In re Google RTB Consumer Privacy Litigation

• Court: District Court, N.D. California
• Decided: January 3, 2025
• Docket: 4:21-cv-02155
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 IN RE GOOGLE RTB CONSUMER Case No. 21-cv-02155-YGR (VKD) PRIVACY LITIGATION 8 ORDER DENYING PLAINTIFFS' MOTION FOR CONTEMPT AND 9 SPOLIATION SANCTIONS RE NAMED PLAINTIFFS DATA 10 (REDACTED) 11 Re: Dkt. No. 697 12 13 Plaintiffs move for an order finding defendant Google LLC (“Google”) in contempt of the 14 Court’s previous discovery orders (Dkt. Nos. 487, 524) and sanctioning Google for spoliating 15 evidence, contending that Google failed to preserve and produce certain data relating to the named 16 plaintiffs. Dkt. No. 697. Google opposes the motion, both on the merits and on the ground that it 17 is untimely. Dkt. No. 708. Having considered the parties’ briefing and arguments at the hearing 18 (Dkt. No. 714), the Court denies plaintiffs’ motion for contempt and sanctions. 19 I. BACKGROUND 20 On July 29, 2022, the parties filed a discovery dispute letter in which plaintiffs asked the 21 Court to order Google to produce information regarding how Google links information it discloses 22 through RTB with an account holder’s Google account and what information is linked. Dkt. No. 23 269 at 2. Specifically, plaintiffs argued that “Google is purposefully withholding evidence that 24 Google’s internal systems link the information that Google sends through RTB with the Named 25 Plaintiff’s Google account. This linkage renders information disclosed through RTB personal 26 information.” Id. at 2-3 (emphasis in original). On August 26, 2022, the Court issued an order 27 resolving this dispute. Dkt. No. 314 at 4-5. The order states in relevant part: Plaintiffs’ premise is that if Google associates information with an 1 account holder, the information is “personal” to the account holder 2 because of that association. They seem to say that if such information is disclosed in an RTB auction, it is “personal 3 information” of an account holder within the scope of discovery. The parties’ arguments on this point are not well-developed. In 4 particular, the Court is not persuaded that if an item of information Google associates with an account holder is shared with an RTB 5 participant in a manner that (a) eliminates the association with a 6 specific account holder and (b) does not allow the RTB participant to make the same association (see “cookie matching” discussion 7 below), Google has necessarily shared “personal information” of an account holder with an RTB participant. If plaintiffs contend 8 otherwise, they have not pointed the Court to any authority that supports their position. 9 The Court expects Google to produce documents sufficient to show, 10 for each named plaintiff, what information specific to that plaintiff 11 was shared with an RTB participant and the details of such sharing. If Google discloses information that allows an RTB participant to 12 identify an account holder based on information the participant may have about that account holder, Google must produce records 13 showing the disclosure of that information as well. Otherwise, 14 plaintiffs have not shown they are entitled to discovery of all information Google maintains about an account holder solely based 15 on Google’s internal linking of information with an account holder. 16 Id. (emphasis added in second paragraph).1 17 On February 28, 2023, plaintiffs filed a motion seeking sanctions against Google. Dkt. No. 18 431. As relevant here, plaintiffs argued that Google “intentionally stripped out” data fields that 19 would identify the named plaintiffs whose data they produced, making it difficult for plaintiffs to 20 know which data is associated with a particular named plaintiff and to match later productions 21 with earlier productions. Id. at 5. Specifically, plaintiffs claimed that Google deliberately omitted 22 from its production the Google Account ID and Google User ID data fields, and the “joining keys” 23 that link the two. Id. at 5-6. Google responded that it produced the named plaintiffs data using a 24 unique “query ID” field that allowed plaintiffs to match prior productions with later productions of 25 samples of named plaintiffs data. Dkt. No. 448 at 12. The Court held a hearing on the motion. 