In re Google RTB Consumer Privacy Litigation

Background

Plaintiffs, who are Google account holders, allege that Google improperly sells or otherwise discloses their personal and private information to third-party companies through Google’s real-time bidding, or “RTB,” advertising auction process. Google denies that RTB operates as plaintiffs allege and denies selling or sharing account holders’ personal information without their consent. The case includes claims for breach of contract, breach of the duty of good faith and fair dealing, intrusion upon seclusion, publication of private information, breach of confidence, violation of the California Information Privacy Act, and violation of the Electronic Communications Privacy Act. Plaintiffs seek declaratory and injunctive relief, damages, restitution, and disgorgement.

The order addressed disputes about plaintiffs’ requests for production, or RFPs, of documents. Under Federal Rule of Civil Procedure 26(b)(1), discovery must concern a claim or defense and be proportionate to the case’s needs, considering factors such as the importance of the issues, the amount at stake, the parties’ access to information and resources, the value of the discovery, and its burden or expense.

Rulings on the Requests

The court required production, with limitations, for RFPs 1, 2, 3 and 4 as to the Texas Attorney General action only, 7 through 11, 22(i) and (j), 28, and 30. Google did not have to produce documents responsive to RFPs 3 and 4 concerning the Arizona and Australia actions, RFP 22(q)(i), RFP 33, or RFP 35 as broadly framed.

For RFP 1, plaintiffs sought nonprivileged documents about Google’s internal investigations into the complaint’s allegations. Google was required to determine whether it conducted such investigations after receiving notice of the complaint, identify relevant document custodians, and produce nonprivileged documents reflecting those investigations.

For RFP 2, Google’s production obligation was limited to changes actually made to RTB that concerned or affected the sale or disclosure of account holders’ personal and private information to third parties. The court did not require production about changes Google merely considered but did not implement.

For RFPs 3 and 4, plaintiffs sought documents and testimony provided to regulators and other government agencies, including materials from proceedings in Arizona, Australia, and Texas. The court found that plaintiffs had not shown enough relevance or proportionality to require production of all materials from the Arizona and Australia actions. For the Texas Attorney General action, Google had to identify the categories of requests for which it would provide responsive documents and promptly produce those documents, but it did not have to produce the additional categories identified by plaintiffs. The court noted that it was not resolving whether an earlier order required broader production from that action.

For RFPs 7 through 9, Google had to produce nonprivileged documents concerning statements or testimony to regulators, government bodies, or courts that discussed RTB. Google did not have to search for or produce material concerning informal interviews, such as statements to the media, or material concerning data privacy generally without a specific connection to RTB or the claims.

For RFPs 10 and 11, concerning preparations for and drafts or discussions of a New York Times opinion editorial by Google’s chief executive, Google had to produce materials that referenced, relied on, or discussed RTB. It did not have to produce materials concerning only data privacy generally.

For RFP 22(i) and (j), which concerned where and how Google stores bid requests and user information used or potentially used in a bid request, Google generally did not have to produce documents about storage location and methods because plaintiffs had not shown that information was relevant. However, to the extent the requested documents would show what account-holder information Google actually shared with third parties through RTB and how Google tracked that sharing, Google had to produce documents sufficient to show those matters. For RFP 22(q)(i), concerning the factors and methods for selecting the winning RTB bid, the court found that plaintiffs had not shown relevance and did not require production.

For RFP 28, plaintiffs sought all documents related to Google’s terms of service, help-center pages, and privacy policies, including drafts and discussions. The court found the request too broad and directed Google to produce responsive documents consistent with its proposed scope, including earlier versions and nonprivileged drafts.

For RFP 30, Google did not have to produce documents about its analysis and decision-making concerning what it told others about the collection and storage of user information. It did have to produce documents about what it told account holders and RTB participants concerning the use and sale of user information, Google’s targeted advertising, and the RTB process. Because the proposed class was limited to U.S. account holders, Google did not have to produce responsive documents concerning non-U.S. account holders.

For RFP 33, the court found that plaintiffs’ concept of “user engagement” was not sufficiently defined. It did not require Google to produce periodic reports about user engagement or studies of how privacy breaches affect user engagement. The court did not bar plaintiffs from further investigating whether Google tracks metrics about what RTB participants value when placing bid requests and, if appropriate, seeking discovery about those metrics and any effect of privacy breaches on them.

For RFP 35, the court found that a request for information about Google’s market share for all digital advertising was too broad. The parties were directed to confer about whether Google had documents showing the relevant market sector encompassing RTB and, if possible, RTB’s share of that sector. The order states that Google need not produce the request as broadly framed, while directing further discussion about a narrower scope.

Disposition

The court ordered the parties to confer, as appropriate, about a schedule for Google’s production of documents responsive to the specified requests and about the scope of RFP 35. Judge Virginia K. DeMarchi resolved the discovery disputes without deciding the merits of plaintiffs’ underlying privacy, contract, or other claims.