Texas Secures Historic $1.375 Billion Data Privacy Settlement with Google

Texas Attorney General Ken Paxton has reached a landmark $1.375 billion settlement with Google to resolve allegations that the tech giant unlawfully tracked and collected Texans’ private data, including geolocation, incognito searches, and biometric information such as voiceprints and facial geometry. This settlement is the largest ever obtained by a single state against Google for violations of state privacy laws, far surpassing previous settlements by other states, including a $391 million secured by a multistate coalition and California’s $93 million settlement. The settlement agreement has not been made public yet. 

Key Allegations and Legal Context 

The lawsuits, filed in 2022, accused Google of: 

• Tracking users’ geolocation even when location settings were disabled. 

• Collecting biometric data (facial geometry, voiceprints) without informed consent. 

• Misleading users about the privacy protections of Chrome’s Incognito mode. 

The claims were brought under various Texas laws, including the Biometric Identifier Act and the Deceptive Trade Practices Act, as well as the newly enacted Texas Data Privacy and Security Act (TDPSA), which took effect on July 1, 2024. 

Settlement Terms and Implications 

• Monetary Relief: Google will pay $1.375 billion to the State of Texas.  

• No Admission of Wrongdoing: Google’s spokesperson stated that Google has not admitted liability or wrongdoing; the settlement resolves “a raft of old claims” related to product policies that Google asserts have already been revised. 

• No Mandated Operational Changes: Google maintains it has already updated relevant privacy controls and policies. According to Google’s spokesperson, the settlement does not require it to make further changes to its products or privacy practices, according to company statements.  

• Ongoing Enforcement: Texas continues to lead aggressive enforcement of data privacy laws, with Attorney General Paxton launching the largest state data privacy and security initiative in the country. 

Comparison to Other State Privacy Actions 

Practical Takeaways for Our Clients 

• Texas is Aggressively Enforcing Privacy Laws: As we have recently advised, the Texas Attorney General’s Office has made clear that it will pursue significant penalties for violations, particularly involving sensitive data and consumer deception. 

• Compliance with Texas and Other State Privacy Laws is Critical: Comprehensive state privacy laws have broad reach and are being enforced with unprecedented vigor. Businesses should review and, if necessary, update their privacy practices, especially regarding: 

• • Geolocation tracking 

• • Biometric data collection 

• • Representations about privacy features. 

• No Safe Harbor from Past Policy Changes: Even if a company has updated its practices, past violations may still be actionable under Texas law, as demonstrated by the focus on “old claims” in this settlement. 

• Potential for Further Litigation: The scale of this settlement may encourage additional state-level enforcement actions or private litigation, particularly in jurisdictions adopting or strengthening their own privacy laws. 

Next Steps for Businesses 

• Review and ensure compliance with the Texas Data Privacy and Security Act and other applicable state privacy statutes, with particular attention to global opt-out provisions. 

• Audit data collection, retention, and disclosure practices, with special attention to geolocation, biometric, and sensitive personal information. 

• Update privacy policies and user disclosures to accurately reflect data practices and available privacy controls. 

• Monitor developments in state and federal privacy enforcement, as Texas’s actions likely signal broader regulatory trends. 

Conclusion 

The $1.375 billion settlement between Texas and Google marks a new era in state-level privacy enforcement, with Texas claiming its spot as a national leader in privacy law enforcement. Companies collecting or processing Texas residents’ data should treat this as a warning to proactively review and strengthen their privacy compliance programs. 

For further guidance or support in navigating these evolving regulatory requirements, please contact our Privacy Law Group. 

NEED HELP WITH DATA PRIVACY AND SECURITY LAW COMPLIANCE? 
The CommLaw Group Can Help! 

Susan Duarte – Tel: 703-714-1318 / E-mail: sfd@commlawgroup.com 

Diana James – Tel: 703-663-6757 / E-mail: daj@commlawgroup.com