What Rodriguez v. Google reveals about user-facing privacy settings, third-party SDKs, app telemetry and the need to verify what data actually leaves an application.
By Claude Khoury, Chief Operating Officer, NSI Global
ORIGINAL PUBLICATION: 16 July 2020 SUBSTANTIVELY UPDATED: 6 October 2026
When NSI Global first reported on Rodriguez v. Google LLC in July 2020, the matter was a newly filed proposed class action alleging that Google continued receiving activity data from non-Google mobile apps even when users had paused or disabled relevant Web & App Activity controls.
Six years later, the case has become significantly more important. On 3 September 2025, a federal jury in California found Google liable on two privacy claims and awarded the certified classes US$425,651,947 in actual damages. The jury found for Google on a separate claim under California’s computer-data-access law and did not award punitive damages.
On 28 August 2026, Chief Judge Richard Seeborg refused to set aside the privacy verdict. Google subsequently filed a notice of appeal to the US Court of Appeals for the Ninth Circuit on 21 September 2026. The judgment therefore remains contested, and there is no authorised claims process or consumer distribution at this time.
The long-running litigation matters beyond Google. It highlights a risk that applies to any organisation operating apps, websites or digital services: a privacy control can look simple to the user while the underlying data architecture is far more complex. If the technical behaviour of embedded software does not match what a setting appears to promise, the gap can become a legal, governance and trust problem.
What Was Rodriguez v. Google About?
The plaintiffs were Google account holders who alleged that activity from non-Google apps continued to be transmitted to Google even after they had turned off or paused Web & App Activity settings. The official case materials identify Google software embedded inside third-party apps, including the Firebase Software Development Kit and the Google Mobile Ads Software Development Kit, as part of the alleged data pathway.
The plaintiffs alleged that Google collected, saved and used app-activity data despite users’ privacy settings. Google denied the claims and argued, among other things, that the relevant data was anonymised or pseudonymous and that users retained meaningful control through Google’s privacy tools.
At trial, the jury returned a mixed verdict. It found Google liable for invasion of privacy under the California Constitution and common-law intrusion upon seclusion, but not liable under California’s Comprehensive Computer Data Access and Fraud Act. The jury awarded actual damages but declined to award punitive or nominal damages.
What Did the Jury Decide?
On 3 September 2025, the jury awarded US$425,651,947 to the two certified classes. Reuters reported that the classes covered roughly 98 million users and 174 million devices. The plaintiffs had sought substantially more, but the jury rejected punitive damages.
The verdict is significant because it was not based simply on the proposition that app telemetry existed. The privacy claims focused on whether the collection was inconsistent with what users had been told and whether Google had valid consent for the relevant activity.
Google continues to dispute liability. On 28 August 2026, Judge Seeborg denied Google’s renewed request for judgment as a matter of law on the privacy claims. Google then filed an appeal in September 2026. Until that appellate process is resolved, the final legal outcome remains open.
Is the $425 Million Google Privacy Case a Settlement?
No. The US$425.65 million figure resulted from a jury verdict, not a negotiated settlement.
That distinction is important. A settlement normally reflects an agreement between the parties. Here, a jury decided liability and damages, the trial court entered judgment, Google challenged that judgment and the dispute has moved into the appellate process.
The official case website states that there is currently no money or benefit available for distribution. If compensation ultimately becomes available after the litigation is resolved, class members would receive further instructions. Articles describing the US$425 million figure as an already available ‘settlement fund’ are therefore inaccurate.
Why Web & App Activity Settings Became the Central Issue
The case centred on how users understood Google’s Web & App Activity controls and what happened technically after those controls were paused or switched off.
A privacy setting is a user-interface representation of a much larger system. Behind one toggle can sit data collection code, multiple application services, analytics infrastructure, advertising systems, identity services, cloud storage, retention rules and data-processing logic.
For a privacy control to operate as users reasonably expect, the underlying architecture must implement the choice consistently across every relevant data pathway. A well-designed interface cannot compensate for technical flows that continue elsewhere in the system.
