Google has agreed to a $5 billion settlement to resolve a class action lawsuit accusing the company of collecting browsing data from users even when they explicitly used Chrome’s incognito mode. The settlement, announced in December 2023, represents one of the largest privacy-related payouts in tech history, though with an important catch: the money won’t be distributed directly to users as cash compensation. Instead, affected users can pursue individual damages claims through state courts—a distinction that has confused many people about what the settlement actually means for their wallets. The core allegation is straightforward but significant. Google promised users that incognito mode would prevent tracking and data collection, yet the company continued to collect browsing information through website analytics, advertising trackers, and its own services.
A user in California, for example, might have opened incognito mode believing their search for a medical condition or sensitive topic was truly private, only to have that information collected and potentially linked to their Google account or used for advertising purposes. The lawsuit, originally filed in 2020, argues this violated both consumer protection laws and privacy expectations. What makes this settlement unusual is that it doesn’t result in a check in the mail. The settlement requires Google to delete billions of data records and implement new privacy protections, but the financial component involves individual consumers filing their own lawsuits in state courts if they want to seek monetary damages. Over 1,000 people have already filed individual state court lawsuits seeking compensation, signaling that many affected users are pursuing compensation through this alternative path.
Table of Contents
- What Was Google Accused of Doing with Incognito Mode Data?
- What Must Google Do Under the Settlement Terms?
- How Can Affected Users Actually Get Money from This Settlement?
- What Privacy Protections Has This Settlement Actually Created?
- What Are the Major Limitations and Misconceptions About This Settlement?
- How Does This Settlement Compare to Other Tech Privacy Cases?
- What Comes Next for Browser Privacy and Google’s Obligations?
What Was Google Accused of Doing with Incognito Mode Data?
google‘s incognito mode, marketed as a private browsing feature, was supposed to work like this: while you’re in incognito, Google won’t save your browsing history, cookies, or site data to your account. The feature became popular precisely because users believed it offered anonymity and privacy. However, the lawsuit alleged that Google was still collecting vast amounts of data about what users did in incognito mode—just through different mechanisms. Google Analytics, for instance, would still track page visits and user behavior. Advertising networks would still collect data. Google’s own services would still create profiles based on incognito activity.
The disconnect between what users believed incognito mode would protect and what actually happened represents a significant trust violation. If you searched for “migraine treatments” in incognito mode to keep that private, Google’s systems could still log that search and potentially use it for advertising, despite the user’s explicit action to browse privately. The lawsuit argued this was deceptive because Google’s own descriptions of incognito mode suggested this wouldn’t happen. Meanwhile, competing browsers offered similar private modes with clearer disclosures about what data would or wouldn’t be collected. One practical example of the impact: a user managing a medical condition might use incognito to research treatments without storing that history locally, yet Google’s backend systems would capture that activity. This becomes particularly problematic when you consider that such data could be sold to data brokers, exposed in a breach, or used in ways that harm the user—like when an employer or insurance company purchases such data from third parties. The lawsuit framed this not just as a privacy violation but as consumer deception, since users took specific action to browse privately based on Google’s representations about incognito mode.
What Must Google Do Under the Settlement Terms?
The settlement requires Google to take several concrete actions beyond simply writing a check. First and most significantly, Google must delete what the company itself characterized as “billions” of data records that reflect private browsing activity collected in incognito mode. This is a massive data deletion effort, though critics have noted that once data is distributed across Google’s vast systems and sold to third parties, complete deletion becomes practically challenging. Second, Google must update how it discloses data collection practices related to incognito mode. Users will receive clearer, more specific information about what Google does and doesn’t collect while in incognito mode.
The company must explain that while incognito mode prevents local storage of history, cookies, and site data, Google and third parties may still track activity through analytics and advertising tools. This transparency requirement addresses one of the core problems in the original lawsuit—users were genuinely misled about what “private browsing” actually protected. Third, Google committed to providing users with a way to block third-party cookies specifically within incognito mode. This is a meaningful technical change that actually reduces tracking capability, not just the appearance of it. A user in incognito mode will be able to configure their browser to prevent third-party websites and ad networks from setting cookies that track their behavior across multiple sites. This is a real privacy enhancement, though it’s worth noting that Google was already moving toward restricting third-party cookies across its entire browser as part of broader industry shifts—this requirement simply applies that change to incognito mode.
How Can Affected Users Actually Get Money from This Settlement?
This is where the settlement structure becomes confusing for many people. Unlike typical class action settlements where money is distributed to class members, this settlement doesn’t include a direct payment mechanism. Instead, the settlement allows individuals to pursue damages through individual lawsuits filed in state courts. This approach actually gives plaintiffs potentially more control and larger recovery amounts, but it also requires individuals to take their own legal action rather than simply being paid from a settlement fund. More than 1,000 people have already filed individual state court lawsuits seeking monetary damages since the original class action allegations surfaced. These plaintiffs are arguing that Google’s deceptive practices caused them harm—through misuse of their data, invasion of privacy, or other damages they can quantify.
Some states have stronger privacy laws and damage provisions than others, which means the potential recovery varies depending on where a person lives and which court has jurisdiction. A person in California, for instance, may have different legal remedies available under California law than someone in Texas, where privacy protections differ significantly. The key limitation here is awareness and access to legal representation. Most affected users don’t know they can file individual claims, and doing so typically requires hiring an attorney. The settlement effectively shifts the burden from a centralized class action distribution to individual litigation, which means those with resources and knowledge can potentially recover damages, while others may never learn about this option. Consumer advocacy groups and legal aid organizations have begun highlighting this path for affected individuals, but the uptake remains relatively low compared to the total number of people whose data was collected.
