In re Google RTB Consumer Privacy Litigation

Opinion

IN RE GOOGLE RTB CONSUMER Case No. 21-cv-02155-YGR (VKD) PRIVACY LITIGATION ORDER RE NOVEMBER 21, 2022 DISCOVERY DISPUTE RE NAMED PLAINTIFF DATA REDACTED VERSION Re: Dkt. Nos. 365, 367

Plaintiffs and defendant Google LLC (“Google”) ask the Court to resolve a dispute concerning whether Google has complied with its obligations to produce named plaintiff data. Dkt. No. 376. In connection with this dispute, the parties provided excerpts from discovery produced in the Calhoun litigation,1 which plaintiffs contend support their position. See Dkt. No. 367. The Court held a hearing on this dispute on December 6, 2022.2 Dkt. No. 376. For the reasons explained below, the Court orders Google to produce information concerning “verticals” and requires the parties to confer further regarding time sampling. I. BACKGROUND This dispute concerns Google’s compliance with the Court’s August 26, 2022 order resolving the parties’ earlier dispute regarding plaintiffs’ discovery of named plaintiff data. Dkt. No. 314.3 In that order, the Court ordered Google to produce documents sufficient to show several

1 Calhoun et al v. Google LLC, No. 20-5146.

2 Because the hearing involved detailed discussion of Google’s confidential information, the Court conducted the hearing under seal. categories of data relating to the named plaintiffs. As to some disputed categories of information, the Court directed the parties to confer further and, if appropriate, to comply with the procedures the Court established for considering materials from the Calhoun litigation. Plaintiffs say that Google’s production of named plaintiff data is incomplete. They argue that Google has chosen to produce data principally from the , but neglected other sources that contain unique data about information Google shares with RTB participants. Dkt. No. 365 at 2. Specifically, plaintiffs argue that Google should be required to search for and produce named plaintiff data from six other data logs, referred to collectively as the Id. at 1-3. In support of their position, plaintiffs separately describe and attach examples of these other data logs that were produced in the Calhoun litigation. See Dkt. No. 367. Google says that it has complied with the Court’s August 26 order to produce documents sufficient to show the named plaintiffs’ sign-up information, consent-related data, settings, “My Activity” records (including web-browsing) history, and other records that are “responsive to the ‘Linking account information,’ ‘Ads shown,’ and ‘Cookie-matching’ sections” of the order. Dkt. No. 365 at 4-5. At the hearing, Google represented that it would produce additional data by the week of December 12, 2023, following the expiration of a contractually-required notice period. Id. at 5; Dkt. No. 376. Google says that it has produced named plaintiff data “from six different time periods and five log sources,” including the and some of the Dkt. No. 365 at 5. Google vigorously disputes plaintiffs’ characterization of the information produced in the Calhoun litigation and disagrees that it includes unique information relevant to this case. See Dkt. No. 367. This dispute requires the Court to address Google’s compliance with the August 26 order. This task is complicated by the fact that plaintiffs’ portion of the joint submission does not refer to what the Court has ordered and where Google’s production falls short. Instead, plaintiffs focus on the alleged superiority of the as a source of responsive information. At the hearing, plaintiffs elaborated on their positions. First, plaintiffs say that Google has not produced certain data fields that reflect information about the named plaintiffs that is shared with RTB participants in violation of the Court’s August 26 order. Second, plaintiffs say that Google has improperly limited its production to data for only six weeks from the relevant time period. Third, plaintiffs argue that Google has produced data in a manner that destroys its context and structure. Fourth, plaintiffs argue that Google should be ordered to produce information from that relates to information shared with RTB participants. The Court considers each of these arguments. A. Missing categories of information Plaintiffs’ portion of the joint submission does not identify any categories of information missing from Google’s production. However, in the accompanying submission addressing materials from the Calhoun litigation, plaintiffs identify, for each of , the specific fields available in those logs that they say Google has withheld from production. See Dkt. No. 367 at 1-3, Exs. 1-5. For most of these fields, Google responds that it has already produced (or will produce) the information, or that the field corresponds to information Google maintains internally and does not share with RTB participants. See id. at 3-5. The exception appears to be data fields that have to do with what the parties refer to as “detected verticals” or “targeting verticals,” which the Court addresses below. Plaintiffs have no response to Google’s argument that contain no information responsive to the August 26 order that Google has not already produced (or committed to produce) from other sources, other than to say that they do not believe Google’s representations. Plaintiffs acknowledge that the discovery they have obtained in Calhoun does not show that Google shares the data fields they highlight in with RTB participants. Nevertheless, they suspect Google is withholding responsive information from production. For purposes of discovery in this case, plaintiffs essentially argue that it is not enough for the Court to order Google to produce documents sufficient to show all of the data Google shares 1 Google to produce a// of the data fields from the gg for each of the named 2 plaintiffs and permit plaintiffs to explore their suspicions in discovery. Plaintiffs do not dispute 3 Google’s representation that contain I. the vast number of 4 which are not relevant to this litigation. See Dkt. No. 365 at 6. The Court has already considered 5 and rejected an approach to discovery that requires Google to produce all information it collects 6 about the named plaintiffs, regardless of whether that information is disclosed to a third party in an 7 RTB auction. See Dkt. No. 269 at 5; Dkt. No. 314 at 4. Nothing in the parties’ Calhoun 8 submission causes the Court to reconsider that decision. Plaintiffs simply have not shown that 9 || wholesale production of all data fields from | is relevant or proportional to 10 the needs of this case. 11 However, Google has failed to comply with the Court’s August 26 order in one important 12 respect. It is undisputed that during the relevant class period, Google shared at least one data field 13 with RTB participants for the purpose of helping participants target their ads. In the operative 14 complaint, plaintiffs allege that Google collects personal and sensitive information about account 15 || holders, groups them into interest-based categories called “verticals,” and then shares the verticals a 16 || (or information about the verticals) with RTB participants. Dkt. No. 80 ff 16, 144-150. Google 17 || acknowledges that during a portion of the class period it shared a data field called yyy Z 18 || EE with RTB participants but says that the field was deprecated and not shared beginning in 19 approximately February 2020.* Google has not produced documents sufficient to show the 20 detected verticals shared with respect to each of the named plaintiffs, nor has it investigated 21 whether the information can be produced from any existing data sources. Moreover, after much 22 discussion at the hearing, the Court now understands that plaintiffs believe Google presently uses 23 verticals derived from account holders’ personal and sensitive information in connection with 24 RTB auctions, even if Google does not expressly disclose a “vertical” data field to an RTB 25 76 * At the hearing, Google explained that the a field refers to the web site the account holder happened to be visiting at the time of the auction (e.g., a website about 97 motorcycles) and does not refer to categorization of the account holder herself. See also Dkt. No. iscusa cteent ands of vertical) According Coo: a

