A federal appeals court on April 20, 2026, issued a ruling that closes off a last-ditch attempt by a group of Google Chrome users to revive class-wide damages claims in a lawsuit alleging that Google secretly collected browsing data from users who believed they were protected by Incognito mode. The decision, filed in the United States Court of Appeals for the Ninth Circuit under case number 24-5692 and docket entry 1160 in the underlying Northern District of California case 4:20-cv-03664-YGR, represents a significant procedural endpoint in litigation that began nearly six years ago and has wound through discovery, class certification disputes, a near-trial settlement, and now an appellate ruling on intervention timing.

The opinion, authored by Circuit Judge Kenneth K. Lee and joined by Judges Richard R. Clifton and Jay S. Bybee, describes the matter as a case of "too little, too late" for the would-be intervenors, a group of 185 Google Chrome users known in the proceedings as the Salcido plaintiffs.

Background: the original Incognito lawsuit

The litigation has its roots in a complaint filed on June 2, 2020, by three named plaintiffs - Chasom Brown, Maria Nguyen, and William Byatt - along with others, in the Northern District of California. That original complaint, filed by attorneys at Boies Schiller Flexner LLP, accused Google LLC and its parent Alphabet Inc. of intercepting and collecting users' browsing data even when those users had activated "private browsing mode" on their web browsers.

According to the complaint, Google accomplished this through tools that include Google Analytics, Google Ad Manager (formerly known as DoubleClick for Publishers), the Google Sign-In button, and approved third-party tracking pixels. The complaint alleged that more than 70% of online publishers use Google Analytics, and that a similarly large proportion use Google Ad Manager. Both products embed Google's own code into third-party websites. When a browser loads one of those sites, that embedded code causes the browser to transmit the user's IP address, URL requests, browser and device information, and other identifying data directly to Google's servers in California.

The mechanism is technical but straightforward. When a user visits a webpage, the browser sends what is called a GET request to that site's server. On sites carrying Google's embedded code, Google's script directs the browser to duplicate that request - including the referer header containing personally-identifiable URL data - and send a separate, identical request to Google's own servers. According to the complaint, this process happens billions of times per day and occurs regardless of whether the user ever interacts with a Google advertisement.

What made the lawsuit notable was the plaintiffs' contention that this tracking continued even when users were browsing in private mode. Google's own "Search and Browse Privately" page told users that activating private browsing mode on Chrome, Safari, Microsoft Edge, or Firefox would allow them to "browse the web privately." The complaint quoted Google's privacy materials stating that users were "in control of what information you share with Google when you search." According to the plaintiffs, both statements were false. Google's tracking tools were designed to operate automatically regardless of the user's privacy settings.

Professor Douglas C. Schmidt of Vanderbilt University, whose 2018 white paper "Google Data Collection" was cited in the complaint, wrote that a dormant, stationary Android phone with Chrome active in the background communicated location information to Google 340 times during a 24-hour period, or at an average of 14 data communications per hour. Location information, according to the Schmidt research, constituted 35% of all data samples sent to Google during that observation period. The complaint also cited a separate identification mechanism: a browser-level unique persistent identifier transmitted via what is known as the X-client-Data Header, which, according to reporting in The Register cited in the filing, was sent whenever Chrome loaded a page containing Google Analytics or Ad Manager, even after a user cleared the browser cache.

The case was brought under four theories: violation of the Federal Wiretap Act (18 U.S.C. sections 2510 et seq.), violation of the California Invasion of Privacy Act (California Penal Code sections 631 and 632), invasion of privacy under the California Constitution, and intrusion upon seclusion. The proposed class period ran from June 1, 2016 through the time of filing. The complaint defined two subclasses - one for Android device owners browsing in private mode without being logged into a Google account, and one for non-Android Google account holders doing the same.

Settlement and the damages class denial

After two and a half years of discovery, the district court in December 2022 certified a class under Federal Rule of Civil Procedure 23(b)(2), which covers claims for injunctive and declaratory relief. However, the court declined to certify a damages class under Rule 23(b)(3), finding that the named plaintiffs had not shown that common questions of law or fact predominate over individual ones. The named plaintiffs sought interlocutory review of the damages certification denial under Rule 23(f), but the Ninth Circuit declined to grant that discretionary appeal in March 2023.

The case then moved toward trial on the injunctive relief class's claims. Several weeks before trial was set to begin in February 2024, the parties reached a settlement in principle. On April 1, 2024, the named plaintiffs moved for approval of that class settlement. According to the Ninth Circuit's April 20 opinion, the settlement resolved the certified injunctive relief class's claims: Google committed to making changes to its policies, including clarifying how data is used in its disclosures and remediating certain data it had retained. The five class representatives retained the right to seek individual monetary damages through arbitration, but they waived their appellate rights regarding the Rule 23(b)(3) damages class denial.

