Open your browser. Browse. Click. Most of us assume that if we avoid logging in or turning on special features, our activity stays private. But a federal court in California shattered that assumption last month.
The case, which was brought on behalf of Chrome users, alleged that Google continued to collect personal data even when users specifically chose not to sync their Chrome browsers with a Google account, a step many reasonably believed would keep their digital footprints out of the company’s hands.
The court didn’t question whether data collection had occurred. Instead, it focused on whether users had truly consented. District Judge Yvonne Gonzalez Rogers concluded that, because users encountered different privacy terms or understood them differently, they couldn’t sue together as a group.
Legally, that outcome fits with the established rule that class actions require a shared legal or factual thread. But when it comes to digital privacy, that tidy legal logic creates a troubling imbalance. The rule requiring everyone’s privacy perceptions to line up acts as a clever maneuver that turns the messiness of how people encounter privacy policies into a shield against accountability.
The entire online privacy regime hinges on the legal fiction that when we click “I agree,” we’ve meaningfully understood and accepted what comes next. But users encounter these policies distractedly, rarely read them and often can’t make sense of them even if they try.
That disconnect is no accident. Privacy consent was never meant to truly inform users. It was designed to operationalize data collection and optimize for convenience, speed and scale.
The irony emerges when users try to push back. At that point, the same system that treats a mindless click as meaningful legal consent suddenly demands forensic-level detail about what each person saw, understood and agreed to.
In the Google case, the court that readily accepted the fiction of digital consent became deeply concerned with the reality of digital experiences. The very users who had been perfectly uniform when clicking “I agree” were now too different to challenge that agreement together.
This is privacy law’s great bait-and-switch: We’re all in it together when accepting surveillance, but on our own when seeking accountability.
This leaves users in an impossible bind. When class action lawsuits fail because consent transforms back into an individualized contextual act, users can only go it alone. But that’s a dead end. Individual privacy lawsuits almost never happen. The injuries they try to address are diffuse and abstract, ranging from hyper-targeted ads that feel invasive and algorithmic decisions that quietly discriminate to the unsettling sense that our lives are being watched too closely.
These are harms that matter, but they’re hard to convert into legal claims and harder still to translate into dollars.
Class actions exist to bridge this gap. They take the scattered, often invisible harms of modern digital surveillance and turn them into something legible to courts. Class actions make it economically viable for lawyers to represent people without power, and they are just threatening enough to make companies think twice before crossing the line.
This enforcement crisis reflects a deeper choice we face about how power operates in the digital age. We can continue pretending that privacy is protected by an elaborate theater of click-through agreements that nobody reads, privacy policies that nobody understands and legal fictions that fail to serve the people they claim to protect. Or we can build a privacy framework that takes context seriously, one that recognizes the structural imbalances between users and platforms, the impossibility of meaningful consent in an attention economy and the need for collective mechanisms to challenge abuses.
The Google case will likely be remembered not for what it decided, but for the asymmetry it revealed in the way our legal system treats consent. Fixing that asymmetry doesn’t mean extending the consent fiction further. It means moving past it entirely. Privacy protections should not hinge on whether someone clicked a box, but should reflect the realities of power, context and social expectations.
If we won’t commit to a framework that takes those realities seriously, then at the very least we should stop using context selectively to shield companies from accountability while leaving users exposed to harmful data practices.
Yafit Lev-Aretz is an associate professor of law at Baruch College, City University of New York.