26 Dkt. No. 478. On April 14, 2023, the Court denied plaintiffs’ motion for sanctions. Dkt. No. 487. 27 1 The order states in relevant part: 2 The Court agrees with Google that [the Court’s] prior orders did not specify how Google should produce data so that earlier productions 3 can easily be matched with later productions. However, to the 4 extent Google’s productions from multiple different data sources cannot be easily matched up based on the query ID, as plaintiffs 5 contend in their reply, Google’s reliance solely on the query ID needlessly burdens plaintiffs. 6 Accordingly, while Google’s most recent data productions did not 7 violate any directive in the Court’s prior orders, Google must take 8 care that all of its productions of named plaintiffs data can be easily correlated, and it must include the fields necessary to accomplish 9 that result. During the hearing, Google acknowledged that it could include the Google Account ID, Google User ID, and “joining keys” 10 without undue burden, and the Court expects that it will do so, including remedying its prior productions that omit this information. 11 12 Id. at 6-7. In a separate order issued the same day, the Court permitted plaintiffs to select six 13 additional time periods for samples of named plaintiffs data that Google would be required to 14 produce and ordered plaintiffs to “promptly advise Google of their selection.” See Dkt. No. 483 at 15 2. 16 Shortly thereafter, the parties filed another discovery dispute letter regarding Google’s 17 compliance with the portion of the Court’s April 14, 2023 order requiring Google to produce “the 18 Google Account ID, Google User ID, and ‘joining keys’”. Dkt. No. 503. Plaintiffs complained 19 that Google agreed to produce the Google Account ID (or ) data field but refused to 20 produce the Google User ID or “joining keys.” Id. at 1, 4. Google responded that because it 21 the “Google User ID,” it could not produce this data field, and that (contrary to the Court’s 22 statements summarizing Google’s position) no “joining keys” link the Google Account ID and the 23 Google User ID. Id. at 5-6. The Court held a hearing on this dispute and issued an order on May 24 16, 2023. Dkt. No. 510 (sealed); Dkt. No. 524 (public). The order states in relevant part: 25 From the parties’ presentations at the May 16, 2023 hearing, the 26 Court now understands the following: Google maintains Google User ID which it calls the . The 27 includes an 1 . That 2 is populated in a data field called google_user_id.” Google google_user_id field that is 3 transmitted as part of a bid request. Google does log the and an . 4 However, 5 6 7 8 With respect to “joining keys,” the Court understands that plaintiffs 9 use this term to refer to the internal mechanisms by which Google links a Google Account ID (or ) and a . Google 10 says . 11 The Court accepts Google’s representation that the 12 google_user_id data field that is shared with RTB participants and therefore cannot be produced to plaintiffs. However, the 13 Court now appreciates that there is a different but related data item, the , that Google maintains internally, 14 15 . During the hearing, the Court inquired whether Google could produce 16 , together with the Google Account ID (or ), for all sampled named plaintiffs data that the Court has 17 previously ordered Google to produce, even though Google contends that the is never shared with RTB participants. 18 Google’s counsel indicated he would need to investigate that 19 possibility. 20 The Court also accepts Google’s representation that it . 21 In these circumstances, the Court orders Google to investigate 22 whether may be produced, together with the Google Account ID (or ) 23 where available, for all sampled named plaintiffs data. Google shall 24 advise plaintiffs of the result of this investigation, and the parties shall jointly report to the Court whether and when Google will make 25 a further production that includes the information. If Google determines that the information cannot be 26 produced, the parties shall discuss whether any reasonable 27 alternatives exist for the production of the same or similar information, and shall jointly report to the Court on this point. 1 Id. at 2-3. 