Google Class Action Over COVID-19 Contact-Tracing Settled With Security Measures

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

Update: 

• Google has agreed to a non-monetary settlement that will keep security measures in place following claims it exposed the personal information of Android users through a COVID-19 contact-tracing tool.
• Users asked a judge for preliminary approval of the agreement in a California federal court. 
• Users claimed Google violated the California Confidentiality of Medical Information Act, among other things, with its COVID-19 contract-tracing app it developed with Apple. 
• In addition to keeping the added security measures in place, Google will be barred from reverting relevant software improvements it has made, per the settlement.
• The app, called the Google-Apple Exposure Notification System, was introduced in May 2020 as a way for governments to track the spread of COVID-19.

Google Contact Tracing App Class Action Lawsuit Overview:

• Who: Plaintiffs Jonathan Diaz and Lewis Bornmann sued Google over the COVID-19 contact tracing app the tech company created in a joint project with Apple.
• Why: The plaintiffs allege the app exposed their sensitive personal information to third parties. Google is asking for the lawsuit to be thrown out, arguing the plaintiffs did not show that the technology disclosed personally identifiable information to anyone, and could not show they were harmed.
• Where: The lawsuit is playing out in federal court in Northern California.

(Sept. 1, 2021)

Google has asked a judge to throw out a class action lawsuit that claims its digital contact tracing app — created with Apple to manage the spread of COVID-19 during the pandemic — exposed sensitive user information.

The tech giant filed the motion to dismiss last Wednesday in a California federal court, where it pointed out that it had teamed up with Apple in 2020 to “quickly” develop technology to meet the needs of public health authorities, and then made the app available free of charge. 

“Apparently no good deed goes unpunished,” Google said in its filing. 

In April, Plaintiffs Jonathan Diaz and Lewis Bornmann alleged Android users who used a COVID-19 contact tracing tool created by Google and Apple had their sensitive personal information exposed to third-parties thanks to Google.

The pair claim Google violated the California Confidentiality of Medical Information Act and privacy laws in its implementation of the Google-Apple Exposure Notification System (GAEN) for coronavirus. 

The system, rolled out in May, 2020, was designed to help public health authorities track the spread of the novel coronavirus and notify a person if they had been exposed to someone with the virus. 

The program uses Bluetooth on individuals’ mobile phones to send signals about encounters with other people nearby who also have an app using the system. Google tells users it is made with privacy at its center, and assures people their identity is not shared with other users, Google, or Apple.

The class action says the contact tracing apps themselves generate secure personal device identifiers, which change periodically as they are broadcast to other devices. These identifiers should only be traceable with a “key” held by the public health authorities.

However, Google’s mobile services actually record the outgoing and incoming data on each device’s system log, the class action says. 

This means Android device users running Google’s software “unwittingly expose” not only their own personally identifiable information to numerous third parties, but also to users of the app on other devices that come near them, including iPhones, the plaintiffs alleged.

On Wednesday, Google argued that the case should be thrown out because the plaintiffs had not shown that the technology disclosed personally identifiable information to anyone, and could not show they were harmed. 

“Their claims instead hinge on an entirely hypothetical theory that unrelated apps engaged in an increasingly remote and malicious series of steps to attempt to learn something from crash- reporting logs,” Google said. 

“This is thus a textbook case about a hypothetical risk of harm that is not, in any event, fairly traceable to Google’s conduct.”

The class action says more than 28 million people across the U.S. have downloaded contact tracing apps that use GAEN or activated exposure notifications on their phones. California’s version of the app, CA Notify, has been downloaded to 1 million Androids and about 8.5 million Apple devices.

Meanwhile, Google is also facing lawsuits alongside Facebook claiming that it is pushing the newspaper industry to the brink of extinction through anti-competitive behavior, including a “secret deal” that allowed the pair to monopolize the digital advertising market.

Did you expect your data to be kept safe while using a contract tracing app? Let us know in the comments! 

The plaintiffs are represented by Michael W. Sobol, Melissa Gardner, Ian Bensberg, Nicholas Diamand and Douglas Cuthbertson of Lieff Cabraser Heimann & Bernstein LLP.

The Google Contact Tracing App Class Action Lawsuit is Diaz et al. v. Google LLC, Case No. 5:21-cv-03080, in the U.S. District Court for the Northern District of California.

Read About More Class Action Lawsuits & Class Action Settlements:

• Google Gives Netflix, Spotify, Tinder Preferential Treatment, Says Amended Epic Games Class Action Lawsuit
• Google Plus, Post Foods, Premarin, U by Kotex Settlement Checks on the Way
• Netflix and Hulu Failed to Register, Pay Fees Required Under New Jersey Law, Class Action Lawsuit Alleges
• DRN Invaded Privacy With License Plate Readers, Says Class Action Lawsuit