The news
On August 28, 2026, U.S. District Judge Richard Seeborg left the $425.7 million Google privacy verdict in place, rejecting Google's bid to overturn a jury's finding that it collected app data after users opted out. He also awarded class lawyers about $147 million.
The order denied Google's renewed motion for judgment as a matter of law, a request to set aside a verdict the evidence allegedly cannot support, and the plaintiffs' motion for a new trial on the computer-fraud claim they lost. Seeborg rejected Google's argument that the class lacked common proof of a privacy interest, saying whether to credit the evidence was the jury's call.
The case, Rodriguez v. Google LLC in the U.S. District Court for the Northern District of California, was filed on July 14, 2020. Plaintiffs alleged that Google kept collecting activity data from non-Google mobile apps through its Firebase and Google Mobile Ads software development kits (SDKs), code that app makers build into their apps, even after users turned off or paused the Web & App Activity setting in their Google accounts. The two certified classes cover about 98 million account holders from July 1, 2016, to September 23, 2024.
On September 3, 2025, a jury found Google liable for invasion of privacy under the California Constitution and common-law intrusion upon seclusion, but not under California's Comprehensive Computer Data Access and Fraud Act, and awarded $425.7 million in compensatory damages with no punitive damages. On January 30, 2026, Seeborg refused to decertify the classes and rejected the plaintiffs' request for $2.36 billion in disgorgement of Google's profits. Judgment entered on March 2, 2026, came to $440,345,685.40 with interest, according to OpenClassActions.
A separate order granted class counsel one-third of the common fund, $146,781,895.13 as of final judgment. Bloomberg Law reported that the fees go to Boies Schiller Flexner, Susman Godfrey and Morgan & Morgan, which worked on contingency. Seeborg called the fee "extraordinary, but it is warranted by the extraordinary nature of the case," and noted that each class member would receive less than $5.
Seeborg used the lodestar, meaning hours worked multiplied by hourly rates, only as a cross-check: 49,670 hours at counsel's rates came to about $56.8 million, implying a 2.59 multiple. He also granted $135,000 in service awards to the three class representatives.
The numbers
- Jury verdict (compensatory damages)
- $425.7 million
- Judgment with interest, March 2, 2026
- $440,345,685.40
- Attorneys' fees awarded
- About $147 million (one-third of judgment)
- Class members
- About 98 million
- Class period
- July 1, 2016 to September 23, 2024
- Disgorgement request rejected January 30, 2026
- $2.36 billion
Why CEOs should care
The core of this case is a gap between what a privacy control says and what the software behind it does. CISOs and privacy officers should test, not assume, that every analytics and advertising SDK in their apps stops sending data when a user opts out, and should document those tests. A useful question for any product team: if a user switches off tracking, which of our third-party libraries still transmit, and who would know?
For CFOs and general counsel, the math is the lesson. Each class member stands to receive less than $5, according to the fee order, yet the judgment reached about $440 million with interest, and one-third of it goes to lawyers. Companies with tens of millions of users should model class-wide exposure for privacy claims, check whether cyber and privacy insurance covers common-law claims like intrusion upon seclusion, and review how reserves would handle a verdict that survives post-trial motions.
Boards should treat privacy settings as promises that carry legal risk. The jury found liability on state constitutional and common-law privacy claims even though it rejected the statutory computer-access claim. Directors can ask management when the company last verified that its consent settings, disclosures and data flows match, and who owns that check.
The bigger picture
The ruling shows that a privacy class action over a settings mismatch can reach a jury, win and hold up after trial. It also shows the limits: Seeborg rejected the push for $2.36 billion in disgorgement, so the remedy so far is compensatory damages rather than a claim on Google's profits. For companies that rely on embedded SDKs from large platforms, the case is a warning that data flows continuing after users switch them off can carry nine-figure liability.
What happened next
The clerk taxed $152,654 in costs against Google on September 3, 2026; on September 10, Google moved to strike all costs, arguing the mixed verdict meant no party prevailed. On September 17, class counsel asked Seeborg to clarify whether the fee order had denied or deferred their separate $12.4 million request for litigation expenses from the fund. On September 21, Google appealed the March 2 judgment and related orders, including the August 28 denial of its renewed motion, to the U.S. Court of Appeals for the Ninth Circuit; former U.S. Solicitor General Elizabeth Prelogar signed the notice. A second notice of appeal, its filer not shown on the public docket, was filed on September 28. OpenClassActions reported no Ninth Circuit case number or briefing schedule as of September 26.
No money will reach class members until the appeal is resolved and the court approves a distribution plan. Watch for the Ninth Circuit's briefing schedule and any bid by Google to pause enforcement of the judgment.
