Google loses appeal court bid to prevent UK Safari users from suing over circumvention of privacy settings
Context & Ripple Effects
This 2015 ruling is the procedural opening move of a six-year arc: by refusing to block the claim at the threshold, the Court of Appeal lets UK Safari users pursue Google for allegedly bypassing their browser privacy settings. That door stayed open long enough for a group action claiming to represent 5.4M UK iPhone users to file in late 2017, alleging an algorithm tricked Safari into releasing personal data from 2011-2012.
The endgame is already in the record: in November 2021 the UK Supreme Court dismissed the $4B damages claim, meaning today's ruling matters less for its own outcome than for what it licensed — years of discovery and argument over consent-based tracking before the damages theory failed.
First-order effects
- Google must now defend the Safari circumvention allegations on their merits rather than killing the suit procedurally, exposing its 2011-2012 iOS ad-tracking practices to UK court scrutiny.
- UK iPhone users gain standing to sue collectively, shifting the dispute from individual complaints to a single representative action against one defendant.
Second-order effects
- A viable route past the procedural gate invites copycat representative claims against other platforms whose trackers sidestepped browser settings, making cookie-consent litigation a recurring cost line rather than a one-off risk.
- Google's defence strategy hardens around attacking the quantum and structure of damages — a playbook visible in the eventual Supreme Court dismissal of the $4B figure while the underlying conduct remained litigated for six years.
Third-order effects
- The arc from this ruling to the 2021 dismissal sketches how UK group litigation over data practices actually resolves: courts will hear consent cases, but control-of-data theories struggle where no material damage is shown — pushing future claimants toward regulatory complaints and GDPR-era statutory damages instead.
- Browser-level privacy settings become de facto legal boundaries: any mechanism that circumvents them carries litigation exposure across jurisdictions, raising the engineering bar for how ad networks interact with third-party browsers.
The trend: Browser privacy settings are hardening into legally enforceable access controls, with UK collective actions testing — and so far limiting — the damages available when ad trackers bypass them.