What Is an SDK and Why Does It Matter?
A software development kit, or SDK, is a package of code and tools that developers can integrate into an application rather than building every function themselves. SDKs can provide useful capabilities such as analytics, advertising, authentication, crash reporting, mapping, messaging, payments and performance monitoring.
That creates an important privacy and security reality: when a user interacts with one company’s app, embedded code supplied by another company may also process or receive information generated by that interaction.
An SDK is not inherently a tracking tool and third-party code is not inherently unsafe. The governance question is whether the organisation deploying it understands what information the SDK collects, where that information goes, why it is needed, how long it is retained and what happens when a user withdraws consent or changes a privacy setting.
The Business Lesson: Privacy Settings Must Match Actual Data Flows
The most important lesson from Rodriguez is not specific to Google. Organisations should be able to demonstrate that the controls presented to users correspond to the behaviour of the underlying systems.
That requires more than reviewing privacy-policy wording. Product, engineering, legal, privacy, risk and security teams need a common understanding of the real data flows created by the application.
- What information leaves the app or website?
- Which internal and third-party systems receive it?
- Which SDKs, APIs and analytics tools participate in the flow?
- What data is tied to identifiers, accounts or devices?
- What happens technically when a user opts out or pauses collection?
- Do backend systems, SDKs and downstream processors honour that choice consistently?
- Are retention and deletion rules implemented in the systems that actually store the data?
- Can the organisation prove how a privacy control behaved at a particular point in time?
If those questions cannot be answered, the problem is not merely one of legal drafting. It is a technical-governance gap.
Your Data Supply Chain Extends Beyond Your Own Application
Modern apps are assembled from a large number of external components and services. Analytics, advertising, payment processing, identity providers, cloud services, customer-support tools and software libraries can all create additional data flows.
An organisation can therefore have a privacy or security exposure even where its own application code behaves correctly. A third-party component may introduce collection, transmission, storage or processing that was not adequately mapped or that changed after an update.
Useful governance controls include maintaining an SDK and dependency inventory, reviewing data permissions, mapping destinations, monitoring version changes, validating contractual obligations, testing consent behaviour and removing integrations that are no longer required.
Privacy Assurance Should Test Behaviour, Not Just Documentation
Policies and consent screens are necessary, but they do not establish what the application actually does. Technical assurance should verify behaviour.
Depending on the system and the organisation’s authority, assurance work may include controlled network observation, application testing, permission review, endpoint analysis, code or configuration review, logging analysis and validation that opt-out or consent changes produce the expected technical result.
NSI Global’s Offensive Cyber Security capability focuses on authorised security assessments, control validation and identifying exploitable weaknesses. Where an organisation requires broader cyber posture or architecture review, Cyber Security Consultation can be scoped around the systems and risks under review.
Rodriguez Is Not the Google Incognito Case
The two matters are often conflated because both concern Google privacy controls and both began around 2020.
| Case | Core Issue | Relevant User Context |
| Rodriguez v. Google | App-activity data allegedly collected through embedded Google SDKs despite Web & App Activity settings being paused or off. | Activity inside non-Google mobile apps. |
| Brown / Incognito litigation | Separate allegations concerning data collection associated with private-browsing activity. | Chrome private-browsing / Incognito use. |
Keeping the cases separate matters because they involve different technologies, representations and legal theories. A good privacy analysis should identify the exact control, data flow and processing activity at issue rather than reducing every dispute to ‘tracking’.
What Organisations Should Audit in Their Mobile Apps
- Inventory embedded SDKs and third-party libraries. Know which external components are present and what they are designed to do.
- Map outbound data. Identify what information leaves the application, where it goes and under what circumstances.
- Test consent and opt-out behaviour. Confirm that technical flows change when the user changes a relevant privacy preference.
- Review identifiers and linkability. Determine whether supposedly anonymous or pseudonymous data can be connected to devices, sessions, accounts or other datasets.