Critically, the settlement agreement also provided that none of the absent class members would release their own damages claims or waive any right to appeal the denial of the damages class. That clause became the pivot point for the subsequent intervention dispute.

The Salcido plaintiffs and the intervention attempt

Three months after the settlement was filed, on July 2, 2024 - one month before the final settlement approval hearing - the Salcido plaintiffs moved to intervene in the case. According to the Ninth Circuit opinion, their stated goals were threefold: to appeal the district court's refusal to certify a damages class, to obtain access to discovery materials, and to gain a copy of a tolling agreement between Google and the named plaintiffs. Their central argument was that the settlement was unfair to absent class members and that they needed to intervene to preserve those members' appellate rights.

The district court denied the motion in a short, four-page order, finding it untimely. The court noted the motion was filed "well over a year since the Court denied certification of a damages class in this case." Even crediting the Salcido plaintiffs' claim that they were unaware of the appellate waiver in the settlement agreement until April 2024, the court found they had "failed to explain the three-month delay in moving to intervene."

Separately, days after the named plaintiffs filed the settlement, the Salcido plaintiffs filed individual complaints in California state court seeking damages for Google's collection of their private browsing data. That parallel state proceeding did not go well either. The California Superior Court granted Google's demurrer with leave to amend in May 1, 2025, finding that a portion of the Salcido plaintiffs' damages claims under the California Invasion of Privacy Act were barred by the statute of limitations. According to the Ninth Circuit opinion, the Salcido plaintiffs did not file an amended complaint within the ten days the state court allowed.

The Ninth Circuit's analysis

The Ninth Circuit affirmed the district court's denial on three independent grounds drawn from the court's standard three-part test for assessing timeliness under Federal Rule of Civil Procedure 24: the stage of the proceedings, the prejudice to other parties, and the reason for and length of the delay.

On prejudice, the panel held that the district court did not abuse its discretion. The opinion explains that the relevant question is whether the Salcido plaintiffs delayed after they "knew, or reasonably should have known," that their interests were not being adequately represented. The court reasoned that this clock began running no later than December 2022, when the district court denied the damages class, and perhaps as early as March 2023, when the Ninth Circuit itself declined the Rule 23(f) petition. At that point, the named plaintiffs could no longer pursue class-wide damages, meaning that anyone seeking class damages should have been on notice. The Salcido plaintiffs did nothing until July 2024, a gap of approximately 19 months from the damages class denial.

The consequence of that delay was concrete. Allowing intervention would, in the panel's analysis, require Google and the named plaintiffs to scrap the settlement entirely and restart negotiations. The opinion cited the Ninth Circuit's earlier ruling in Orange County v. Air California, 799 F.2d 535 (9th Cir. 1986), where the court found that the possibility of a settlement unraveling was "so prejudicial that to allow the City of Irvine to intervene at this late date would be tantamount to disaster."

The panel also addressed an important procedural argument raised by the Salcido plaintiffs. They argued that a different rule applies when would-be intervenors seek to enter solely to appeal a class certification denial - specifically, that the intervention motion is timely so long as it was filed within the period the named plaintiffs could have appealed a final judgment, and because no final judgment had yet been entered, their motion was timely by definition. The Ninth Circuit rejected this argument, explaining that two prior cases the Salcido plaintiffs relied upon, United Airlines v. McDonald (432 U.S. 385, 1977) and State of Alaska v. Suburban Propane Gas Corp. (123 F.3d 1317, 9th Cir. 1997), both involved intervention motions filed after final judgment had already been entered. Those cases created no special timing rule for class actions; they simply reflected that when intervention occurs post-judgment, the window is the standard appeal period.

The panel also addressed the structural problem with the Salcido plaintiffs' approach. Even if they could intervene, the proposed settlement contains a clause in which the class plaintiffs waive the right to appeal the damages class certification denial. Stripping that clause from the settlement - which is effectively what granting the intervention would do - would send the parties back to negotiations from scratch. Whether a modified settlement could be structured that preserved the injunctive relief agreement while allowing a damages appeal was not clear from the record. The named plaintiffs had already tried and failed to obtain interlocutory review under Rule 23(f). Under the Supreme Court's 2017 decision in Microsoft Corp. v. Baker, 582 U.S. 23, a party cannot voluntarily dismiss individual claims to manufacture a final judgment for appeal purposes. Without a final judgment or a successful Rule 23(f) petition, there was no procedurally viable path to appeal the damages class denial.

