White v. Google et al

On January 5, 2026, lead plaintiff John White initiated a class action lawsuit against Google and its affiliates in the U.S. District Court for the Northern District of California. The complaint alleged that Google secretly intercepted, scanned, and monetized users' private emails, browsing histories, and real-time location data without meaningful consent. White claimed that Google's pervasive tracking code constituted unauthorized access to protected computers in violation of the Computer Fraud and Abuse Act (CFAA) and illegal wiretapping under the California Invasion of Privacy Act (CIPA). Google moved to dismiss, arguing that its data practices were fully disclosed in privacy policies and that users impliedly consented by using the services. The lawsuit sought billions in statutory damages and an injunction to dismantle the alleged surveillance apparatus. The case quickly drew widespread attention as a pivotal test of whether tech giants can face criminal-style liability for everyday data harvesting.

As of June 2026, the court largely denied Google's motion to dismiss, holding that the plaintiffs sufficiently alleged that the interceptions exceeded the scope of any plausible user consent and could support criminal violations. The CFAA and CIPA claims have survived, and the case is proceeding into discovery, exposing Google to potentially massive statutory damages.

The central issue is whether Google's systematic, automated collection of user communications and device data constitutes criminal unauthorized access under the CFAA and unlawful interception under wiretapping statutes, or whether such activities are shielded by terms of service and privacy policy consent.

The case intensified public and legislative scrutiny over big tech's surveillance economy, prompting calls to modernize the CFAA and electronic privacy laws. It emboldened privacy advocates to pursue criminal-statute-based claims against major platforms, signaling that even industry giants may face direct accountability for everyday data extraction practices.