- Validate retention and deletion. Check that downstream systems apply the promised retention or deletion behaviour.
- Monitor third-party changes. SDK functionality and data practices can change when libraries are updated.
- Align documentation with implementation. Privacy notices and consent interfaces should reflect real technical behaviour.
- Preserve evidence when an issue is identified. Logs, configuration records, code versions, network captures and change histories may become important if the matter develops into litigation or regulatory review.
What the Case Does Not Establish
The verdict should not be read as establishing that every use of Firebase, Google Mobile Ads or third-party analytics is unlawful. These are widely used technologies with legitimate functions.
Nor does the case mean that every disagreement about a privacy setting will result in liability. The legal outcome arose from the particular representations, evidence, class definitions and California privacy claims presented to the jury.
The broader lesson is narrower and more useful: privacy controls need technical integrity. Organisations should know whether the system does what the interface says it does.
Frequently Asked Questions
What Was Rodriguez v. Google About?
It is a US class action concerning allegations that Google collected app-activity data from certain non-Google mobile apps even when users had paused or disabled relevant Web & App Activity settings. Google denied the claims.
Did a Jury Find Google Liable?
Yes. On 3 September 2025, a federal jury found Google liable for invasion of privacy under the California Constitution and intrusion upon seclusion. It found for Google on a separate California computer-data-access claim.
How Much Was the Verdict?
The jury awarded US$425,651,947 in actual damages. It did not award punitive damages. The verdict remains subject to Google’s appeal.
Is the $425 Million a Settlement?
No. It is a jury verdict and judgment under appeal, not a negotiated settlement.
Has Anyone Been Paid From the Case?
No authorised consumer distribution is available at present. The official case website states that no money or benefits are currently available while the litigation continues.
What Is Firebase?
Firebase is a Google platform that provides developers with services for building, operating and analysing applications. Depending on which Firebase products are used, it can support functions such as analytics, authentication, messaging, crash reporting and backend services.
What Is a Software Development Kit?
An SDK is a package of reusable software components, tools and interfaces that developers embed into an application to provide particular functionality. SDKs can also create data flows to the company that supplies them.
Why Do Third-Party SDKs Create Privacy Risk?
They can introduce collection and transmission pathways that are not obvious to the user and may be overlooked by the organisation deploying the app. The risk increases when the organisation cannot clearly map what the SDK collects, how settings affect that collection and where the information is sent.
What Should Businesses Test?
Organisations should test whether consent, opt-out and privacy controls produce the intended technical behaviour across the app, backend systems and relevant third-party services. The scope should be based on lawful authority and the organisation’s actual architecture.
Why the Google Case Still Matters
Rodriguez v. Google began as a dispute over a privacy toggle. It developed into a major class-action verdict because the case forced a court and jury to examine the relationship between what users were told and what the underlying technology allegedly continued to do.
That relationship is now a core governance issue for every organisation building digital services. Modern applications depend on complex ecosystems of SDKs, APIs, analytics services, cloud platforms and identity systems. Users, however, interact with a small number of simple controls.
The gap between those two layers is where risk can accumulate. The strongest response is not more disclosure alone. It is technical verification: know what data flows exist, test what happens when the user changes a setting, and ensure the implementation matches the promise.
Organisations reviewing the security and control architecture of digital platforms can contact NSI Global for a confidential consultation to scope an authorised assessment.
Sources and Further Reading
- Rodriguez v. Google LLC – Official Class Action Website
- Rodriguez v. Google LLC – Official Frequently Asked Questions
- US District Court, Northern District of California – Order Denying Google’s Post-Trial Motion, 28 August 2026
- Reuters – Google must pay $425 million in class action over privacy, jury rules, 3 September 2025
- Reuters – Judge in Google privacy class action awards lawyers $147 million in legal fees, 28 August 2026
- NSI Global – Offensive Cyber Security
- NSI Global – Cyber Security Consultation
