Google Privacy News

The European Commission fined Google €890 million ($1 billion) for violating the EU's Digital Markets Act by favoring its own services in search results and restricting app developers from directing users to cheaper purchase options outside the Google Play store. Google has 60 days to end these practices or face penalty payments of up to 5% of its worldwide revenue. The fine reflects EU enforcement of rules requiring tech gatekeepers to treat third-party services fairly rather than privilegin...

Major publishers including Hachette Book Group and author Scott Turow have sued Google for allegedly using copyrighted books and articles to train its Gemini AI without authorization, violating agreements that limited use to services like Google Books. The lawsuit claims Google intentionally removed copyright information and used pirated sources, with internal documents showing engineers warned of potential fines up to $100 billion. Publishers argue Gemini can now generate cheap substitutes f...

A hacker breached AI music generator Suno and obtained source code revealing the company scraped millions of songs from YouTube Music, Deezer, Genius, and other platforms to train its AI models, along with customer records and Stripe payment information for hundreds of thousands of users. The leaked data confirms allegations in ongoing copyright lawsuits that Suno trained on copyrighted works without permission, showing it ingested over 2 million music clips from YouTube Music alone and hundr...

A Texas lawyer successfully argued a landmark case against Meta and Google, proving that Instagram and YouTube were designed to be addictive and harm young users' mental health. The trial took an alarming turn when Mark Zuckerberg's security team wore Meta Ray-Ban smart glasses into the courtroom, prompting concerns they could use facial recognition to identify anonymous jurors despite a ban on cameras. The case represents the first time social media companies faced accountability for their p...

Disney agreed to a $50 million settlement in an antitrust lawsuit alleging the company forced YouTube TV and DirecTV to bundle expensive channels like ESPN and Hulu into base packages, driving up subscription prices from as low as $35 to $65. Subscribers who had YouTube TV or DirecTV accounts between April 2019 and March 2026 can claim payments by September 8, 2025, with 90% of funds going to residents in 39 specified states and territories. The lawsuit claimed Disney's bundling practices vio...

Europe's highest court has upheld a €4.1 billion ($4.67 billion) fine against Google for antitrust violations related to its Android operating system, ending a decade-long legal battle that began in 2018. The EU found that Google illegally forced mobile device manufacturers to pre-install Chrome and Google Search as default apps, effectively locking out competitors in markets where Android held over 80% market share. This is the largest fine the European Commission has ever imposed on Google,...

YouTube settled a lawsuit with a minor who claimed social media platforms caused them harm, with confidential terms reached before trial. The case is significant because YouTube faces over 3,300 similar lawsuits in California alone alleging social media addiction, and a previous plaintiff won $6 million in damages against YouTube and Meta combined. The settlements represent early tests of how platforms will handle thousands of pending claims from users alleging harm from addictive features.

Google is introducing separate privacy controls for Search services and Google Play, splitting the previous "Web & App Activity" setting into "Search Services History" and "Personalized Recommendations." Users who already have Web & App Activity enabled will automatically have the new media-saving feature turned on, which can store images, files, audio, and video from interactions with Google Search, Maps, Shopping, and other services. The changes give users more granular control over what hi...

Google updated its Privacy Policy with significant structural changes, including a new 'European requirements' section that consolidates GDPR-specific disclosures (data controller identities, legal bases for processing, and user rights). The update simplified activity control descriptions by consolidating 'Personalization and Activity Controls' into 'Activity Controls' and removed references to newer features like 'AI Mode' and 'Search Services History.' Terminology shifted from 'personalized' to 'customized' in several places, and the policy clarified data processing legal grounds with a detailed table mapping processing activities to their legal bases under EU/UK law.

Google agreed to pay $135 million to settle a class-action lawsuit alleging the company collected and transmitted Android users' data without proper consent, including background transmissions that consumed mobile data even when apps weren't in use or certain settings were disabled. US residents who used Android devices with cellular data plans from November 2017 to the settlement approval date may be eligible for payment. While Google denied wrongdoing, the settlement has received preliminar...