What Privacy Protections Has This Settlement Actually Created?
The settlement goes beyond just deleting data—it requires Google to implement technical and policy changes that affect how incognito mode works going forward. The requirement to provide cookie-blocking tools in incognito mode is particularly significant because it represents a concrete privacy enhancement. When you use this feature, third-party trackers cannot follow you across websites as easily. An advertiser that normally tracks you across multiple sites to build a profile for targeted ads would be blocked from doing so while you’re in incognito mode with this setting enabled. However, there’s an important limitation to understand: blocking third-party cookies doesn’t prevent Google itself from collecting data in incognito mode. Google’s own properties—YouTube, Gmail, Google Maps, and others—don’t rely on third-party cookies to track you. They can and will still collect data when you’re logged into your Google account, even in incognito mode.
The settlement doesn’t change this fundamental reality. Additionally, websites you visit can still track you through other methods like fingerprinting, IP-based tracking, or first-party data collection that doesn’t rely on cookies. Incognito mode has always had these limitations, and the settlement doesn’t address them. The transparency improvements are meant to help users understand these realities. By clearly explaining what is and isn’t protected by incognito mode, Google’s updated disclosures should prevent the kind of deception that led to the original lawsuit. In practice, many users still conflate incognito mode with anonymity, when it’s really just a feature that prevents local storage of browsing data. The settlement requirements push Google toward more honest representations, but they don’t fundamentally change what incognito mode can or cannot do technically.
What Are the Major Limitations and Misconceptions About This Settlement?
The biggest misconception is that this settlement means Google was found liable and has admitted wrongdoing. In reality, Google settled the case without admitting fault—a common legal strategy that allows companies to resolve disputes without establishing legal precedent or acknowledging guilt. This means the settlement is important for its practical effects (data deletion, policy changes, individual claims opportunities) but not as an official legal determination that Google violated users’ rights. Future plaintiffs would need to prove their cases independently. Another critical limitation involves the scope of deletions. While Google agreed to delete “billions” of records, the company hasn’t specified exactly which records or how thoroughly this will be verified. Data that was already sold to third parties or shared with advertisers and data brokers presents a practical problem—deleting it from Google’s systems doesn’t bring it back from everywhere it’s been distributed.
A user’s incognito browsing data that was sold to a data broker before the settlement took effect is now in that broker’s hands, potentially permanently. The settlement addresses Google’s role but can’t undo distribution that already occurred. The settlement also doesn’t provide a clear mechanism for ongoing privacy enforcement. Google committed to certain practices, but oversight and penalties for violations aren’t as formalized as they would be under some regulatory frameworks. Additionally, the individual litigation path means that actual monetary recovery is available only to people who either hire attorneys or find group representation. The vast majority of affected users—potentially hundreds of millions of people whose data was collected—will never file claims and will receive no compensation. This creates a situation where those with resources and legal access can potentially recover damages, while most people whose privacy was violated receive only the indirect benefit of Google’s policy changes.
How Does This Settlement Compare to Other Tech Privacy Cases?
Google’s $5 billion settlement is among the largest in tech history, but it’s not without precedent. Facebook paid $5 billion to the Federal Trade Commission in 2019 for privacy violations related to the Cambridge Analytica scandal, setting a benchmark for large-scale privacy penalties. However, that FTC settlement was a government enforcement action with direct oversight, whereas Google’s settlement emerged from class action litigation with a different structure. Amazon and Apple have also faced privacy-related settlements, though typically for smaller amounts or more narrowly defined violations.
The interesting comparison point is that Google’s settlement specifically addresses consumer deception about privacy features, whereas many other tech settlements address broader data misuse or security failures. This settlement is unique in that it requires specific technological changes (cookie blocking in incognito) and data deletion at scale. It also uniquely allows individual state court litigation as an alternative recovery mechanism, which differs from the class action distributions more common in other settlements. International privacy regulators, particularly those enforcing Europe’s GDPR, have taken different approaches—imposing larger financial penalties but often with more direct enforcement oversight.
What Comes Next for Browser Privacy and Google’s Obligations?
The settlement represents a snapshot of Google’s privacy obligations as of 2023-2024, but browser privacy continues to evolve. Google has committed to phasing out third-party cookies across Chrome entirely—a project that predates this settlement but is accelerated by increasing regulatory pressure and this settlement’s requirements. The company has signaled that by 2025, third-party cookies will be gone for most users, replaced with alternative tracking technologies like the Privacy Sandbox initiative. This settlement essentially forces Google to implement these cookie-blocking changes in incognito mode first, serving as a proof-of-concept for broader browser changes. Looking forward, the effectiveness of this settlement depends on both Google’s compliance with its obligations and users’ awareness of the tools now available to them.
As incognito mode gains cookie-blocking capabilities, users who enable these features will have genuinely improved privacy compared to before. However, the long-term privacy landscape will likely be determined by regulatory actions rather than settlements. The FTC, state attorneys general, and international regulators are all investigating tech companies’ privacy practices. If stronger privacy regulations emerge—particularly around data minimization and collection practices—they may supersede the specific requirements in this settlement. For now, Google’s obligations under this settlement represent one of the more concrete privacy protections extracted from the company, though they’re limited to a feature that most users don’t fully understand or consistently use.
You Might Also Like
- Google Chrome Incognito Mode Tracking $5 Billion Privacy Class Action Settlement
- Snap Inc Snapchat Privacy Data Collection Class Action Settlement
- Meta $1.4 Billion Texas Biometric Data Collection Class Action Settlement
Open Settlements You Can Claim Now
Browse current class action settlements accepting claims — several require no proof of purchase: