UNITED STATES OF AMERICA v. Google, Inc.

Filing 28

Opposition [Revised] to the Entry of [Proposed] Stipulated Order For Permanent Injunction and Civil Penalty by Consumer Watchdog. (Reback, Gary) (Filed on 10/23/2012) Modified on 10/24/2012 (ysS, COURT STAFF).

1
2
3
4
5
6
7
8

GARY L. REBACK (SBN 100118)
[e-mail]
ROBERT J. YORIO (SBN 93178)
[e-mail]
MARCUS H. YANG (SBN 273509)
[e-mail]
CARR & FERRELL LLP
120 Constitution Drive
Menlo Park, California 94025
Telephone: [phone]
Facsimile: [phone]
Attorneys for Amicus Curiae
CONSUMER WATCHDOG

9
10

UNITED STATES DISTRICT COURT

11

NORTHERN DISTRICT OF CALIFORNIA

12

SAN FRANCISCO DIVISION

13

UNITED STATES OF AMERICA,

14
15

Plaintiff,
v.

16
17
18

GOOGLE INC.,

CASE NO. CV 12-04177 SI
REVISED REPLY MEMORANDUM OF
POINTS AND AUTHORITIES IN
OPPOSITION TO THE ENTRY OF
[PROPOSED] STIPULATED ORDER FOR
PREMANENT INJUNCTION AND CIVIL
PENALTY

Defendant.

19
20
21
22
23
24
25
26
27
28
{00654828v1}Revised Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

1

This reply memorandum addresses two issues raised by the parties’ responsive briefs.

2

The first goes to the adequacy of the remedy in the proposed order and, specifically, the extent to

3

which Google continues to derive monetary benefit from its misconduct. An analysis of several

4

of the conclusory statements from the government’s brief, in the context of the technology at

5

issue here, reveals that the deal between the parties does not even prevent Google from

6

continuing to violate the Buzz Decree. Nor does it prevent Google from continuing to profit

7

from the misconduct that it previously engaged in. The second issue involves the appropriate

8

legal standard for review by the Court – specifically, whether the proposed consent decree needs

9

to meet the “public interest” standard.

10
11

A.

The Parties’ Proposed Order Permits Google to Continue to Profit from Its
Misconduct.

12

Consumer Watchdog’s initial brief identified a number of serious deficiencies in the

13

proposed order – the lack of a permanent injunction as contemplated by the complaint, a

14

monetary penalty insufficient to satisfy either the objective of the statute or the stated objective

15

of the Commission, and the defendant’s outright denial of liability in the proposed order – and

16

argued that the proposed order fails to satisfy the relevant legal standard. In reply, the

17

government argued (among other things) that the remediation section of the proposed order

18

“shields consumers from potential continued harm.” Gov’t Brief at 6. The government also

19

asserted that Google “earned no more than $4 million from the alleged violation,” Gov’t Brief at

20

10, n.11, but provided no explanation of any kind for its calculation. See Bartley Decl. ¶ 6.

21

As we explained in our motion to file a reply brief, granted by the Court (Dkt. 25), when

22

we examined these assertions in light of the “remediation” section in the proposed order, it

23

became apparent that the order proposed to this Court does not eliminate or prevent “potential

24

ongoing harm.” Indeed, it permits Google to continue to profit from its wrongdoing indefinitely.

25

Basically, the proposed remediation requires Google to “expire” the cookies it set in violation of

26

the Buzz Decree, but permits Google to keep the data those cookies collected (including IP

27

addresses) and to use that data in its ongoing business, thereby continuing to profit from its

28
{00654828v1}Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

1

1

misconduct. The government is either unaware of this result or has simply neglected to mention

2

it to the Court, the press and the public.

3

We base this argument on our understanding of how tracking cookies generally work and

4

on what Google said on its site about how it uses DoubleClick cookies – – up until a few days

5

ago, when, after reading the Consumer Watchdog reply brief filed on October 18, Google

6

changed its site to obscure the embarrassing admissions. In anticipation of this conduct, we

7

printed the relevant portion of the site prior to Google’s changes and attach it here as Exhibit A.