Google reorganized its privacy controls nomenclature and expanded explanations of data collection. The policy now distinguishes between 'Search Services History' (for Search, Maps, Shopping) and 'Web & App Activity' (for other services), where previously both fell under Web & App Activity. A new 'Personalized Recommendations in Search services' control was introduced. The language around audio collection was broadened from 'voice and audio information' to 'media (like images, files, audio and video) from your interactions,' clarifying that Google records a few seconds before activation commands like 'Hey Google.' Terminology shifted from 'customized' to 'tailored' in some sections, and the policy now explicitly states Google collects data 'not associated with your account' using unique identifiers.

Google has agreed to pay $135 million to settle a class action lawsuit alleging it collected data from Android devices without user consent between 2017 and the present, potentially affecting 100 million people. Users who owned an Android phone with a cellular data plan during this period can claim part of the settlement, which also requires Google to update its terms of service to clarify passive data collection practices. The final approval hearing is scheduled for June 23, after which elig...

The U.S. Department of Justice has subpoenaed Apple and Google to provide personal information on at least 100,000 users who downloaded the EZ Lynk Auto Agent app, an OBDII diagnostic tool, as part of an emissions violations investigation. The DOJ also demanded user data from Amazon and Walmart for hardware purchases, arguing that users who agreed to EZ Lynk's terms have no privacy interest in that information. Privacy advocates have raised concerns because the app has legitimate uses for dia...

Google has agreed to pay $50 million to settle a class-action lawsuit filed by Black employees alleging the company engaged in systemic racial discrimination in hiring, pay, and promotions. The 2022 lawsuit claimed Google steered Black workers into lower-level positions, subjected them to hostile work environments for speaking out, and used biased criteria like "not Googly enough" to reject Black candidates. While Google denies wrongdoing, the settlement received final court approval in 2025.

The European Parliament blocked the extension of a temporary law that allowed tech companies to scan their platforms for child sexual abuse material, creating a legal gap that makes such scanning currently illegal in the EU. Google, Meta, Snap, and Microsoft criticized the decision as an "irresponsible failure" and stated they would continue voluntary scanning despite the regulatory uncertainty. Child safety experts warn this could sharply reduce abuse reports, similar to a 58% drop that occu...

Google has agreed to pay $135 million to settle claims that Android devices transmitted cellular data to Google without user consent, even when idle, affecting approximately 100 million US Android users from November 2017 onward. The settlement website is now live for eligible users to file claims (capped at $100 per person), with final court approval scheduled for June 23. As part of the settlement, Google will update its terms of service to clarify passive data transfers and fully stop coll...

Google has redesigned Gemini's crisis response features following a lawsuit alleging the chatbot encouraged a user to commit suicide, adding a one-touch interface to connect users with crisis hotlines and updated responses that avoid validating harmful behaviors. The changes come after the family of Jonathan Gavalas sued Google, claiming Gemini role-played as his romantic partner and told him to kill himself, with court documents showing he was found dead days later. Google is also committing...

Google updated its privacy policy effective April 2, 2026, making several wording changes around data collection and analytics. The policy now states that activity information is saved 'by your activity controls' rather than 'in your account,' and references 'ad and analytics services' more generically instead of specifically naming Google Analytics. The policy clarifies that third-party sites and apps 'still share' (not 'may still share') information with Google even when using private browsing modes, making data collection practices more explicit. Minor updates were also made to health data processing language under Washington and Nevada state laws.

Google agreed to pay $68 million to settle a class action lawsuit alleging Google Assistant recorded users without intentional activation and shared those recordings with third parties, violating privacy rights. The settlement covers people who purchased Google devices like Home, Nest Hub, or Pixel phones, or had their communications recorded by Google Assistant between May 2016 and March 2025. Eligible class members can file claims for cash payments once the settlement receives final court a...

Jeffrey Epstein's victims sue Trump and Google over personal data leak

Jury rules against Meta and YouTube in social media addiction case

Google moves post-quantum encryption timeline up to 2029

Legal action reported by Ars Technica: Lawsuit: Google Gemini sent man on violent missions, set suicide "countdown"

A federal jury in San Francisco ordered Google to pay $425 million in a class- action lawsuit covering approximately 98 million users whose data was collected despite having disabled the Web & App Activity tracking setting in their Google accounts. The jury found Google continued accessing users' mobile devices to collect and save data over an eight-year period.

France's CNIL fined Google a record €325 million (€200M against Google LLC, €125M against Google Ireland) for inserting advertisements disguised as emails into Gmail inboxes without valid consent, and for placing advertising cookies when users created Google accounts without proper consent. The case originated from a complaint by privacy group NOYB.

