A federal judge approved the Google RTB privacy class-action settlement on March 26, 2026, requiring a new opt-in control limiting data shared in ad auctions, with $21.8M in attorney fees.
A federal judge this week granted final approval to a class-action settlement requiring Google to introduce a new user control that limits the personal data the company shares duringreal-time bidding (RTB) auctions - a case that has wound through the courts for nearly five years and that carries direct consequences for how programmatic advertising functions at scale.
United States District Court Judge Yvonne Gonzalez Rogers, sitting in the Northern District of California, signed the order today, March 26, 2026, in the case styled In re Google RTB Consumer Privacy Litigation, Case No. 4:21-cv-02155-YGR. The settlement is for injunctive relief only: no class member other than the named plaintiffs receives monetary compensation. What they do receive is a mechanism, described in court documents as the "RTB Control," that gives them the ability to limit what Google broadcasts about them to the hundreds of companies participating in its advertising auctions.
The ruling closes a lawsuit that began on March 26, 2021, when a complaint was first filed in Hewitt v. Google LLC. Cases were consolidated into the present litigation in June 2021. Google's motion to dismiss was largely denied in June 2022. Plaintiffs sought class certification in July 2023, a motion the court denied without prejudice. The parties then reached a settlement ahead of the renewed certification deadline of September 2, 2025.
According to the Settlement Agreement filed with the court, Google will provide all Settlement Class Members with the ability to limit the information it provides to third parties about them in the Google RTB system. The control will be available at both the account level and the browser level.
When activated, the RTB Control strips RTB bid requests of identifying data. Coverage from September 2025 detailed the technical implications: the control removes encrypted Google User IDs, device advertising IDs, IP addresses, and cookie-matching data from bid requests, and generalizes user-agent strings to the major version level. In effect, it converts a targeted impression into something much closer to contextual inventory - information about the page, but not about the person viewing it.
Google's RTB system, according to expert testimony cited in the litigation, reaches approximately 1.3 million publishers and processes billions of auctions daily. The scope of data shared in each bid request has been documented extensively: Google User IDs, IP addresses, cookie-matching services, user-agent information, publisher IDs, page URLs, unique device identifiers, and "vertical" interest segments covering health conditions, religion, ethnicity, and sexual orientation. According to court documents, Google categorizes users into more than 5,000 consumer segments and subcategories.
Alongside the RTB Control itself, the settlement requires Google to create a dedicated webpage describing the control, with appropriate links to other relevant Google pages, and to send an email to all currently active individual Google U.S. account holders advising them of the new options. According to the court order, all three elements - the RTB Control, the dedicated webpage, and the email - must be live within 30 days of today's final approval.
The Settlement Agreement defines the class as all individual Google account holders subject to U.S. Terms of Service who have an active Google account on the effective date, where "active" means the account has been used within the two years preceding that date. According to the order, although Google was unable to confirm the exact size of the class because it cannot determine which accounts correspond to unique individuals, plaintiffs' expert estimates the class at a minimum of 169 million people and potentially more than 200 million unique individuals.
The court found the settlement class satisfies the requirements of Rule 23, specifically Rule 23(b)(2), which governs injunctive relief classes. Numerosity, commonality, typicality, and adequacy of representation were each addressed. On typicality, the court noted that class representatives are, like all putative class members, subject to Google's Terms of Service, Privacy Policy, and standardized disclosures. On commonality, the court found that "Google's RTB is universal."
Because this is a Rule 23(b)(2) class seeking only injunctive relief, class members had no right to opt out and formal class notice was not required.
One detail that matters considerably for anyone considering future litigation: the settlement's release is narrow by design. According to the Settlement Agreement, class members release only claims for injunctive, declaratory, or other equitable non-monetary relief. Claims for monetary damages - including statutory penalties, unjust enrichment, disgorgement, punitive damages, and restitution - are explicitly preserved for all class members except the seven named class representatives.
The named plaintiffs are Christopher Valencia, John Kevranian, Terry Diggs, Kimberley Woodruff, Rethena Green, Salvatore Toronto, and Tara Williams. Each receives a $15,000 incentive award, approved by the court. The court noted they came forward to represent the interests of millions of others with very little personally to gain, and risked a judgment for attorneys' fees and costs.
The fee dispute is where the court's skepticism becomes most apparent. Class counsel sought $128,358,352 in attorneys' fees - approximately 3.5 times the proposed lodestar of $36,673,815 - plus $3,488,792.96 in costs. Plaintiffs justified the fee request using the percentage-of-fund method, relying on their expert Professor Robert Zeithammer's valuation of the settlement at a minimum of $1.4 billion, derived by multiplying a calculated $36 annual benefit per account holder by the number of account holders expected to activate the RTB Control, assuming an opt-in rate of 8.8%.
The court rejected this approach as too speculative. At the February 17, 2026 settlement hearing, Judge Gonzalez Rogers proposed instead that class counsel be paid based on the actual number of users who make use of the RTB Control. Counsel declined, preferring immediate payment. The court then applied the lodestar method.
After reviewing billing records, the court identified a series of errors and inefficiencies. Appeals costs of $163,300 related to a lost interlocutory appeal were excluded entirely. Discovery motion hours were trimmed sharply - plaintiffs brought and lost seven appeals of the Magistrate Judge's discovery rulings, producing fees the court characterized as unnecessary. Document review hours were reduced to reflect standard review speeds of fifty 10-page documents per hour, against the 8.7 documents per hour billed at a full associate rate of $325. Billing related to Lead Counsel meetings was cut by half due to violations of a court order prohibiting block billing and time spent on fee preparation.