2 Pursuant to the Court’s direction, the parties filed a status report on May 24, 2023. Dkt. 3 No. 529. The report stated in relevant part that “Google has represented that it performed a 4 reasonable investigation and confirmed that it can produce the , where 5 available, together with the Google Account ID [i.e. ], where available, for the prior and 6 forthcoming productions of sampled named-Plaintiff data. Google has represented that it is 7 working diligently to produce this additional information and endeavors to complete this 8 production by June 2, 2023.” Id. at 1. According to Google, it produced data samples in May and 9 June 2023 that were consistent with the representations in the status report. Dkt. No. 708 at 6; 10 Dkt. No. 708-2 ¶ 21. 11 On October 30, 2023, plaintiffs learned through deposition testimony of a Google 12 representative that, in the normal course of business, 13 . Dkt. 697 at 9-10 (citing Rule 30(b)(6) 14 deposition testimony of Glenn Berntson). 15 On November 17, 2023, plaintiffs asked Google to produce four additional samples of 16 named plaintiffs data, beyond the six samples the Court had earlier allowed plaintiffs to select. 17 See Dkt. No. 719-1; Dkt. No. 708-4. At that time, at least one of the requested samples 18 encompassed a time period within the retention period for Dkt. 19 No. 697 at 11. Google did not respond to plaintiffs’ request until January 11, 2024, at which time 20 it objected to the lateness of the request for additional data samples, but nevertheless agreed to 21 produce the requested samples. Dkt. No. 708-4. In addition, Google’s January 11, 2024 response 22 included the following statements: 23 As with prior productions, Google will not decrypt any encrypted [B]iscotti values in the data. For additional detail regarding the data 24 that Google intends to produce from these data sources for these 25 four additional one-week time periods, please refer to the explanations set forth in our May 8, 2023 and June 2, 2023 26 production cover letters.[2] 27 Plaintiffs’ request fails to specify what “joining keys” they are 1 demanding or their relevance to this litigation. To the extent 2 Plaintiffs are referring to that can be used to decrypt certain encrypted pseudonymous identifiers in logs, Google will not 3 produce any such . Plaintiffs have not explained why they need this information to prosecute their claims, particularly in light of the 4 voluminous data Google has already produced and the additional data it is committing to produce relating to the named Plaintiffs. 5 6 Id. at ECF 3. Google produced the four additional data samples on February 9, 2024, by which 7 time the retention period for all samples had expired. Dkt. No. 697 at 11. 8 On April 19, 2024, plaintiffs filed the present motion for an order finding Google in 9 contempt of the Court’s April and May 2023 orders for deliberately failing to maintain and 10 produce and following those orders in 2023. Dkt. No. 697 at 11 14-15. Plaintiffs also move for evidentiary sanctions under Rule 37(e) of the Federal Rules of 12 Civil Procedure, precluding Google from arguing that plaintiffs are unable to link RTB bid request 13 data with account information for signed-out Google account holders, and for an adverse inference 14 jury instruction. Id. at 16-17. 15 II. LEGAL STANDARD 16 When a party “fails to obey an order to permit or provide discovery,” Rule 37(b)(2)(A) 17 permits a court to issue a further order imposing sanctions, including “prohibiting the disobedient 18 party from supporting or opposing designated claims or defenses,” “striking pleadings,” 19 “dismissing the action,” or “treating as contempt of court the failure to obey [an] order . . . .” Fed. 20 R.Civ. P. 37(b)(2)(A). To obtain a contempt order as a discovery sanction, the moving party must 21 prove by clear and convincing evidence that a court order provided “unequivocal notice” that 22 certain discovery must be produced. Etienne v. Kaiser Found. Hosp., No. C11-02324 LB, 2012 23 U.S. Dist. LEXIS 91600, at *3 (N.D. Cal. July 2, 2012) (citing Unigard Sec. Ins. Co. v. Lakewood 24 Eng’g & Mfg. Corp., 982 F.2d 363, 368 (9th Cir. 1992)); see also F.T.C. v. Affordable Media, 179 25 F.3d 1228, 1239 (9th Cir. 1999) (discussing clear and convincing evidence standard); Koninklijke 26 27 named plaintiffs’ data samples in May and June 2023 included 1 Philips N.V. v. Elec-Tech Int’l Co., No. 14-cv-02737-BLF, 2015 WL 6449399, at *2 (N.D. Cal. 2 Oct. 26, 2015) (“[C]ontempt requires the existence of a specific and definite court order.”). A 3 finding of contempt is improper where the violation was “based on a good faith and reasonable 4 interpretation of the [order].” See In re TFT-LCD (Flat Panel) Antitrust Litig., 289 F.R.D. 548, 5 553 (N.D. Cal. 2013). 