State Accused Tech Giant of Geolocation, Incognito Search, Biometric Violations
Texas reached a nearly $1.4 billion settlement agreement with technology giant Alphabet after accusing its Google subsidiary of violating state privacy laws.
See Also: How Linking Identity, Data Security Can Help Cyber Response
Texas Attorney General Ken Paxton sued Google twice in 2022, accusing the tech giant of deploying facial and voice recognition technology in consumer products, capturing biometric data without informed consent. He also accused Google of misrepresenting the privacy protections of its Chrome browser Incognito mode and of tracking users’ location even if they turn off geolocation feaures.
“For years, Google secretly tracked people’s movements, private searches and even their voiceprints and facial geometry through their products and services,” said Paxton in a Friday statement. “This $1.375 billion settlement is a major win for Texans’ privacy and tells companies that they will pay for abusing our trust.”
Alphabet, based in Mountain View, California, reported consolidated, unaudited 2024 revenues of $350 billion – up 14% from the year prior.
The company said Texas’s grievances have already been addressed via product or policy changes, although the company has admitted no wrongdoing or liability.
“This settles a raft of old claims, many of which have already been resolved elsewhere, concerning product policies we have long since changed,” Google spokesman José Castañeda told Information Security Media Group.
Other states have also pursued Google for violating their privacy laws and reached settlement agreements, although none of those settlements has surpassed $93 million. “Even a multistate coalition that included 40 states secured just $391 million – almost a billion dollars less than Texas’s recovery,” the Texas attorney general said.
Paxton first filed suit against Google in January 2022, alleging that the company was violating Texas’ Deceptive Trade Practices Act by misleading consumers over its user-tracking practices. “Google provides a setting called ‘Location History’ and tells users that, if they turn it off, ‘the places you go are no longer stored,'” although still continued to track their location using “other settings and methods that it fails to adequately disclose,” the state attorney general’s office said at the time.
The attorney general amended the state’s lawsuit in May 2022, accusing Google of continuing to track users’ behavior even after they enabled the incognito “private browsing” mode in its Chrome browser, even though that feature “implies to consumers that Google will not track your search history or location activity.”
Texas’ lawsuit accused Google of engaging in “surreptitious” tracking even after a user activated “private browsing mode,” for which Google had promised users: “You can choose to browse the web privately using Chrome in Incognito mode.”
Paxton sued a second time in October 2022, accusing Google of illegally obtaining and storing people’s biometric information, including voiceprints and facial geometry “through its products and services like Google Photos, Google Assistant and Nest Hub Max,” without first obtaining express consent. The attorney general alleged that this violated the state’s Capture or Use of Biometric Identifier Act.
The state attorney general’s case against Google faced some setbacks. In January, a Texas appeals court found that the state’s courts lacked the authority to hear the incognito allegations, because the conduct occurred outside of the state.
Paxton’s office previously reached $700 million and $8 million settlements with Google over what the state alleged were the company’s anticompetitive and deceptive trade practices.
Last summer, Paxton announced the launch of a dedicated data privacy team tasked with enforcing residents’ privacy rights.
In July 2024, Meta – formerly known as Facebook – agreed to pay $1.4 billion to settle a lawsuit filed by the Texas attorney general’s office over the company’s capture of Texans’ biometric data. That was the first lawsuit to be brought under the CUBI Act.
Among other requirements, CUBI stipulates that anyone who captures or possesses a biometric identifier – “a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry” – even with an end user’s permission must typically “destroy the biometric identifier within a reasonable time, but not later than the first anniversary of the date the purpose for collecting the identifier expires.”
Beyond facing multiple state lawsuits filed over its incognito mode, Google also faced a class action lawsuit filed by U.S. consumers. In late 2023, Google settled that lawsuit for $5 billion.