These adjustments produced a revised lodestar of 36,242.15 hours, or $28,570,247.34. The court then applied a discretionary reduction of approximately 10%, bringing the figure to $25,713,222.61. Given what it described as only limited or partial success - plaintiffs initially sought classwide damages exceeding $1 billion and were denied certification for a damages class - the court applied a 0.85 multiplier. According to the order, "the Court finds that the settlement is adequate, but by no means excellent." The final attorneys' fee award is $21,856,239.22. Litigation costs of $3,488,792.96 were approved in full.
Plaintiffs had described the settlement as "an historic victory for hundreds of millions of Americans" that would "fundamentally alter Google's business practices." The court, reviewing press coverage, found the characterization somewhat overheated. The order specifically notes that much of the independent coverage "questions the degree to which this injunctive relief will impact Google, given that the RTB control is an opt-in."
That observation echoes analysis published by AdExchanger in November 2025, which noted that opt-out controls - meaning controls that users must actively choose to enable - rarely drive widespread adoption. History has consistently shown that default settings dominate user behavior, and the RTB Control is no exception: users must affirmatively turn it on. As a result, many industry observers expect the practical effect on Google's auction volume to be limited, at least initially.
The court also noted that the disclosures Google will publish represent what plaintiffs themselves described as "the first consumer-facing disclosures that Google has ever made about its ad auction practices." That framing suggests the informational component of the settlement may prove as significant in the long run as the control itself.
This settlement does not exist in isolation. In January 2025, the Electronic Privacy Information Center and the Irish Council for Civil Liberties filed the first-ever complaint under the Protecting Americans' Data from Foreign Adversaries Act with the Federal Trade Commission, alleging that Google's RTB system - which broadcasts data approximately 31 billion times per day - shares Americans' sensitive behavioral information with entities subject to Chinese government jurisdiction.
That concern intensified further. In February 2026, a separate class action - McGrath v. Google LLC, Case No. 3:26-cv-01446 - was filed in the same Northern District of California, alleging that Google's RTB infrastructure transmitted Americans' browsing data to Pangle (ByteDance), MediaGo (Baidu USA), and Temu (Whaleco Services), in violation of the Bulk Sensitive Data Rule, the Electronic Communications Privacy Act, and California wiretapping statutes.
Meanwhile, Texas finalized a $1.375 billion settlement with Google on October 31, 2025, covering location tracking, incognito monitoring, and biometric data collection. And a federal jury in San Francisco delivered a $425.7 million verdict against Google on September 3, 2025, for continuing to collect data through Firebase SDK even after users disabled tracking.
Each of these cases addresses distinct legal theories and distinct datasets. But together they sketch a coherent picture: Google's advertising infrastructure is facing sustained legal pressure across multiple jurisdictions, on multiple grounds, simultaneously.
For marketing professionals, the most immediate operational question is what happens to audience targeting when a meaningful number of users activate the RTB Control. The data stripped from bid requests - Google User IDs, IP addresses, device IDs, cookie-matching data - are precisely the signals that enable behavioral targeting, frequency capping, attribution, and audience segmentation in open-web programmatic campaigns.
Publishers, particularly independent ones running display advertising through Google's ecosystem, face a related but distinct concern. When users activate the RTB Control, the information that makes their inventory valuable to performance advertisers disappears from the bid stream. Reduced targeting fidelity typically means reduced clearing prices. Google's RTB system processes auctions across approximately 1.3 million publishers; the distributional effects of even modest adoption rates would not be uniform.
The settlement's injunctive relief also compels transparency that has not existed before. For the first time, Google will publish dedicated disclosures explaining how RTB auctions work, what data is shared, and with whom. That transparency may itself generate further regulatory scrutiny - from European data protection authorities, from the UK's Information Commissioner's Office (which first investigated RTB back in 2019), and from state attorneys general who have demonstrated both the appetite and the capacity to pursue privacy enforcement actions against major platforms.
The court retains jurisdiction for one year over all matters relating to the interpretation, administration, implementation, and enforcement of the settlement.
Who: Google LLC, as defendant, and a class of at minimum 169 million - and potentially more than 200 million - active U.S. Google account holders as plaintiffs, with Judge Yvonne Gonzalez Rogers of the United States District Court for the Northern District of California presiding.
What: Final approval of a class-action settlement in In re Google RTB Consumer Privacy Litigation (Case No. 4:21-cv-02155-YGR), requiring Google to create a new "RTB Control" allowing users to limit data shared about them in real-time bidding auctions, to publish dedicated disclosures about its RTB practices, and to email all active U.S. Google account holders about the new control. No monetary damages are awarded to class members. Attorneys' fees were set at $21,856,239.22 and litigation costs at $3,488,792.96. Each of the seven named class representatives receives $15,000.
When: The original complaint was filed on March 26, 2021. The settlement was reached on September 2, 2025. The settlement hearing took place on February 17, 2026. Final approval was granted today, March 26, 2026. Google must implement the RTB Control, publish the dedicated webpage, and send the class notification email within 30 days.
Where: United States District Court, Northern District of California.
Why: The case was brought over allegations that Google's RTB system systematically shared detailed personal information about tens of millions of users - including sensitive health, religion, and identity data - with hundreds of third-party companies participating in its advertising auctions, without adequate disclosure or user control. The settlement addresses the disclosure and control deficit without resolving class members' potential monetary claims, preserving the right to seek damages in future litigation.