8

See How does Google use the DoubleClick cookie to serve ads?,

9

http://www.google.com/policies/privacy/ads (retrieved, as indicated on the document, on

10

October 18, 2012 and attached as Exhibit A). In anticipation that Google may attempt to change

11

the site back before the Court can detect the alterations, we attach a print out of the relevant

12

portion of the site as of October 22, 2012 as Exhibit B (retrieved on October 22, 2012). Exhibit

13

B is the page the user is now taken to if he now types “How does Google use the DoubleClick

14

cookie to serve ads?” – – despite the fact that the page has been altered to eliminate that text.

15

•

In violation of its obligations under the Buzz Decree, Google placed DoubleClick

16

tracking cookies on Safari users’ computers without permission in two different ways.

17

The blog post of the FTC’s (now former) chief technologist explained what Google did to

18

place the cookies. See Ed Felton, FTC Settles with Google over Cookie Control

19

Override, http://techatftc.wordpress.com/2012/08/09/google/. Basically, Google’s

20

DoubleClick server sent Safari users’ computers small files, each containing a cookie ID

21

(usually a string of letters and numbers).

22

•

At the same time, DoubleClick created database entries on its systems corresponding to

23

the cookie IDs. This fact was not stated, insofar as we can tell, in any of the FTC’s

24

written or oral explanations, either to the public or to this Court. Google’s new privacy

25

policy page now discloses this fact. See Exhibit C at 2. Undersigned counsel was not

26

aware of the significance of this fact until he made inquiries after reading the

27

government’s filings in this case. As the Stanford researcher originally credited by the

28

Wall Street Journal for revealing Google’s Safari “hack” recently explained in a
{00654828v1}Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

2

1

presentation at The London School of Economics (posted to the web on October 12,

2

2012):

3

[C]ookies don’t collect anything. Cookies are just a little piece of

4

information that gets saved in a browser. It’s the website that

5

collects things.

6

information but because of their cookies, Google collected

7

personal information.

And so sure, cookies don’t collect personal

8

LSE Safari-gate meeting transcript, http://www.privacysurgeon.org/blog/lse-safari-gate-

9

meeting-transcript/ (at 24:21).

10

•

The cookie ID was stored on each user’s computer, but was sent back to DoubleClick

11

with each HTTP request by the user’s browser, and data about the user was recorded in

12

the DoubleClick database. HTTP requests usually contain (among other things) the URL

13

of the page requested, the URL of the page the user is currently on (the referrer URL),

14

and the IP (Internet Protocol) address of the user. The IP address is simply a unique

15

number assigned to each computer or device connected to the Internet. (If the user runs a

16

search, the URL will contain the search terms.) All of this user data was recorded in the

17

DoubleClick database, along with the cookie ID. See Exhibit A at 5.

18

•

Because DoubleClick receives in one request both the URLs and the cookie ID, it can

19

associate those URLs with the particular ID in its database. This permits Google to get a

20

detailed picture of each user’s web browsing and search activities. DoubleClick uses this

21

information to serve targeted ads to the cookie ID when that cookie ID shows up on a site

22

in Google’s DoubleClick network. Safari’s default privacy controls – which block third-

23

party cookies (like DoubleClick’s) by default – are intended to prevent this result. But

24

Google created a workaround for this setting, which allowed Google to continue to set

25

DoubleClick cookies, track users and serve those users targeted ads.

26

The “remediation” requirement in the Proposed Stipulated Consent Order only requires

27

Google to “expire” the cookies it set on Safari browsers before February 15, 2012. The proposed

28

order does not require Google to delete the data it collected against these cookie IDs (i.e., the
{00654828v1}Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

3

1

data in Google’s (DoubleClick’s) databases). Nor does the proposed order impose any limits on

2

what Google can do with this data. Google can and will use the data for profit on a going-

3

forward basis.

4

By “expiring” the wrongfully placed cookies, Google can no longer associate particular

5

user data in its database with a particular wrongfully placed cookie ID, as the “expired” IDs are

6

no longer valid. The next time the user goes on DoubleClick, he will get a new cookie ID.

7

However, his IP address will not likely change, and, as Google’s FAQ site indicated before

8

alteration (Exhibit A at 5), Google has already collected and stored IP addresses for the

9

wrongfully-placed cookies. So, by referring to the user’s IP address, Google can continue to use

10

the wrongfully obtained data and track the user in the future and serve him targeted ads. In other

11

words, using the IP address, Google can associate the user’s new cookie ID with the wrongfully

12

obtained data in its database.

