Google is asking a federal judge in San Jose, for the second time this year, to throw out a class action accusing it of switching on Gemini-powered "Smart features" in Gmail, Chat and Meet without its users' consent. The case, Thele v. Google LLC (No. 5:25-cv-09704), began with a complaint filed on November 11, 2025, and was rewritten the following day as a first amended complaint. U.S. District Judge Noël Wise dismissed that amended complaint on July 7, 2026, finding that the plaintiffs had not alleged a concrete injury, but allowed them to try again. They filed a second amended complaint on August 18, 2026, and Google moved to dismiss it on September 29. No ruling on that motion had been reported by late October.

The first amended complaint, dated November 12, 2025, remains the fullest statement of what the plaintiffs say happened and why they believe it broke the law. Its central claim fits in one sentence: "on or about October 10, 2025, Google secretly turned on Gemini for all its users' Gmail, Chat, and Meet accounts, enabling AI to track its users' private communications contained in those platforms without the users' knowledge or consent." Google has denied changing anyone's settings. The court has not decided whether either side is right about the facts.

In Short

Two Google users sued the company in November 2025, saying it quietly flipped on a setting that let its Gemini AI read their emails, chats and video calls without asking first. A judge threw out that version of the case in July 2026 because the users could not point to any message the AI had actually read or any real harm it caused, though they were allowed to try again. They did, adding a third plaintiff and new arguments about confusing settings, and Google is now asking the court to dismiss the new version as well.

What the November complaint alleges

The two named plaintiffs are Thomas Thele, who lives in Cook County, Illinois, and Melo Porter, who lives in Santa Cruz County, California. According to the court docket, Thele filed the original complaint alone on November 11, 2025; Porter joined on the amended version filed the next day. Both are represented by Ahdoot & Wolfson, PC, a firm with offices in Burbank and New York, and the amended complaint is signed by Tina Wolfson.

The complaint describes a before and an after. Before, it says, "Google users could 'opt in' and turn on Gemini as a 'Smart' feature for these services, purportedly to 'personalize [their] experience.'" After, it alleges, the feature was on for everyone. "On information and belief, Google turned on this 'Smart features' option - without any notice to users - for all Gmail, Chat, and Meet accounts on or about October 10, 2025," the complaint states, adding that this "enabled Gemini AI to scan, read, and analyze every email (and email attachment), message, and conversation on those services."

The phrase "on information and belief" matters. It is the standard legal formula for an allegation a plaintiff believes to be true but cannot yet prove from personal knowledge. The complaint does not explain how the October 10 date was identified, and it does not cite a Google announcement, a support page change or a notification email that fixes it.

The stakes, as the plaintiffs describe them, are the whole of an inbox. The complaint says Google used Gemini "to access and exploit the entire recorded history of its users' private communications, including literally every email and attachment sent and received in their Gmail accounts." Both plaintiffs say they used Gmail, Chat or Meet "throughout the day" from at least October 10, 2025. Neither says what was in those messages. "In the interest of protecting his privacy and security, Plaintiff Thele does not recite here the precise Gmail, Chat, and/or Meet communications that he sent or received," the complaint says, using near-identical language for Porter. Instead, it lists categories that "could be determined" from their communications: financial and employment records, religious and political affiliations, medical care, the identities of family and friends, and eating, shopping and exercise habits.

That choice later proved costly. It is, in substance, the gap the judge identified eight months later.

The setting at the centre of the case

The complaint opens with Google's own Data privacy settings menu, as it appears on a mobile device. Five entries are listed: Google Usage ID, Report Additional Diagnostics, Smart features, Google Workspace smart features and Package tracking. Beneath them, a link reads "Turn on smart features and personalization in Gmail, Chat, and Meet to personalize other Google products."

The Smart features entry carries a toggle and this description: "When you turn this setting on, you agree to let Gmail, Chat, and Meet use my email, chat, and video content to personalize my experience with smart features in these products." In the version shown in the complaint, the toggle is off.