6 With respect to electronically stored information (“ESI”), a court may impose sanctions 7 under Rule 37(e) when “[ESI] that should have been preserved in the anticipation or conduct of 8 litigation is lost because a party failed to take reasonable steps to preserve it, and [the ESI] cannot 9 be restored or replaced through additional discovery.” Fed. R. Civ. P. 37(e). If a court finds that 10 the loss of information has prejudiced the moving party, it may order “measures no greater than 11 necessary to cure the prejudice.” Fed. R. Civ. P. 37(e)(1). If a court finds that the offending party 12 “acted with the intent to deprive another party of the information’s use in the litigation,” the court 13 may order an adverse evidentiary presumption, among other remedies. Fed. R. Civ. P. 37(e)(2).3 14 III. DISCUSSION 15 A. Timeliness of Plaintiffs’ Motion 16 Fact discovery in this case closed on January 19, 2024. See Dkt. Nos. 530, 534. By 17 operation of Civil Local Rule 37-3, plaintiffs’ last day to file a discovery-related motion was 18 January 26, 2024. See Civil L.R. 37-3 (“Where the Court has set separate deadlines for fact and 19 expert discovery, no motions related to fact discovery may be filed more than 7 days after the fact 20 discovery cut-off.”). However, the parties filed a stipulated request asking the presiding judge to 21 again extend the fact discovery motion deadline to February 2, 2024 so that they could “complete 22 the meet and confer discussions [that] will allow the parties to hopefully resolve or narrow many 23 of their outstanding discovery disputes.” Dkt. No. 654 at 2. The presiding judge granted this 24 request, with the result that the parties’ deadline to file discovery-related motions was extended to 25 February 2, 2024. See Dkt. No. 656. Plaintiffs filed the present motion on April 19, 2024, more 26 3 Rule 37(e), as amended in 2015, displaces the Court’s inherent authority to award sanctions with 27 respect to ESI. Gregory v. State of Montana, 118 F.4th 1069, 1072 (9th Cir. 2024). 1 than two months after this deadline. 2 Plaintiffs have not shown good cause for their failure to file their motion by February 2, 3 2024, nor have they shown that they brought the motion “as soon as practicable” after learning the 4 grounds for the motion. See Dkt. No. 711 at 2. The record reflects that with respect to samples of 5 named plaintiffs data, plaintiffs knew as early as the May 24, 2023 status report, that Google 6 intended to produce only encrypted , together with the Google Account IDs, or 7 , for both prior and “forthcoming” productions of data samples, and that Google did not intend 8 to produce decrypted or . Dkt. No. 529. Plaintiffs did not 9 raise any dispute about Google’s intended production with the Court, although they “reserve[d] all 10 rights” to do so. Id. With respect to plaintiffs’ subsequent request for additional data samples in 11 November 2023, plaintiffs knew at least as of January 11, 2024 that Google intended its 12 production of additional data samples to include the same information as its prior productions, and 13 that Google would not produce the ; indeed, Google specifically stated it 14 would not produce this information. Dkt. No. 708-4 at ECF 3. Plaintiffs were also aware from the 15 deposition testimony they obtained that Google ordinarily retained for 16 only . Dkt. No. 697-1 ¶ 4. 17 Plaintiffs offer no plausible explanation for why they could not have raised this dispute 18 following the parties’ May 24, 2023 status report, in which Google’s position about what it would 19 produce following the Court’s May 16, 2023 was clearly stated. If plaintiffs were not satisfied 20 with Google’s representations about its intended production, they should have promptly raised the 21 disagreement with the Court. Furthermore, Google’s position regarding its later production of 22 additional data samples was not ambiguous. While the Court does not condone Google’s nearly 23 two month-delay in responding to plaintiffs’ request for additional samples, plaintiffs were on 24 notice of Google’s position as of January 11, 2024, and should have raised the issue no later than 25 February 2, 2024. 