Google agrees to $22.5M fine for latest privacy breakdown

LOS ANGELES — Google agreed to pay a record $22.5 million fine to settle allegations by the Federal Trade Commission that it violated a pledge to protect the privacy of its users who use Apple's Safari browser.

The FTC is ramping up efforts to protect the online privacy of consumers and said it levied the largest fine in its history against Google to send a clear message to the Internet giant, which bypassed Apple software's privacy settings to track users across the Web.

The FTC said the behavior violated terms of the settlement Google reached with the commission last year over its now-defunct Buzz social-networking service.

The FTC ordered Google to disable all the tracking cookies by next year. Tracking cookies are snippets of computer code that collect information about how users browse the Web and can be used to show users ads based on their browsing history.

The FTC said Google informed Safari users that since the browser blocks third-party cookies, they did not need to opt out of online tracking.

Yet Google in fact placed a temporary cookie on computers, tablets and mobile devices, a privacy breach first reported by Stanford researcher Jonathan Mayer.

By enabling the company's DoubleClick advertising network to shadow unwitting Safari users, Google got a better handle on what kinds of marketing pitches to show them, according to the FTC.

In reaching the settlement, Google did not admit any liability.

"We set the highest standards of privacy and security for our users," Google said in an emailed statement. "The FTC is focused on a 2009 help center page published more than two years before our consent decree, and a year before Apple changed its cookie-handling policy. We have now changed that page and taken steps to remove the ad cookies, which collected no personal information, from Apple's browsers."

Google did not contest the facts in the FTC complaint and its defense that it was unaware of what it was doing was "immaterial," David Vladeck, director of the FTC's bureau of competition, said on a conference call Thursday after the announcement.

"As a regulator, it is hard to know which answer is worse — I didn't know or I did it deliberately," Vladeck said.

"We hope that the civil penalty we're imposing here today and continued monitoring of Google's performance by the commission and by others frankly will force Google to have a better sense of what's going on."

Under scrutiny

Google has increasingly found itself in the regulatory cross hairs as privacy advocates decry how it handles users' personal information as it looks to maintain its dominance in search, which still makes up the bulk of its revenue.

The FTC says it will continue to monitor Google to ensure that it does not engage in deceptive practices.

Google has 19 years left on the 20-year settlement it reached last year that prevents the search giant from misrepresenting how it handles user information and requires Google to submit to regular privacy audits.

Vladek said the "magnitude of the violation" called for a "substantial civil penalty" and that the FTC would levy stiffer penalties for future violations.

"Google is paying what we think is a heavy price," Vladek said. "This sends the message that the FTC isn't kidding around."

Marc Rotenberg, president of the Electronic Privacy Information Center (EPIC), said he was pleased with the FTC's action to protect consumers' online privacy.

"Google's hack of the Safari browser clearly violated the terms of the order," Rotenberg said.

The latest settlement doesn't affect a separate FTC inquiry over whether Google has been abusing its dominant position in Internet search to highlight its own services over rivals and drive up online advertising prices.

Plenty of money

Although the $22.5 million fine is a record for the FTC, it won't leave much of a financial dent at Google.

The company had $43 billion in cash at the end of June and generates $22.5 million in revenue roughly every four hours.

"This record fine will send a signal to a lot of Internet companies, but there's still some question whether the FTC has the authority and resources to rein in an entity as big and powerful as Google," said Carl Tobias, a Richmond University law professor who followed the Safari case.

Bad publicity may be the bigger blow for Google, which takes so much pride in its scruples that it has adopted "Don't Be Evil" as its corporate motto.

"This has to sting. They don't want to lose too much goodwill," said Justin Brookman, director of consumer privacy for the Center for Democracy & Technology.

Material from The New York Times and The Associated Press is included in this report.

By Jessica Guynn Los Angeles Times

By Jessica Guynn
Los Angeles Times