The plaintiffs' argument turns on that wording. "Despite this setting being in default, 'opt out' status since at least October 10, the setting is still worded as an 'opt in' feature," the complaint says. A user, in their account, is told that turning the setting on is an act of agreement - while, they allege, Google had already done the turning on.

Two details in the menu are worth noting. The description of Smart features does not mention Gemini, artificial intelligence or machine learning. The link between the setting and Gemini is made by the complaint, which defines the option as "Google's ability to track the user's 'email, chat, and video content' with its Gemini AI technology." And Google Workspace smart features appears as a separate entry from Smart features - a structure that became part of the plaintiffs' argument when they rewrote the case in August 2026.

The complaint contrasts all this with Google's contractual language. The only reference to AI in Google's Terms of Service, last modified on May 22, 2024, is in the context of developing and improving services, it says, quoting: "we use artificial intelligence and machine learning to provide you with simultaneous translations, and to better detect and block spam and malware." Google's Privacy Policy, in its July 1, 2025 version, states that "across our services, you can adjust your privacy settings to control whether we collect some types of data and how we use it."

What the plaintiffs cite as evidence

Much of the complaint's factual support comes from outside the plaintiffs' own accounts. Its most vivid passage is drawn from a PCMag column by Ruben Circelli, published on November 5, 2025, under the headline "I Let Gemini Access My Gmail, and It's Downright Creepy." The complaint quotes Circelli's account of Gemini identifying his first crush, his top Facebook friends in 2009 and his best friend in 2010. "How does Gemini know that? The simple answer is that the information is somewhere within the 16 years' worth of my email history that it can access," the passage reads.

The complaint uses the column for two purposes. It presents it as proof of what Gemini can do with an inbox. It also argues that the column shows "even tech journalists monitoring Google's use of Gemini AI in Gmail are not fully aware of this change," because such articles "still characterize the feature as something that must be agreed to and affirmatively turned on." That second reading cuts both ways: the column describes a reporter who chose to give Gemini access, which demonstrates capability rather than default activation.

On scale, the complaint cites an estimate of 1.8 billion active Gmail accounts globally in 2025 and an estimate that 41.9% of US citizens use Gmail, "over 130 million American users." Both figures come from statistics websites - SQ Magazine, in an article dated August 6, 2025, and About Chromebooks, dated August 7, 2025 - not from Google. The complaint says only that class members "number in the millions."

It also reaches back into Google's history. It cites a January 24, 2012 Google blog post by Alma Whitten announcing that the company "may combine information you've provided from one service with information from other services," and that "[w]e'll treat you as a single user across all our products." From that, the complaint argues that Google "is now able to collect and utilize users' private communications through AI 'Smart features' and combine it with existing data profiles it has for its users," enabling "unmerited, improper, and monetizable insights into users' private lives." It does not allege any specific instance of smart features data reaching an advertising profile.

On security, it cites the 2018 Google+ vulnerability, reported by The Wall Street Journal on October 8, 2018, and the subsequent accelerated shutdown of the service after 52.5 million users' data was exposed, as NPR reported on December 11, 2018. "Any information that Google stores through its Gemini AI platform may eventually be stolen, if it has not already been," the complaint says. It also quotes written testimony by Google's then Chief Privacy Officer Keith Enright to the US Senate Commerce Committee on September 26, 2018, that "users trust [Google] to keep their personal information confidential and under their control."

The survey evidence is older still. The complaint cites a May 20, 2015 Pew Research Center report finding that 93% of adults consider it important to control who can get information about them, 90% consider it important to control what information is collected, and 88% say it is important not to be watched or listened to without permission. It cites a 2013 Pew finding that 86% of internet users had taken at least one step to avoid being tracked and that 64% cleared cookies and browser histories, and an April 14, 2010 academic study in which 88% of 18- to 24-year-olds and 94% of 45- to 54-year-olds agreed that "there should be a law that requires websites and advertising companies to delete all stored information about an individual." The most recent survey the complaint relies on was published more than ten years before it was filed.

