Google to pay record-setting $22.5 million fine over privacy practices

The fine for violating privacy laws when it tracked users of Apple's Safari browser is the largest ever handed down in an FTC complaint

Google will pay a historic fine to settle U.S. government charges that it violated privacy laws when it tracked users of Apple's Safari browser via cookies.

The $22.5 million civil penalty is the largest ever secured by the U.S. Federal Trade Commission for a violation of one of its orders.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]

However, finds the settlement inadequate for various reasons, including the amount of the fine and the fact that it allows Google to deny guilt and liability.

The fine amount is "chump change" for Google, and the FTC shouldn't have agreed to a settlement unless Google was willing to make an admission of guilt, said John Simpson, director of the privacy project at

"This is letting Google buy its way out of trouble," he said.

The consent decree states that "Defendant denies any violation of the FTC Order, any and all liability for the claims set forth in the Complaint, and all material allegations of the Complaint save for those regarding jurisdiction and venue."

In its complaint (PDF), which it referred to the U.S. Department of Justice, the FTC said that Google falsely told Safari users that it wouldn't place tracking cookies on their devices or serve them targeted ads.

The FTC said that with this misrepresentation, Google violated an existing privacy settlement it had reached with the agency.

The settlement also requires that Google disable all tracking cookies it placed on affected users' computers.

"The record setting penalty in this matter sends a clear message to all companies under an FTC privacy order," said Jon Leibowitz, chairman of the FTC, in a statement. "No matter how big or small, all companies must abide by FTC orders against them and keep their privacy promises to consumers, or they will end up paying many times what it would have cost to comply in the first place."

According to the FTC, Google "for several months" in 2011 and 2012 placed tracking cookies on computers of Safari users when they visited sites in Google's DoubleClick ad network. Google had previously assured users that they would be exempt from such tracking and ad targeting because of the default settings in the Safari browser used in Macs, iPhones and iPads that block such cookies, the FTC said.

Instead, Google in many cases actively circumvented Safari's cookie-blocking settings in order to track these users, the FTC said.

The Center for Democracy and Technology praised the FTC's action, highlighting in particular that the agency moved quickly to address the issue and that in its complaint it faulted Google for acting in a way that the FTC said violates the code of conduct of the Network Advertising Initiative, to which Google belongs.

"This action demonstrates the FTC is a champion for consumer privacy rights," said Justin Brookman, CDT's Director of Consumer Privacy, in a statement.

A Google spokeswoman said via email that the FTC "is focused on a 2009 help center page published more than two years before our consent decree, and a year before Apple changed its cookie-handling policy." Google has now changed that page and "taken steps to remove the ad cookies, which collected no personal information, from Apple's browsers," she said.

The DOJ filed the complaint and proposed settlement on behalf of the FTC in U.S. District Court for the District of Northern California in San Jose this week.  The proposed consent decree is subject to court approval.'s Simpson said the organization is considering challenging the settlement by arguing that it doesn't serve the public interest if it doesn't include an admission of guilt from Google.

A similar view (PDF) is shared by FTC Commissioner J. Thomas Rosch, the only one of five commissioners who voted against referring the complaint to the DOJ and approving the proposed settlement.

"There is no question in my mind that there is 'reason to believe' that Google is in contempt of a prior Commission order. However, I dissent from accepting this consent decree because it arguably cannot be concluded that the consent decree is in the public interest when it contains a denial of liability," Rosch wrote in a dissenting statement.

Copyright © 2012 IDG Communications, Inc.

How to choose a low-code development platform