13

The court will note that the Google FAQ site before October 18, 2012, merely listed IP

14

addresses as one of the items of user information Google collected. See Exhibit A at 5. As

15

indicated above, that page has been eliminated by Google. Now elsewhere on its site, Google

16

describes IP addresses, gratuitously adding that “depending on the user’s server, a different

17

address may be assigned to the user by their service provider each time they connect to the

18

Internet.” Exhibit D at 2. While this is technically true, it so rarely happens that companies use

19

IP addresses to associate different cookie IDs on the same machine across search sessions all the

20

time.

21

It is common knowledge and common practice in the industry to use IP addresses and

22

“referrer fields” (another item collected by Google cookies) to track internet users’ browsing.

23

See HTTP cookie, http://en.wikipedia.org/wiki/HTTP_cookie (“Tracking cookies may be used to

24

track internet users’ web browsing. This can also be done in part by using the IP address of the

25

computer requesting the page or the referrer field of the HTTP request header, but cookies allow

26

for greater precision.”)

27
28

The proposed order does not prohibit Google from doing this. So the proposed order
permits Google to go right on using improperly obtained user data for commercial purposes – –
{00654828v1}Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

4

1

including continuing to target advertising to the Safari users who received Google cookies

2

improperly. The proposed order could prevent this result simply by requiring Google both to

3

expire the cookies and to expunge all data collected from those cookies.

4

Moreover, even if (for whatever reason) Google is not using IP addresses to continue

5

targeting the Safari users – – and cannot in the future (for whatever reason) associate the data

6

entries in its database with particular cookie IDs (or even particular IP addresses), Google will

7

still profit from the data it collected in violation of the Buzz Decree. More specifically, the kind

8

of profile data Google collected can be used for profitable purposes other than targeting

9

advertising to the particular users from whom data was initially collected. For example,

10

analyzing a number of profiles helps Google to understand typical search patterns (for example,

11

people who visit NYTimes.com are more likely to visit other newspaper sites in the same

12

browsing session).

13

The wrongfully collected data, then, can still be used to target others (sometimes called

14

“lookalikes”) who exhibit similar behaviors. For example, if Google’s wrongfully collected data

15

shows that people in a particular browsing pattern (e.g., tech blogs) are more likely to click on a

16

particular ad (e.g., an ad for Google’s Chrome web browser), this information can be used to

17

target ads at users who exhibit similar behavior in the future.

18

As Paragraph 50 of the Buzz Complaint alleges, Google collected and used – and, as we

19

now know, continues to use – information about web-browsing activity from Safari users to

20

whom it represented that it would not collect such information. According to the Buzz

21

Complaint, this continuing conduct violates Part 1(A) of the Buzz Decree – misrepresenting the

22

extent to which users may exercise control over the collection or use of covered information.

23

See Safari Complaint at ¶ 51. Again, the proposed order could prevent this result simply by

24

requiring Google to expunge the wrongfully collected data from its database. If Google (or the

25

government) contends that it cannot identify the data fields of affected Safari users with

26

particularity, Google should be required to expunge its entire database of Safari users and start

27

over. After all, according to the declaration supporting the government brief, “[t]he FTC only

28

included or excluded relief based on what it determined to be in the best interests of consumers.”
{00654828v1}Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

5

1

Permitting Google to settle this case without expunging wrongfully collected data runs

2

afoul of the position taken by the FTC in a prior Google investigation. As we noted in our initial

3

brief, the FTC closed down its investigation of the Wi-Spy scandal only after Google publicly

4

stated its “intention to delete the inadvertently collected data as soon as possible” and gave

5

“assurances to the FTC that the company ha[d] not used and [would] not use any of the

6

[wrongfully collected data] in any Google product or service, now or in the future.” The FTC’s

7

Director of the Bureau of Consumer Protection based the Commission’s decision to close the

8

investigation squarely on this representation: “This assurance is critical to mitigate the potential

9

harm to consumers from the collection of payload data,” he wrote. See Consumer Watchdog

10
11

Initial Memorandum at 3.
Perhaps, in the Court’s discretion, the Court may wish to defer to the FTC’s judgment –

12

however suspect and unsupported – as to the propriety of an order intended to deter Google from

13

future misconduct. But it is hard for us to imagine that the Court would approve a settlement

14

that does not even stop Google from continuing the very misconduct alleged in the complaint.