Five counts and the relief sought

The November complaint brings five causes of action, all resting on the same factual allegation.

Count Law What the plaintiffs allege
One California Invasion of Privacy Act, Penal Code Section 632 Google used Gemini as "an electronic amplifying or recording device to eavesdrop upon or record" confidential communications
Two Intrusion upon seclusion (common law) Google intentionally intruded on private affairs by using AI to track communications
Three California Constitution, Article I, Section 1 The same intrusion violated the state's constitutional right to privacy
Four Comprehensive Computer Data Access and Fraud Act, Penal Code Section 502(c)(1), (c)(2) and (c)(7) Google accessed accounts without permission by "installing - without Plaintiffs' and Class Members' informed consent - AI software that intercepts and/or takes data"
Five Stored Communications Act, 18 U.S.C. Section 2701 Google "intentionally accesses without authorization a facility through which an electronic communication service is provided"

The CIPA count is built on Section 632, the provision on recording confidential communications, rather than on the pen register provision that has driven much of the recent wave of website tracking suits. The Stored Communications Act count adds an allegation that Google's access "included private communications Plaintiffs and Class Members had with third parties that are not affiliated with Google" - people who never had a Google account setting to toggle.

The proposed class covers "All natural persons residing in the United States with Google accounts whose private communications in Gmail, Chat, and/or Meet were tracked by Google's Gemini AI after Google turned on 'Smart features' in those persons' data privacy account settings." Google's officers and directors and the judges on the case are excluded.

The relief requested is broad. Under CIPA, the plaintiffs seek a declaration, "statutory damages and/or trebled actual damages," an injunction against further access and an order requiring Google "to destroy all data created or otherwise obtained from its illegal tracking." Under the privacy counts, they seek punitive damages, describing Google's conduct as "malicious, oppressive, and willful." Under CDAFA they seek compensatory, injunctive and punitive relief and attorney's fees, and under the Stored Communications Act, statutory or actual damages "including profits earned by Google attributable to the violations." The complaint argues that "Money damages, alone, could not afford adequate and complete relief." No dollar figure is claimed beyond the jurisdictional statement that the amount in controversy exceeds $5,000,000, and the plaintiffs demand a jury trial.

California law should govern, the complaint says, because Google's Terms of Service choose it, and Google is alleged, on information and belief, to use servers in California to access the communications.

Google's public position

Google's first public response came ten days after the original filing, though not in court. On November 21, 2025, the official Gmail account publicly denied changing anyone's AI data settings after a viral post by technology YouTuber Dave Jones claimed users had been automatically opted in. According to PPC Land's reporting at the time, Gmail said that smart features had existed for many years and that Gmail content is not used to train the Gemini model. That statement did not mention the lawsuit.

Google has since characterized smart features as long-standing, optional and controlled by the user, according to OpenClassActions, a site that tracks class litigation. That framing is the opposite of the complaint's: if the features were on by default long before October 10, 2025, there was no October switch to complain about - but there would also be no moment at which users opted in.

How the first complaint failed

Google was served on November 13, 2025, according to the docket, and is represented by King & Spalding LLP. The case was first assigned to Magistrate Judge Nathanael M. Cousins and, after a party declined to proceed before a magistrate judge, reassigned on November 14 to Judge Wise. Google filed its motion to dismiss the first amended complaint on January 21, 2026, with a hearing set for April 15, 2026. According to OpenClassActions, the court ultimately decided the motion without a hearing.

Google argued that the plaintiffs never adequately alleged that their own data had been touched and did not describe an injury concrete enough to satisfy Article III of the Constitution, according to Law Commentary, which reported the ruling on July 13, 2026. Article III limits federal courts to actual cases and controversies, which in practice requires a plaintiff to show a concrete, particularized harm before a court will consider whether a statute was broken.