participant. Specifically, plaintiffs contend that Google uses the verticals it maintains to curate bid requests presented to its ad customers to enable those customers to target account holders associated with particular verticals, or that Google otherwise conducts the RTB auction process in a manner that facilitates the targeting of account holders based at least in part on verticals linked to account holders. Plaintiffs say that Google’s production must include documents sufficient to show both the explicit sharing of verticals associated with the named plaintiffs and any implicit sharing that facilitates ad targeting. The Court agrees. Google must produce documents sufficient to show for each named plaintiff the “verticals” data fields it shared with RTB participants during the class period. In addition, Google must produce documents sufficient to show for each named plaintiff the information, if any, that it provided to RTB participants that would permit those participants to infer information about the account holder based on verticals linked with the account holder. B. Time sampling Google says that it has produced six weeks’ worth of named plaintiff data from different months within the relevant class period for the relevant data sources that required notice to ad customers. According to Google, because it is contractually-required to provide notice to each of the ad customers whose data is encompassed by the production, if sampling is not permitted, it would be required to provide notice to thousands of customers. Plaintiffs dispute that production of data for the full time period would be unduly burdensome for Google, describing Google’s selection of time periods as “arbitrary.” The Court accepts Google’s representations that for data sources that require notice to ad customers, production of named plaintiff data for the entire class period would impose an undue burden, and some kind of sampling is appropriate. For data sources that do not require notice to ad customers, the Court is not persuaded that production of named plaintiff data for the entire class period would impose an undue burden. For data sources that require notice to ad customers, if Google wishes to rely on a sample of responsive data to satisfy its obligations, it must take steps to ensure that the sample is representative such that plaintiffs can rely on it in making the arguments considered or discussed whether Google’s production was a representative sample. If a dispute remains about Google’s time sampling, the parties must confer on this point. At a minimum, Google must explain to plaintiffs how it selected the six weeks it chose for production, and if plaintiffs disagree about whether those six weeks are representative, they must explain to Google why they disagree. If a dispute remains after the parties confer, they may submit that dispute to the Court for decision. C. Context and structure of production data While plaintiffs acknowledge that the named plaintiff data in question is stored in databases, they object that Google’s production of only certain fields from the databases eliminates context and structure from the data that makes it difficult to use. Plaintiffs explained at the hearing that this is why they want Google to produce all data fields contained in the logs for each named plaintiff. Dkt. No. 376. Google responds that neither the Court’s August 26 order nor any other rule of discovery requires them to produce thousands of irrelevant data fields simply because those fields are stored in the same database as relevant data fields. Id. During the hearing, Google explained that for each named plaintiff it queried the relevant databases using data fields corresponding to the categories of information in the August 26 order, and then output the results of the queries to a file. Google represents that the resulting files include the names of the data fields and their corresponding values. This is how production of responsive data from a database commonly occurs—run queries on relevant data fields, output results. See, e.g., Sarieddine v. D&A Distribution, LLC, No. 17-CV-2390-DSF-SKX, 2018 WL 5094937, at *3 (C.D. Cal. Apr. 6, 2018); Zysman v. Zanett Inc., No. C-13-02813 YGR (DMR), 2014 WL 1320805, at *2 (N.D. Cal. Mar. 31, 2014). Plaintiffs’ claim that the data Google has produced lacks context and structure and is therefore unusable is not persuasive. Plaintiffs do not contradict Google’s explanation of how it produced the data, and they do not show or explain how Google’s production using that methodology prevents plaintiffs from understanding and using the 1 of a particular database or data log in order to comply with the August 26 order. 2 D. Related information 3 On several occasions during the hearing, plaintiffs appeared to advocate for production of a 4 broader scope of information “related to” information Google shares with RTB participants, or “in 5 furtherance of” the RTB auction process. Such information is beyond the scope of the Court’s 6 August 26 order, which requires Google to produce documents sufficient to show specific 7 categories of information. 8 I. CONCLUSION 9 The Court orders as follows: 10 1. Google must produce “verticals” information described in section II.A above by 11 January 31, 2023. 12 2. The parties must confer promptly about the time sampling issue in section I.B, but no 13 later than January 13, 2023, and may submit any remaining dispute for resolution. 14 The Court denies all other relief requested. 15 IT IS SO ORDERED. a 16 Dated: December 16, 2022

Uigiuian®, hu Marcle: VIRGINIA K. DEMARCHI 19 United States Magistrate Judge 20 21 22 23 24 25 26 27 28