26 Accordingly, the Court finds that plaintiffs’ motion is untimely and denies the motion on 27 that basis. Alternatively, even if timely, the Court denies the motion on its merits, as explained 1 B. Plaintiffs’ Motion for Contempt Order under Rule 37(b)(2)(A) 2 Plaintiffs’ principal argument is that Google had an obligation to preserve and produce 3 decrypted and because the Court ordered it to do so in its 4 April and May 2023 orders. While plaintiffs repeatedly assert that any time the Court used the 5 term “joining keys,” this necessarily included nothing in either of these 6 orders clearly required Google to preserve and produce and/or decrypted 7 . 8 As explained above, the focus of the Court’s April 14, 2023 order was to ensure that 9 Google’s productions of named plaintiffs data “can be easily correlated” with one another. Dkt. 10 No. 487 at 6-7. The Court did not address Google’s use or production of any “ ” that could be 11 used to decrypt that are otherwise maintained by Google as encrypted pseudonymous 12 identifiers. While the Court’s May 16, 2023 order did discuss this functionality—and 13 distinguished it from the matters addressed in the April 14, 2023 order—that order required 14 Google to “investigate whether the may be 15 produced, together with the Google Account ID ( ) where available, for all sampled 16 named plaintiffs data,” and directed the parties to jointly report back to the Court. Dkt. No. 524 at 17 2-3 (emphasis added). After receiving the parties’ joint status report on May 24, 2023, the Court 18 issued no further orders to Google, and neither party identified any disagreements that remained to 19 be resolved on this point. See Dkt. No. 529. 20 Accordingly, plaintiffs have not shown by clear and convincing evidence that Google 21 violated a clear and definite court order to preserve and produce decrypted and 22 . 23 C. Plaintiffs’ Motion for Discovery Sanctions under Rule 37(e) 24 While plaintiffs argue that their request for sanctions is limited to Google’s conduct “after 25 the Court specifically ordered Google to produce and ,” Dkt. 26 No. 697 at 2, plaintiffs contend that their request for sanctions does not depend entirely on 27 Google’s asserted violation of a court order. Plaintiffs additionally contend that Google had an 1 and their November 17, 2023 email request for this ESI. 2 In May 2021, plaintiffs served RFP 42, which asked Google to produce: 3 [a]ll Information Google has collected, created associated and derived, and continues to collect, create, associate and derive, 4 regarding Plaintiffs, including but not limited to: authenticated and 5 unauthenticated personal identifiers and device, browser, and other identifiers (including IP address) associated with Plaintiffs and their 6 devices; data associated with those identifiers, including browsing history, ad history, communications history, Google account sign-in 7 history, Chrome Sync history; derived data; appended data; associated verticals and segments; embedded data; all data contained 8 in user profiles, interest profiles, interest graphs; and, authenticated 9 and unauthenticated data (this request will be supplemented with any currently known identifiers upon entry of a protective order 10 governing the exchange of discovery). 11 Dkt. No. 697-1 ¶ 3; Dkt. 708-3 at ECF 3. In June 2021, Google objected in writing to this RFP and 12 agreed to produce only non-privileged documents “showing what information, if any, that 13 Google’s systems directly associate with the identifiers Plaintiffs have provided or will provide to 14 Google, and shared with third parties utilizing RTB, to the extent Google can reasonably identify 15 such data as belonging to plaintiffs.” Dkt. 708-3 at ECF 4. By the time the parties’ dispute about 16 the scope of RFP 42 was presented to the Court a year later, in July 2022, plaintiffs appeared to 17 have limited their request. As the Court observed in its August 26, 2022 order, “[p]laintiffs’ 18 portion of the joint [discovery dispute] submission is not tethered in any meaningful way to these 19 document requests. The Court hopes this is because, during the conferences of counsel, plaintiffs 20 have narrowed the categories of information for which they are seeking documents to those 21 described in the joint submission . . . . In any event, in resolving this dispute, the Court focuses on 22 the categories described in the joint submission and not the much broader document requests.” 