15

Under any legal standard, the proposed remedy is simply inadequate.

16

We are mystified as to why the government did not point out to the Court Google’s

17

ability to continue to use improperly-collected data in the future. Surely, this is something the

18

Court would like to know in evaluating the proposed settlement. We believe the government

19

should have given the Court the technical background we have provided in this brief. Indeed, we

20

do not know which is worse – the government’s failure to stop Google’s continuing misconduct

21

or the government’s failure to disclose to the public and this Court that Google will continue to

22

use the improperly collected data.

23

The government’s brief claims that Google “earned no more than $4 million from the

24

alleged violation” and that the penalty “was many times the upper-bound of what the FTC

25

estimates the company earned from the alleged violation.” Gov’t Brief at 9-10 and n. 11. The

26

brief also claims difficulty in making a “per violation” calculation because “only a small subset

27

of Safari users viewed the misrepresentation.” The brief gives no indication that the government

28

included or even understood that Google would continue to profit from its misconduct.
{00654828v1}Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

6

1

In any case, third party analysts had far less difficulty calculating the appropriate penalty

2

than the government now claims to. According to the FTC, there are 190 million Safari users. 1

3

Also, according to the FTC, every Safari user “probably received a DoubleClick tracking cookie

4

during the relevant time period.” 2 If even one-tenth of one percent of Safari users saw the

5

misrepresentation, the statutory penalty would exceed $3 billion. An independent analyst, using

6

the most conservative assumptions possible, estimated the statutory penalty at $8 billion.3 Surely

7

the government could have made a realistic calculation of how many Safari users saw the

8

misrepresentation had it bothered to compel discovery from Google

9

Of course, this just represents a calculation of the statutory penalties. As the government

10

points out, the issue for this Court is not simply the size of the penalty under the statute, but

11

rather the benefit obtained by Google from its misconduct (and the consequent harm to

12

consumers). The deterrent effect from the settlement, according to the government, flows from

13

the government’s unsupported assertion that the negotiated penalty exceeds the government’s

14

estimate of what Google earned from its misconduct.

15

But, in making an estimate of what Google earned from its misconduct, there is no reason

16

to limit the calculation to users who saw the misrepresentation. Harm to users comes less from

17

the fact that people were falsely assured by Google that leaving the Safari settings unchanged

18

would prevent them from being tracked than it does from the circumvention of users’ privacy

19

settings in the first place.

20

Millions upon millions of users had their browser settings overridden as a result of

21

Google’s intentional misconduct - - regardless of whether they saw Google’s notice. These users

22

exercised a choice about allowing third parties to track them, and Google intentionally

23
24
25
26
27

1

FTC Google Twitter Chat Transcript
http://www.ftc.gov/opa/socialmedia/twitterchats/120809googletwtchat.pdf.
2

Ed Felton, FTC Settles with Google Over Cookie Control Override
http://techatftc.wordpress.com/2012/08/09/google/.
3

Elizabeth H. Johnson, High Stakes,
http://www.poynerspruill.com/publications/Pages/GoogleAllegedCircumventionSafariPrivacySet
tings.aspx.

28
{00654828v1}Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

7

1

disregarded that choice. The reason Google engaged in this conduct was to circumvent controls

2

that were preventing it from profiling people, and selling ads based on those profiles.

3

The benefit Google reaped from this conduct is not limited to monetizing the data

4

collected from users who saw the misrepresentation. Neither the government nor Google could

5

possibly argue this. The benefit to Google comes from its having collected data from estimated

6

190 million users who had chosen not to have their data collected by third parties.

7

The government has not given this Court any insight into how it made its calculations.

8

From what is available in the government’s brief, and from Google’s site (before alteration) and

9

from other sources on the web, we believe we have shown: (1) that Google has continued to

10

profit from its misconduct by tracking Safari users whose cookies were “expired”; (2) that

11

Google can (and does) continue to profit from the data it improperly collected by profiling other

12

users with this data and otherwise employing the improperly collected data in its services; and

13

(3) that the benefit to Google from its misconduct is not limited to users who saw Google’s

14

misrepresentations. We cannot more precisely quantify the amount of Google’s monetary

15

benefit without taking discovery of Google - - something the government should have done. If

16

the Court seeks more precise calculations from us, we ask that the court permit us to take

17

relevant discovery.

