Attorney Chris Sheean comments on Gaos v. Google, a class action lawsuit that seems to have been inspired by a complaint Chris Soghoian had filed with the FTC, mentioned previously on this blog. The background on the lawsuit, as provided by Sheean:
[…]
In the Gaos suit, Google is alleged to have violated the privacy rights of those who use Google’s search platform. The suit alleges that Google profits by providing its customers (companies seeking to improve their overall ranking and visibility in Google search results) with the search queries that are used to locate and click on a link to that customer’s website. When a Google user enters a search query, activates a search, and then clicks on a result in the search, the web address of that site will have a “Referrer Header,” a string of characters that contains the user’s search query. For example, if a user typed in a search for “hardware store in Toledo, Ohio” the Referrer Header would look like “http://www.google.com/search?q+hardware+store +in+Toledo+Ohio”. The Gaos suit alleges that by transmitting the search queries, Google has disclosed to third parties its users’ private information in violation federal and California law, as well as in violation of Google’s own privacy statement.
In apparent recognition that it would be near to impossible to identify a Google user solely by analyzing a single search query, the Gaos complaint theorizes that third parties are able to “deanonymize” Google users through a process called “accretion,” where some ne’er-do-wells are able to link together the personal information of individuals, such as email addresses, with information about those individuals, such as shopping and searching habits gleaned from studying search queries. The complaint speculates that through accretion, these nefarious third parties will link up the information submitted with the query itself to the user’s identity, and thereby learn all sorts of private and personal information about the user. The examples the complaint gives include those individuals who perform “vanity searches,” where an individual enters his or her own name to discover where on the internet their name might appear. The complaint goes on to speculate that a Google user could be searching for medical information relating to personal medical issues, and the release of such information would constitute a significant privacy violation. While it’s true that the release of an individual’s medical records and related information would be a potential violation of that person’s rights to privacy, the complaint fails to give any actual instance of such an occurrence, let alone a plausible explanation of how such a gaffe would occur.
There are at least 2 fundamental problems with the claims asserted in the Gaos suit: first, it asks the court to make huge leaps in facts and engage in rank speculation to find any privacy violations; and second, the facts of any actual privacy violations and the alleged harms that would result are so intertwined with individualized facts as to make the case wholly inappropriate for class action treatment.
Read more on Point of Law.