Google’s Privacy Lawsuit: Who Controls the Data Leaving Your Devices?

A privacy setting is a promise about what happens to data. For organisations handling sensitive information, that promise needs to be tested.

Google’s app-tracking lawsuit raises a practical question for security leaders: how closely does a device’s actual behaviour match the controls its users believe they have enabled?

On 3 September 2025, a federal jury awarded $425.7 million in Rodriguez v. Google. The dispute concerned data collected through third-party mobile apps after users disabled certain Google activity settings. The official case website explains the allegations and affected groups. The jury found Google liable for invasion of privacy and intrusion upon seclusion, while finding in Google’s favour on a separate California computer-access claim, as documented in the court’s January 2026 order.

The court rejected Google’s attempt to overturn the privacy verdict on 28 August 2026. Google disputes the outcome and subsequently filed a notice of appeal, according to MediaPost’s September reporting. As of 25 September 2026, the litigation remained unresolved. docs.justia.com

The security issue behind the privacy dispute

The case centres on disclosure, consent and data collection. Its broader significance for cybersecurity is the need to understand data flows generated during ordinary device use.

NIST’s guidance on cybersecurity and privacy recognises that privacy risks can arise from routine data processing, independently of a cybersecurity incident. An organisation can protect its systems against intrusion while still allowing information to leave through services embedded in approved applications.

For security teams, this makes application approval a deeper responsibility. What information does an app transmit? Which embedded components receive it? What changes when tracking is disabled?

Why operational context matters

The sensitivity of data depends partly on what it reveals when combined with other information. NSA guidance on mobile location exposure explains that location data can expose daily routines, movements and associations between people and places. For government, defence and critical infrastructure personnel, those patterns can carry operational significance.

This risk assessment is broader and separate from the court’s findings about Google. It gives organisations a reason to evaluate telemetry and metadata alongside the documents and messages they already classify as sensitive.

Turn privacy expectations into verifiable requirements

Our assessment is that organisations should make three checks part of mobile security reviews:

• Map data collection. Include operating-system services and third-party components within approved apps. Record recipients, purposes and retention periods.
• Test the controls. Compare observed behaviour before and after privacy settings change, using controlled devices and appropriate application and network analysis. Repeat after significant updates.
• Reduce unnecessary collection. Require a business justification for external telemetry and evidence that restrictions work.

Procurement teams should ask vendors to demonstrate these behaviours. Security and privacy teams should jointly define what evidence is sufficient.

The lasting lesson for sensitive environments is straightforward: control over data becomes credible when an organisation can explain what leaves its devices, why it leaves, and how that behaviour is enforced