turned on sync. Thus, “Google itself created a situation where there is a dispute as to whether users’ consent of Google’s data collection generally is ‘substantially the same’ as their consent to the collection of their [non-synced] data in particular.” Id. at 928. Whether a “reasonable” user of Google’s computer software at issue in this case consented to a particular data collection practice is not to be determined by attributing to that user the skill of an experienced business lawyer or someone who is able to easily ferret through a labyrinth of legal jargon to understand what he or she is consenting to. Instead, a determination of what a “reasonable” user would have understood must take into account the level of sophistication attributable to the general public, which uses Google’s services. Because applying the correct standard reveals disputes of material fact regarding whether “reasonable” users of Google’s product consented to Google’s data collection practices, the issue of consent—assuming a plaintiff class is certified—is remanded to the district court for trial.

CALHOUN V. GOOGLE, LLC 23

CONCLUSION

For the foregoing reasons, we REVERSE the order of the district court and REMAND this case for further proceedings consistent with this opinion.