23 Dkt. No. 314 at 1-2. As explained above, the Court declined to order Google to produce “all 24 information [it] maintains about an account holder solely based on Google’s internal linking of 25 information with an account holder,” and instead ordered Google to produce “documents 26 sufficient to show, for each named plaintiff, what information specific to that plaintiff was shared 27 with an RTB participant and the details of such sharing,” including “information that allows an 1 that account holder.” Id. at 4-5. Thus, to the extent plaintiffs rely on RFP 42 as a source of 2 Google’s purported obligation to preserve beginning at least in April 3 2023, that reliance is misplaced in view of the Court’s August 26, 2022 order resolving the 4 parties’ dispute about the scope of that RFP. 5 Plaintiffs argue that when their counsel sent an email on November 17, 2023 asking 6 Google to produce four additional data samples and specifically asked for “any joining keys that 7 exist,” Google should have at least preserved the for samples that were 8 within the retention period. Dkt. No. 711 at 12; Dkt. No. 720 at 14:6-15:5, 17:17-25. The 9 Court disagrees that simply by asking Google to produce “joining keys” plaintiffs triggered 10 Google’s obligation to preserve and produce this ESI. Google has no obligation, independent of 11 litigation, to preserve the , and their destruction in the ordinary course of 12 business is not wrongful in any respect. To the contrary, Google offers persuasive evidence that 13 its ordinary practice of destroying the keys after is an important data security and privacy 14 measure. See Dkt. No. 708-1. In these circumstances, plaintiffs’ argument that, because they 15 demanded “joining keys” in litigation, Google had an obligation to preserve 16 ignores the history of the parties’ disputes and the Court’s prior orders regarding this ESI, 17 as recounted in detail above. That is, as of May 24, 2023, the parties’ status report to the Court 18 did not identify any remaining disputes about what Google would preserve or produce with 19 respect to named plaintiffs data, and plaintiffs’ counsel’s email did not wipe the slate clean. 20 For these reasons, even if the Court accepts plaintiffs’ view (which Google disputes) that 21 decrypted and/or should have been preserved as relevant 22 evidence, plaintiffs have not shown that Google acted unreasonably or with the intent to deprive 23 plaintiffs of the use of this ESI in the litigation in not suspending its retention period. 24 Likewise, the Court is not persuaded that plaintiffs have suffered evidentiary prejudice by not 25 having a sample that includes decrypted and/or . The 26 question of prejudice is not even addressed in plaintiffs’ opening motion, see generally Dkt. No. 27 697, and although their reply includes assertions that this information is “necessary” and “critical,” 1 that “bid request information is personal information under Google’s privacy policy for both 2 signed-in and signed-out users,” see Dkt. No. 711 at 9, given that they have obtained information 3 in discovery regarding how Google does or does not associate account holder information with 4 other identifying information when a user is signed-out. 5 || IV. CONCLUSION 6 For the foregoing reasons, the Court denies plaintiffs’ motion for an order finding Google 7 in contempt of the Court’s April and May 2023 orders under Rule 37(b)(2)(A), and for evidentiary 8 sanctions and an adverse inference instruction under Rule 37(e). 9 IT IS SO ORDERED. 10 || Dated: January 3, 2025 11 Uniaiuia E Qi □□□□□□ Virginfa K. DeMarchi 13 United States Magistrate Judge

15 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28