On delay, the panel declined to excuse the three-month gap between April 2024 and July 2024, during which the Salcido plaintiffs said they were processing the settlement's contents. The court noted that three reasons offered on appeal - lack of notice of the settlement, lack of an unredacted docket version, and difficulty accessing the tolling agreement - were each insufficient. The settlement agreement had been filed publicly; the Salcido plaintiffs' own counsel had conceded at the lower court hearing that they knew of it promptly after it was filed. There was also no evidence they believed the tolling agreement applied to their own claims.

The stage-of-proceedings factor likewise disfavored the Salcido plaintiffs. The district court found the motion was filed on the eve of the final settlement approval hearing and more than a year after the damages class denial. The Ninth Circuit agreed that the settlement did not constitute a sufficiently sharp "change of circumstance" to restart the intervention clock from zero.

What it means for the ad tech and marketing community

The ruling closes off one route to class-wide monetary damages in this specific case, but it leaves intact several other legal proceedings touching on closely related conduct. Texas finalized a $1.375 billion settlement with Google in October 2025covering location tracking, Incognito monitoring, and biometric data collection - the largest privacy settlement obtained by any state attorney general against Google. A federal jury in San Francisco delivered a $425.7 million verdict against Google in September 2025 in Rodriguez v. Google LLC, finding that the company continued collecting data through its Firebase SDK even after users explicitly disabled Web and App Activity tracking. A federal judge approved the Google RTB class-action settlement in March 2026, requiring Google to introduce a new opt-in control limiting the personal data it shares in real-time bidding auctions.

For advertising and marketing professionals, the original Incognito complaint describes the plumbing that underpins much of digital advertising: Google Analytics and Google Ad Manager together reach more than 70% of online publishers, according to the 2020 filing, and both operate by causing user browsers to transmit identifying data to Google's servers as a byproduct of normal page loads. The complaint's description of GET request duplication - where Google's embedded code causes a browser to copy the referer header from the user's request to the website and send an identical request to Google - is the technical mechanism by which Google correlates browsing history across the web, linking individual sessions to user profiles that inform ad targeting.

Google has been making structural changes to how its measurement and consent architecture works in 2026, including a June 15, 2026 change that removes Google Signals from its role as a co-controller of advertising data collection and consolidates that authority under Consent Mode settings managed within Google Ads. The EFF filed complaints with California and New York attorneys general in April 2026 over a separate data-handover dispute, continuing a pattern of regulatory and legal pressure on the company's data practices that PPC Land has tracked across multiple jurisdictions and product lines.

The Brown v. Google LLC settlement does require Google to make specific policy changes - clarifying how data is used in its disclosures and remediating certain retained data. But because class-wide monetary damages were never certified, there is no fund from which individual affected users can collect compensation. The five named plaintiffs will pursue individual monetary claims in arbitration. The absent class members whose browsing data was allegedly collected retain their own causes of action but must now pursue them individually or in separate proceedings, a path the Ninth Circuit opinion itself notes is practically difficult given the relatively small individual damages involved.

Timeline

Summary

Who: The Ninth Circuit panel of Judges Clifton, Bybee, and Lee ruled against the Salcido plaintiffs - a group of 185 Google Chrome users who sought to intervene in the Brown v. Google LLC class action - and in favor of the named plaintiffs and Google as appellees.

What: The court affirmed the denial of a motion to intervene under Federal Rule of Civil Procedure 24. The Salcido plaintiffs wanted to appeal the district court's December 2022 refusal to certify a damages class in a lawsuit alleging that Google secretly tracked Chrome users' browsing activity while they used Incognito mode, in violation of federal wiretap law and California privacy statutes. The Ninth Circuit held the motion untimely under the three-part test applied to intervention motions in the circuit: the stage of proceedings disfavored intervention, the delay was unreasonable and unexplained, and granting the motion would have likely required unwinding a negotiated class settlement.

When: The opinion was filed on April 20, 2026, following oral argument held on September 19, 2025. The underlying class action was originally filed on June 2, 2020. The Salcido plaintiffs filed their intervention motion on July 2, 2024.

Where: The appellate court is the United States Court of Appeals for the Ninth Circuit. The underlying district court proceedings took place in the Northern District of California before Judge Yvonne Gonzalez Rogers. Oral argument was held in Pasadena, California.

Why: The ruling matters because it resolves the last procedural attempt to appeal the denial of a class-wide damages certification in a case that spanned nearly six years, involved allegations affecting hundreds of millions of Chrome users, and produced a settlement requiring Google to modify its privacy disclosures. Class-wide monetary damages remain uncertified. Individual users whose data was allegedly collected during private browsing sessions between June 1, 2016 and the settlement retain theoretical causes of action but must pursue them outside this class action. The ruling also adds a procedural data point on how the Ninth Circuit applies its three-part intervention timeliness test in the specific context of post-settlement intervention to appeal class certification denials.

Share this article
The link has been copied!