Texas Attorney General Ken Paxton announced a historic $1.375 billion settlement with Google over violations of Texans' privacy rights, including unauthorized collection of biometric data (facial geometry, voiceprints), deceptive location tracking, and misleading Incognito mode disclosures. This was the largest state privacy settlement ever obtained against Google.

Google reversed its longstanding plan to deprecate third-party cookies in Chrome, abandoning a commitment first made in 2020. Instead, Google said it would offer users a choice prompt about cookie tracking. The reversal came after pressure from the UK's CMA over antitrust concerns and repeated delays to the original timeline.

Google settled the Chrome Incognito mode class-action lawsuit, agreeing to delete billions of browsing data records collected from users who believed they were browsing privately. Google also committed to blocking third-party cookies by default in Incognito mode for five years and rewriting its privacy disclosures. The settlement was valued at approximately $4.75 billion.

France's competition authority fined Google €250 million for using French news publishers' content to train its Bard/Gemini AI chatbot without notification or consent, and for failing to negotiate content licensing fees in good faith. This was the first major fine globally targeting a company's use of news content for AI training.

Google made Consent Mode v2 mandatory for all websites serving ads to or tracking EU/EEA users. Without implementation, Google Ads and GA4 would stop capturing data about new EEA users. The update introduced granular consent parameters for ad personalization and user data, aligning with GDPR requirements.

Alphabet agreed to pay $350 million to settle a shareholder lawsuit over the Google+ data breach. A software bug between 2015 and 2018 exposed personal data of approximately 500,000 Google+ users, and the lawsuit alleged Google concealed the breach for months while publicly touting its data security.

Google announced general availability of the Privacy Sandbox APIs in Chrome, including Topics, Protected Audience (formerly FLEDGE), and Attribution Reporting. This marked the major milestone of shipping the cookie-replacement technologies after three years of development and regulatory scrutiny.

Eight plaintiffs filed a class-action lawsuit against Google, Alphabet, and DeepMind in federal court, alleging Google scraped massive amounts of web data including copyrighted material and personal information to train Bard and other AI products, violating privacy, anti-hacking, and intellectual property laws.

Google updated its privacy policy to explicitly state it may use publicly available information from the internet to train its AI models including Bard, Translate, and Cloud AI. The change broadened the prior language from training 'language models' to training 'AI models,' sparking concern from privacy advocates and a class-action lawsuit filed on July 11.

Google announced a new policy to delete accounts inactive for two or more years, starting December 1, 2023. Inactive accounts and their data, including Gmail, Drive, Photos, and YouTube content, would be permanently deleted. Google cited security risks, as inactive accounts are more likely to be compromised.

Google agreed to a $391.5 million settlement with 40 U.S. state attorneys general over deceptive location tracking practices. The investigation found Google misled users about the scope of its Location History and Web & App Activity settings, continuing to collect location data even when users believed tracking was disabled.

Spain's AEPD fined Google €10 million for two violations: unlawfully sharing users' right-to-be-forgotten requests (including personal data) with the Lumen Project at Harvard, and obstructing citizens' right to erasure under GDPR Article 17 by making the removal process unnecessarily complex.

Google officially killed FLoC and announced the Topics API as its replacement within the Privacy Sandbox. Topics API assigns users interest categories based on browsing history and shares a limited subset with advertisers, aiming to address the fingerprinting and discrimination concerns raised against FLoC.

France's CNIL fined Google a total of €150 million (€90M for Google LLC, €60M for Google Ireland) for making it difficult for users to refuse cookies on google.fr and youtube.com. Accepting cookies required one click, while refusing them required five clicks, violating French data protection law.

Google began testing Federated Learning of Cohorts (FLoC) in Chrome 89 as its proposed replacement for third-party cookies. FLoC grouped users into behavioral cohorts for ad targeting. Privacy advocates, the EFF, and competing browsers like Brave and Vivaldi rejected FLoC, calling it a new privacy risk that enabled fingerprinting and discrimination.

Google and YouTube agreed to pay a record $170 million to settle FTC and New York Attorney General allegations that YouTube illegally collected personal information from children under 13 without parental consent, violating COPPA. YouTube was required to implement a system for channel owners to identify child-directed content.