On Monday, a California judge denied Google’s request for summary judgment in a lawsuit filed by users alleging the company illegally invaded the privacy of millions of people. The people suing Google say that occurred because Google’s cookies, analytics, and tools in apps continued to track internet browsing activity even after users activated Incognito mode Chrome, or other similar features like Safari’s private browsing expecting a certain level of privacy. However, the truth is, as we wrote in 2018, “What isn’t private: private browsing mode.”

Judge Yvonne Gonzalez-Rogers pointed to statements in the Chrome privacy notice, Privacy Policy, Incognito Splash Screen, and Search & Browse Privately Help page about how incognito mode limits the information stored or how people can control the information they share, writing, “Taken as a whole, a triable issue exists as to whether these writings created an enforceable promise that Google would not collect users’ data while they browsed privately.”

In response to the ruling, Google spokesperson José Castañeda provided the following statement to The Verge:

“We strongly dispute these claims and we will defend ourselves vigorously against them. Incognito mode in Chrome gives you the choice to browse the internet without your activity being saved to your browser or device. As we clearly state each time you open a new incognito tab, websites might be able to collect information about your browsing activity during your session.”

Another issue going against Google’s arguments that the judge mentioned is that the plaintiffs have evidence Google “stores users’ regular and private browsing data in the same logs; it uses those mixed logs to send users personalized ads; and, even if the individual data points gathered are anonymous by themselves, when aggregated, Google can use them to ‘uniquely identify a user with a high probability of success.’”

She also responded to a Google argument that the plaintiffs didn’t suffer economic injury, writing that “Plaintiffs have shown that there is a market for their browsing data and Google’s alleged surreptitious collection of the data inhibited plaintiffs’ ability to participate in that market... Finally, given the nature of Google’s data collection, the Court is satisfied that money damages alone are not an adequate remedy. Injunctive relief is necessary to address Google’s ongoing collection of users’ private browsing data.”

The lawsuit was filed in 2020, seeking “at least” $5 billion in damages, and as reported by Mike Swift for MLex, the ruling was not entirely surprising, as the judge had indicated she’d do so, but it is a big one as it moves the case closer toward settlement or a trial.

Update August 7th, 11:23PM ET: Added statement from Google.