18

Issues regarding web privacy involve technical details that make blatant and intrusive

19

privacy violations seem academic and rather innocuous. A comparison to real world privacy

20

violations might be helpful to explain the consequences of approving the proposed order.

21

Suppose a Peeping Tom were loose in a residential neighborhood. The Peeping Tom,

22

once apprehended by the authorities, was shown to have both leered into people’s bedrooms and

23

bathrooms at night and to have taken pictures of what he saw. The government now proposes to

24

settle the case with the Peeping Tom by preventing him from leering into people’s homes in the

25

future. But the government proposes to let the Peeping Tom keep all the invasive pictures he has

26

taken, and publish them in a book for profit. At very most (under the provisions here) the

27

government would require the Peeping Tom to delete street addresses and to obscure the facial

28

characteristics of his victims so that they cannot be identified easily – and he could then go ahead
{00654828v1}Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

8

1

with publication. Ordinary people would find it difficult to understand such a result under any

2

legal standard.

3
4

B.

The Court Should Apply the Public Interest Standard in Evaluating
FTC Settlements.

5

The parties would have this Court be the first in the nation (of which we are aware) to

6

hold that consent settlements involving the Federal Trade Commission need not be in the public

7

interest. Only a few months ago, when the FTC volunteered in federal court that its consent

8

settlements had to meet the public interest standard, it made no effort to limit that admission to

9

any particular federal circuit. We find it hard to imagine that the Commission could now (or

10

ever) take the position that it did not have to act in the public interest or otherwise satisfy the

11

public interest standard.

12

We are aware, of course, that this Court and others in this circuit have evaluated consent

13

decrees involving government agencies under a legal standard that does not expressly include the

14

public interest requirement. But the FTC Act, under which this suit is brought, has its own

15

legislative history. As we explain below, the Act was amended expressly to empower the

16

Commission to protect the public, and, hence, we believe that the Commission’s actions under §

17

5(l) of the Act must satisfy the public interest standard. The government seems to recognize the

18

point. In Circa Direct, the FTC conceded that “a district court reviews a proposed consent

19

decree to ensure it . . . serves the public interest as articulated in the underlying statute.” March

20

14, 2012 FTC submission at 2. The government in this case quotes that same passage for

21

precisely the same point. See Gov’t Brief at 3, n.4.

22

The government brings this case under § 5(l) of the FTC Act. That section was amended

23

in 1938 expressly to give the FTC the responsibility to protect the public interest at large. See S.

24

Rep. No. 75-221 at 2 (1937). Prior to the amendment, the Commission was empowered only to

25

act in “private controversies” among competitors. Thus, the amendment empowered the

26

Commission to stop “exploitation and deception of the public” even without injury to

27

competitors of the defendant. S. Rep. No. 75-221 at 3 (1937). And the Commission was given

28
{00654828v1}Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

9

1

the power to restrain unfair acts if the restraint “be in the public interest.” S. Rep. No. 75-221 at

2

3-4 (1937).

3

Similarly, the House Report stated that the amendments to Section 5 empowered the

4

Commission to prevent acts “which injuriously affect the general public,” and, specifically, “the

5

consumer.” See. H. R. Rep. No. 75-1613 at 3 (1937). Moreover, as we have noted, the Seventh

6

Circuit observed decades ago that the Commission “unlike a private litigant, must act in

7

furtherance of the public interest.” Johnson Prods. Co. v. F.T.C., 549 F.2d 35, 38 (7th Cir.

8

1977).

9

Many of our arguments go to the issue of whether the proposed settlement is “adequate.”

10

But, as both we and the parties have noted in briefing, the “public interest” standard is broader

11

and far less deferential than the more limited “fair, reasonable, and adequate” requirement. In

12

any case, we believe that the parties’ proposed order fails to meet the appropriate legal standard.

13

Dated: October 23, 2012

Respectfully submitted,

14
15
16
17
18

/s/ Gary L. Reback
Gary L. Reback, Of Counsel
Carr & Ferrell LLP
Attorneys for Amicus Curiae
Consumer Watchdog

19
20
21
22
23
24
25
26
27
28
{00654828v1}Reply Memorandum in Opposition to [Proposed] Stipulated Order for Permanent Injunction
(Case No. CV-12-04177 SI)

10