Richard Lloyd, a former director of Which? consumer group and class representative of campaign group Google You Owe Us, sued the tech giant for collecting browsing data from iPhone users between the years of 2011 and 2012. This was despite Google claiming that it was prevented from doing so by the default settings on the browser Safari.
“This claim was related to events that took place a decade ago and that we addressed at the time. People want to know that they are safe and secure online, which is why for years we've focused on building products and infrastructure that respect and protect people's privacy,” a Google spokesperson said.
The Supreme Court is the final stop for legal judgments in the UK. Lloyd's claim had previously been challenged by Google and overturned in the Court of Appeal.
Lloyd had brought the claim as a class action — on behalf of over 4 million people affected by the alleged data breach.
If he had won, it would have forced Google to pay out compensation to iPhone users to the tune of up to £750 each.
At the time, unlike most other internet browsers, all relevant versions of Safari were set by default to block third party cookies.
A “cookie” is a small block of data that is placed on a device when the user visits a website. A “third party cookie” is a cookie placed on the device not by the website visited by the user but by a third party whose content is included on that website.
Third party cookies are often used to gather information about internet use, and in particular web pages visited over time, to enable the delivery to the user of advertisements tailored to interests inferred from the user’s browsing history.
Google had a cookie known as the “DoubleClick Ad cookie” which could operate as a third party cookie. This enabled Google to identify visits by the device to any website displaying an advertisement from its vast advertising network and to collect considerable amounts of information.
Lloyd first notified Google of the claim in 2017. He applied to the courts for permission to serve the claim out of the jurisdiction, as Google is based in the US.
The Court of Appeal upheld this claim and said that despite the class action being "unusual", it should be allowed due to the fact that iPhone users were all victims of wrongdoing during this period, and had all suffered the same loss.
Google's Supreme Court appeal claimed that competition can only be awarded for financial damage or mental stress.
It also said that the present claim is not suitable as a representative claim.
The ruling is significant because a judgment against Google may have thrown open the doors to representative actions in Britain in other data protection cases. This would allow consumer rights defenders to bring claims against companies that breach privacy law.
The Confederation of British Industry welcomed the ruling. “Introducing a US-style class action could have put a chill on investment and a detrimental impact on firms across the economy without improving access to justice for the majority of consumers,” said Matthew Fell, CBI chief policy director.
Rocio Concha, Which? director of policy and advocacy said the news would be "disappointing" for those affected, adding that the government must allow for an "opt-out collective redress regime which would mean that affected victims would be automatically included in the action and be represented by a body bringing the claim on behalf of those affected.
“People who have suffered from data breaches must be able to hold big companies to account and get the redress they deserve. Which? has repeatedly called for consumers to have an easier route to redress when they suffer from data breaches."
Google is also set to hear the result of a ruling in its appeal against the European Commission on Wednesday, which served it with a record €4.34bn (£3.8bn, ($5.03bn) fine.
Watch: Former Google CEO: AI will be central to ‘how we live our lives’