Loading story…
Google agreed to a preliminary $135 million class action settlement in Taylor v. Google LLC over allegations that Android devices transmitted cellular data to Google without users’ consent, including while phones were idle and apps were closed. The proposed settlement covers roughly 100 million U.S. Android users who used an Android device with a cellular data plan from Nov. 12, 2017 until final approval, though Google denied wrongdoing and said it settled to avoid further litigation.
Eligible users can file claims for payments that may reach up to $100, with final amounts depending on participation levels and deductions for fees and costs. As part of the agreement, Google will revise Google Play terms to better disclose passive data transfers, obtain user consent during device setup, and stop collecting data entirely when the "allow background data usage" setting is turned off. A final approval hearing is scheduled for June 23, and payments would be issued only after court approval and any appeals are resolved.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
The court set a final approval hearing for June 23, 2026, to determine whether the Android data harvesting settlement will be approved.
As part of the settlement terms, Google agreed to revise Google Play terms to clarify passive data transfers, obtain user consent during device setup, and stop collecting data when the 'allow background data usage' setting is turned off.
By April 8, 2026, the settlement website was live, allowing eligible U.S. Android users to check eligibility and submit claims for compensation from the settlement fund.
In the class action Taylor et al. v. Google LLC, Google agreed to a preliminary $135 million settlement while denying wrongdoing over allegations that Android devices sent data to Google even when idle or with apps closed.
The settlement covers U.S. Android users who used an Android device with a cellular data plan beginning on November 12, 2017, the start of the class period tied to allegations that Android transmitted cellular data to Google without consent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcecnet.com
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A court has ordered Google to pay $425 million in a class action lawsuit for misleading users about its 'Web & App Activity' privacy setting. Despite users disabling data collection, Google continued to gather app usage data via Firebase, affecting 98 million users. Google plans to appeal the decision, maintaining that its privacy tools are transparent and effective.
Jun 29, 2026
Comcast agreed to pay **$117.5M** to settle a class action tied to a large-scale breach disclosed in late 2023 that potentially affected **31M+** people. Comcast attributed the intrusion to **CitrixBleed** (Citrix NetScaler ADC/Gateway), a vulnerability that can enable **session hijacking** and credential theft; researchers warned stolen session tokens could remain valid even after patching, extending attacker access. The proposed settlement (preliminarily approved) provides reimbursement for documented losses (up to **$10,000** per person) and compensation for time spent responding, while Comcast denies wrongdoing. Separately, Google agreed to pay **$135M** to settle Android users’ claims that devices transmitted data to Google servers over **cellular networks** in the background without meaningful consent, with individual payouts capped (reported up to **$100**) and additional **injunctive relief** requiring clearer disclosures and express consent during setup. Two dermatology practices also reached settlements over cybersecurity incidents exposing patient data; one New Jersey practice reported unauthorized network access spanning **Dec 2023–Mar 2024** and exposure of **PHI/PII** (including SSNs and treatment/insurance data) affecting **373,630** individuals, offering cash benefits plus credit monitoring/identity protection while denying liability.
Jun 29, 2026
A new class-action lawsuit filed in the U.S. District Court for the Northern District of California alleges **Meta** misled WhatsApp users by marketing “unbreakable” end-to-end encryption while allegedly retaining and analyzing message content and enabling employee access via internal tools. The complaint—brought by plaintiffs from multiple countries and seeking global class certification—cites unnamed whistleblowers but reportedly provides no technical proof (e.g., logs or code) to substantiate claims that Meta can decrypt or read message contents; Meta spokesperson Andy Stone denied the allegations as “categorically false,” reiterating WhatsApp’s use of the **Signal Protocol** for end-to-end encryption. Separately, **Google** agreed to pay **$68 million** to settle a class-action lawsuit alleging **Google Assistant** unlawfully recorded users’ private conversations when inadvertently triggered (e.g., via “Hey Google” misfires) and shared recordings with third parties for advertising-related purposes. The preliminary settlement, also filed in Northern California federal court, still requires judicial approval and applies to purchasers of Google devices dating back to May 2016; Google reportedly settled without admitting wrongdoing. Together, the cases underscore ongoing legal and regulatory exposure tied to consumer privacy representations, data handling, and the gap between product claims and alleged internal access/collection practices.
Jun 29, 2026