The court agreed. According to Bloomberg Law, which reported the decision on July 8, 2026, Judge Wise found that the plaintiffs had alleged only that Gemini could be used to track their data, which was insufficient to show an injury in fact. The order listed what the complaint left out: when the plaintiffs signed up for their accounts, why October 10, 2025 mattered, whether Gemini was already enabled when they created their accounts, and whether they had since turned the features off. According to Law Commentary, nothing in the complaint ruled out the possibility that Gemini had been running as a default feature well before October. Nor, according to both outlets, did the plaintiffs identify any specific message Gemini analyzed or any piece of personal data it actually accessed or used.

The request for an injunction failed separately. According to Law Commentary, the court found no ongoing or future risk, accepting Google's point that users can eliminate it by switching off the smart features in their account settings - the very step the complaint described as an unfair burden.

According to OpenClassActions, the order cited the Ninth Circuit's 2025 decision in Popa v. Microsoft and the Supreme Court's TransUnion v. Ramirez, both of which limit standing based on a statutory violation alone. The ruling turned on standing alone and did not decide whether Google's conduct violated any of the privacy laws in the complaint. The plaintiffs were given 21 days to amend, a deadline the parties extended by stipulation to August 18, 2026, with court approval on July 16.

What the second amended complaint changes

The rewritten complaint, filed on August 18, 2026, is described here as reported by OpenClassActions, in a case page updated on October 3, and by the privacy law firm ZwillGen, in an October 22 analysis by Michael Bleicher and Jeff Landis that groups Thele with other AI-related wiretap claims.

According to those accounts, it makes six principal changes:

  • Plaintiffs. A third named plaintiff, from Washington state, joins Thele and Porter. According to ZwillGen, one plaintiff alleges receiving Gmail search suggestions that appeared to be AI-generated - the kind of observable sign of use the judge had found missing - while others say they found smart features enabled without having opted in.
  • Timing. The October 10, 2025 date gives way to a looser window in the fall of 2025, with the complaint asserting, according to OpenClassActions, that the exact timing is known only to Google.
  • Consent design. The complaint attacks Google's consent interface as a dark pattern, relying on the definition in the California Consumer Privacy Act. According to ZwillGen, it alleges that turning the features off requires navigating two separate settings and giving up familiar features, including spellcheck and the tabbed inbox, while the setting still reads as an invitation to opt in.
  • Geography. Citing press reports, it alleges the same features are off by default for users in the European Union, the United Kingdom and Switzerland, where opt-in consent is required, according to OpenClassActions.
  • Training and review. On information and belief, it alleges that scanned content may be used to train Google's higher-tier models and may be seen by human reviewers, while acknowledging Google's statement that its base models are not trained on user data.
  • Claims and relief. It adds a claim under California's Unfair Competition Law, recasts the Stored Communications Act claim around the statute's bar on a provider divulging stored communications, and narrows the class to US residents whose communications were accessed, reviewed or analyzed by Gemini after Google enabled it without consent. The relief sought now includes an injunction requiring genuine opt-in consent and deletion of data, including its use for AI training.

Google's second motion

Google moved to dismiss the second amended complaint on September 29, 2026, filing a request for judicial notice alongside it. According to ZwillGen, Google argues that the plaintiffs still have not identified a concrete injury and that its terms of service and privacy policy authorize the conduct the plaintiffs challenge. The second argument goes to the merits: it puts the wording of Google's own terms and privacy policy at the centre of the case.

A clerk's notice on September 30 took an October 13 case management conference off calendar, according to OpenClassActions. ZwillGen described the motion as pending on October 22, and OpenClassActions' October 24 roundup of Google class actions listed the status as "Google's second motion to dismiss pending." No hearing date has been reported.

Why this matters for marketers

For most of the advertising industry, Gmail is two things at once: a communications service and a placement. Gmail ads appear at the top of the Promotions and Social tabs of the consumer inbox and are bought through Demand Gen campaigns. The second amended complaint alleges that switching off smart features costs users the tabbed inbox, the layout that creates those tabs. Neither the complaint nor the published accounts of it address what happens to ad delivery for users who make that trade.

Gmail's inbox advertising has drawn regulatory action before. In September 2025, France's CNIL fined Google €325 million, part of it over advertisements shown in the Promotions and Social tabs to more than 53 million users in France.

