When Google C.E.O. Sundar Pichai appeared on Capitol Hill in 2018, as part of a congressional inquisition of tech leaders, it was easy to poke fun at the spectacle. Lawmakers had clearly planned to knock Silicon Valley elites down a few pegs, but they lacked the vocabulary to land the big Perry Mason moment. And so we got comical episodes like when Rep. Ted Poe held up his phone and said, “If I move from here and go over there… does Google know that I moved to the left?” Pichai tried to explain that it depends on settings and apps opened, which caused the frustrated Texas Republican to blurt out, “It’s not a trick question!” Other times, Pichai was able to effectively parry the questions with feel-good bromides: “It’s really important to us for average consumers to understand [the information collected by Google]. We remind users to do a privacy checkup. And we make it obvious.”
Video footage of Pichai’s congressional testimony may play differently if ever shown to a jury. That could happen in a case that centers on how Google collects and uses data from those who have turned on the private “Incognito” mode on the company’s Chrome web browser. The plaintiffs estimate billions of dollars in damages from the interception of private browsing information that includes sexual interests and political views, and thanks to a judge’s recent order sanctioning Google for discovery misconduct, the tech giant may find it more difficult to defeat the suit. In fact, because of this rather extraordinary sanctioning, should the case get to trial, the jury could hear about Google’s efforts to hide key witnesses and evidence.
But let’s be honest, the good class actions tend to settle. This one in particular has the potential to be very good (Texas even brought a copycat lawsuit last month), so before it maybe goes away quietly, let me share what’s been happening—and what could happen next.
When this lawsuit was filed back in 2020, it was no slam dunk, and it’s no surprise that most reporters stopped following the case as it slowly plodded along. (Plus, Google convinced the judge to bar the public from attending certain hearings.) Represented by high-powered law firms including Boies Schiller, Susman Godfrey, and Morgan & Morgan, the plaintiffs are trying to glom onto an old federal wiretapping statute that’s had a mixed track record in lawsuits over the years in holding tech companies accountable for surreptitious internet tracking.
In response to the suit, Google did what many defendants have done when facing a law that predates the internet age and was really meant to stop covert monitoring of telephone conversations: it pointed to its terms of service (“Do you agree? Click yes.”) and argued that Chrome users consented to data collection. Sure, Google might tell those users they can go into private “Incognito” mode, but company lawyers argued this really just means privacy from other people who use the same device. It doesn’t mean Google can’t scoop up what it wishes.
C’mon, responded plaintiffs’ lawyers, arguing this narrow sense of privacy wasn’t clear at all from the splash screen that Chrome users see when they turn on Incognito.
In May 2021, U.S. District Court Judge Lucy Koh sided with the plaintiffs and rejected a motion to dismiss. That meant the case headed into discovery, where plaintiffs’ lawyers collected all sorts of potentially damaging material to Google. For instance, Google employees have described the Incognito mode internally over the years as “effectively a lie,” “misleading,” “a confusing mess,” “not truly private,” and delivering a “false sense of privacy.”
Nevertheless, the plaintiff lawyers had some issues to work out. The complaint identifies all sorts of ways that Google collects browsing data—Google Analytics, “fingerprinting” techniques, Ad Manager, etc.—but could the company actually tell when a Chrome user has enabled Incognito mode? Who exactly were the injured Chrome users? If they couldn’t be identified, class certification was hopeless. And how to assess damages? What portion of browsing data collected was private browsing data?
The attorneys had theories—search the phrase “X-client-data header” if you’re the technically-minded sort—and pursued them, and the defendant was repeatedly told to produce certain information. That itself wasn’t unusual, but from the looks of magistrate judge Susan Van Keulen’s May 20 sanctioning order (a redacted version recently became available), plaintiffs really had to chase hard for relevant information, even as Google was representing to the court that it was making its best efforts to turn over responsive documents. Van Keulen ultimately concluded that Google had, in fact, violated discovery orders.
Just two weeks before the end of discovery, plaintiffs learned a key part of the story when Google finally turned over explosive information. As it turns out, Google has been logging Incognito traffic as far back as 2017. Three years ago, one employee began to evaluate the economic impact to Google of blocking third-party cookies by default in Incognito mode. In 2020, three other employees worked on a similar project. At one point, one of the project members noted the “[p]otential privacy risk of logging inferred Chrome incognito detection” and sought “feedback from privacy gurus.”
Again, this stuff was only turned over very late in the process. Google now is facing a motion for Pichai to sit down for a deposition. (I gave Google’s lawyer at Quinn Emanuel an opportunity to explain. He passed along the request to his client, who hasn’t followed up with me.)
For Google’s negligence (if not bad faith malfeasance), the judge has issued a series of punishments. Perhaps most importantly, Google is precluded from arguing that it never implemented its Incognito detection protocol. (The company will still be allowed to argue about the unreliability of such detection when opposing class action certification.) Google also won’t be able to use testimony from the four employees who were working on measuring the economic impact of privacy settings. Whatever explanations or caveats they have, that’s now out of bounds. And should the case go to trial, and the discovery misconduct comes up, jury instructions about Google’s failure to disclose witnesses and evidence have been deemed appropriate.
$2,000 an hour
Google was also hit with one final punishment that may actually be more consequential for the law firms representing the plaintiffs than for the company itself: Google had to pay attorneys’ fees and costs associated with the sanctions motion, revealing precisely what famed attorneys like David Boies are really charging these days.
Law can be weird at times. Kick your opponent’s ass hard enough, and you might have to disclose your pay. That’s because the law attempts to discourage frivolous motions and any rule-breaking. And so, there are times when fees shift from losers to winners. In these instances, judges demand a breakdown of the charges. Then, they sometimes land in the hands of nosy reporters.
In the privacy case over Google’s Incognito mode, we now have a public filing about what various partners and associates make at Boies Schiller, Susman Godfrey, and Morgan & Morgan. The total bill for this one sanctions fight came to $1,078,924.43, which includes 1,167 lawyer hours, $29K worth of experts, and some other small computer and travel expenses.
Boies didn’t do a lot of work here, but for those 49 hours, he’s now charging $1,950 an hour. He’s pretty close to the rarefied class of attorneys charging more than $2,000 for 60 minutes of time, which now includes a Covington partner billing a Ukrainian company $2,500 an hour.
At these plaintiffs’ firms, nine partners with fee rates north of $1,000 worked on this case. That includes Morgan & Morgan class action chief John Yanchunis ($1,300 an hour) and Boies Schiller data privacy pro Mark Mao ($1,100 an hour). The only partner who worked more hours than those two was Susman Godfrey’s Amanda Bonn, who probably deserves a raise (or a new firm). At $725 an hour, she’s making less than some associates on this case even though she was once named a Litigation Trailblazer by the National Law Journal. As for the associate who gets credited with the bulk of the work, his name is Ryan McGee and he clocked 182 hours at Morgan & Morgan.
Of course, logging billable hours isn’t always the most honest endeavor, and judges have been known to adjust downwards. I make no judgment about the integrity of these numbers, though I reserve the right to dish out more attorney fee reports in future editions of this column.
Also, if the case does settle, there will certainly be a humongous legal fees motion made. These lawyers, working on contingency, will likely want a good portion (15 percent? 30 percent?) of the settlement pot. The judge will need to approve. Another way to look at this development is that these firms made a million dollar bet that this sanctions chase would eventually pay out. Presumably, they’re investing multiples more on the rest of the case. It’s evidence of huge expectations for a massive score.