Today the Federal Trade Commission announced that Google has agreed to pay a record $22.5 million civil penalty to settle charges that it violated an earlier privacy settlement by circumventing the Safari browser’s default privacy settings and placing advertising tracking cookies without user knowledge or consent. In addition to the civil penalty, the order also requires Google to disable all the tracking cookies it had said it would not place on users’ computers and devices.
In its complaint, the FTC charged that Google found a loophole to place advertising tracking cookies on users’ Safari browsers during a period of several months in 2011 and 2012, while directly informing them that the existing Safari settings automatically opted them out of cookies. To get around Safari’s privacy settings, they used invisible web forms to trick Safari into thinking that users had interacted with Google’s DoubleClick ads and thus allowed the cookies to be placed on their device.
“The record setting penalty in this matter sends a clear message to all companies under an FTC privacy order,” said John Leibowitz, Chairman of the FTC. “No matter how big or small, all companies must abide by FTC orders against them and keep their privacy promises to consumers, or they will end up paying many times what it would have cost to comply in the first place.”
The earlier privacy settlement between Google and the FTC was reached in October 2011 and explicitly barred Google from misrepresenting the extent to which consumers can exercise control over the collection of their information. The Commission voted 4-1 to take their complaint to the Department of Justice, which filed the complaint and proposed a settlement on behalf of the Commission.
This settlement is a major victory for the FTC’s ongoing efforts to make sure companies live up to the privacy promises they make to consumers, and should hopefully make other companies think twice before taking advantage of loopholes.