The line between inbox content and advertising is also moving. Google's privacy policy dated October 16, 2026 lets data from connected Gmail and Photos accounts shape ads for users who link those services to Search through Personal Intelligence, adding an exception to a promise kept since July 2021 not to use Gmail, Drive or Photos content for ad personalization. That change is opt-in by the policy's own description, and it came almost a year after the Thele complaint was filed. The complaint does not allege that smart features data was used for ads. But the two disputes rest on the same question - whether a person actually chose to let Google read their mail - and the answer shapes what can be built on top of that choice.

Defaults have been the recurring flashpoint in Google's AI rollout. In June 2025, Workspace subscribers received notices that Gemini would be bundled into existing plans without opt-out alternatives. On August 13, 2025, Google switched on Gemini's Personal Context feature by default for eligible users, excluding those in the European Union, the United Kingdom and Switzerland - the same three jurisdictions the second amended complaint now cites. When Google launched Personal Intelligence in beta on January 14, 2026, connecting Gmail and Photos to Gemini, the feature was disabled by default and Google said Gemini does not train directly on the Gmail inbox. Meta, for its part, said in October 2025 that it would use Meta AI conversations to personalize content and ads from December 16, 2025, without asking users to opt in.

The litigation record shows that settings-based privacy claims can succeed against Google when collection is proven. On September 3, 2025, a San Francisco jury in Rodriguez v. Google ordered the company to pay $425.7 million after finding that it violated the privacy of nearly 100 million users who had turned off Web & App Activity, while rejecting the CDAFA claim. That case was built on evidence of data flowing after users changed a setting. Thele, so far, has stalled before reaching the question of what data flowed at all.

The statutory backdrop is shifting too. Governor Gavin Newsom signed SB 690 on September 30, 2026, ending private suits over CIPA's pen register provision for websites and apps from January 1, 2027. Sections 631, 632 and 632.7 keep their private rights of action, and the award under CIPA remains the greater of $5,000 per violation or three times actual damages, as PPC Land reported in its coverage of an IAB paper on the law. The Thele complaint's CIPA count rests on Section 632, so the new law does not touch it. Other tracking cases continue in the same courthouse: a March 2026 suit in San Jose accused Ace Hardware of tracking users who had rejected cookies under CIPA and the federal Wiretap Act.

What Thele has not yet produced is any factual finding. A year after filing, the court has ruled only that the first version of the complaint did not show harm. Whether Google switched anything on, when, and what Gemini did with the content it could reach remain allegations - and the ruling on Google's second motion will determine whether the case moves on to discovery, where those questions could be tested.

Timeline

Summary

Who: Plaintiffs Thomas Thele of Illinois and Melo Porter of California, later joined by a third plaintiff from Washington state, represented by Ahdoot & Wolfson; defendant Google LLC, represented by King & Spalding; and U.S. District Judge Noël Wise of the Northern District of California.

What: A proposed class action alleging that Google turned on Gemini-powered "Smart features" in Gmail, Chat and Meet without consent, in violation of CIPA, CDAFA, the Stored Communications Act and California privacy law. The first amended complaint was dismissed for lack of standing, the plaintiffs refiled with new allegations about dark patterns, European defaults and AI training, and Google has moved to dismiss again.

When: The complaint was filed on November 11, 2025, and amended on November 12, 2025. The dismissal came on July 7, 2026, the second amended complaint on August 18, 2026, and Google's second motion to dismiss on September 29, 2026. No ruling had been reported by late October 2026.

Where: The US District Court for the Northern District of California, San Jose division; the proposed class covers Google account holders residing in the United States.

Why: The plaintiffs say a setting worded as an opt-in was switched on for them without notice, exposing the full contents of their inboxes to Gemini. The court has so far held that they did not show any concrete harm. The outcome bears on how far default-on AI settings can go before users' consent is in doubt - and on the consent foundations that Google's Gmail placements and its expanding use of inbox data for personalization depend on.