Google Ad Tools Illegally Collect Disability Data From Calif. DMV: Class Action

When Katherine Wilson, a California resident, renewed her disability parking placard on the DMV website in June, she provided the department with her personal information, including disability information, the complaint said. This month, while renewing, Wilson discovered Google “secretly used" Google Analytics and DoubleClick “to unlawfully collect her personal information from her motor vehicle record, and intercept and learn the contents of her communications with the DMV,” it said. Google later used the plaintiff’s information to generate revenue for its advertising and marketing business without her consent, the complaint said.

In obtaining personal information from DMV records and using it for a purpose not permitted under law, Google violated the federal Driver’s Privacy Protection Act (DPPA), alleged the complaint. And because Google learned the contents of Wilson’s and class members’ communications with the DMV, and used it without their consent, it violated California’s Invasion of Privacy Act (CIPA), it said.

Congress enacted the DPPA in response to California DMVs’ practice of freely disclosing drivers’ personal information “acquired through states’ coercive power,” alleged the complaint. The law also addressed “the invasion of privacy associated with unconsented disclosure of such personal information to direct marketers for commercial purposes,” the complaint said. Personal information under DPPA includes a photograph, Social Security and driver’s license numbers, name, address, phone number and “medical or disability information,” it said. A disabled parking placard, which relates to a driver’s permit, falls under the DPPA’s definition of “motor vehicle record,” it said.

Google Analytics and DoubleClick obtain and permit the DMV to transmit users’ “email addresses, disability information, disability placard information, and other identifying information" from the DMV’s motor vehicle records, and about users’ activity on the DMV website, including the contents of users’ communications with the DMV, the complaint said. Google didn’t obtain consent to learn the contents of Wilson’s communications with the DMV “or to use that information,” the complaint said.

That information is combined with “cid” (Client ID) and “jid” (Join ID) information that Google “obtains about users as they move around the DMV website, along with email address information, to connect that information to Google’s user profile,” said the complaint alleged. “This enables advertisers to target users with relevant content or advertisements using the personal information and data that Google harvested from the driving records maintained by the DMV and from the contents of website users’ communications with the DMV,” it said. The jid and cid parameters include data that “differentiate users from one another and can be used by Google Analytics and DoubleClick to link the collected data to create a unique user profile,” it said.

Google “feeds the vast quantities of personal data obtained from and learned by Google Analytics and DoubleClick into the marketing and advertising systems that it sells to its customers,” alleged the complaint. The tech company “capitalizes on the data and information it collects to identify, characterize, and categorize users, selling to its marketing and advertising customers the ability to target specific demographics,” it said.

Wilson seeks an order enjoining Google from obtaining and using personal information from DMV motor vehicle records; an order enjoining the defendant from learning the contents of plaintiffs’ and class members’ communications with the DMV; plus awards of statutory and actual damages under the DPPA and CIPA, pre- and post-judgment interest, and attorneys’ fees and costs. Google didn't comment Tuesday.