The fines just keep mounting for Google. In the wake of last year’s Safarigate, in which Google was revealed to be tracking millions of iOS & Mac Safari users against their knowledge, Google first agreed to pay a $22.5 million fine to the FTC, the largest such fine in history. But it’s not stopping there, with Google now agreeing to pay $17 million to settle the issue with 37 states.
Early last year, the Wall Street Journal broke a stor, showing how Google had been exploiting a loophole in the way Safari blocked cookies to bypass the privacy settings of millions of iPhone, iPad and Mac owners.
Here’s how it worked. In Safari on the Mac or iPhone, there is an option to always block cookies from third parties and advertisers, but Apple makes an exception on pages where a user has interacted with it in some way: by, say, filling out a form.What Google did was make sure that any time someone did a Google search or accessed one of their pages, Safari would automatically send an invisible form to Google, which would then allow them to install a tracking cookie on any iOS device or Mac even against that user’s explicit privacy settings. And once that initial cookie got installed, things snowballed, because a glitch in Safari then allowed an unlimited number of subsequent cookies to be added.
It was shady, and not only did the FTC get angry, but the vast majority of U.S. states pursued their own case against Google. Those states were Alabama, Arizona, Arkansas, California, Connecticut, District of Columbia, Florida, Illinois, Indiana, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Nebraska, Nevada, New Jersey, New Mexico, North Carolina, North Dakota, Oklahoma, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Vermont, Virginia, Washington and Wisconsin.
Google is now paying $17 million to settle the issue. Google says they are pleased to put the issue behind them. “We work hard to get privacy right at Google and have taken steps to remove the ad cookies, which collected no personal information, from Apple’s browsers,” a spokeswoman said by email.
Of course they’re pleased. They got away with paying less than $500,000 in damages on a state-by-state basis in the end, and as John Gruber points out, Google will earn that revenue back in less than two hours.