However, U.S. District Court Judge Yvonne Gonzalez Rogers in the Northern District of California was far from glowing in her assessment. In her March 26–27, 2026 ruling, she described the settlement as “adequate, but by no means excellent,” expressing skepticism about its real-world impact because the new “RTB Control” requires users to actively seek it out and turn it on.
What the Settlement Actually Requires
The case, *In re Google RTB Consumer Privacy Litigation*, dates back to March 2021. Plaintiffs, including Kimberley Woodruff and other Google account holders, accused the company of violating its own privacy promises by sharing detailed personal information with thousands of advertisers and data intermediaries through its RTB system.
In RTB auctions, when a user loads a webpage or app, their data — including identifiers, location signals, browsing history proxies, and more — is broadcast in a split-second auction so advertisers can bid on showing them a targeted ad. Critics have long argued this “bidstream” creates a massive, opaque surveillance network where sensitive data reaches hundreds or thousands of parties with minimal oversight.
Under the approved settlement, Google must create and maintain a new privacy setting called the **RTB Control**. When a user enables it:
- All key identifiers are stripped from the bid request, including encrypted Google User IDs and device advertising IDs (such as MAIDs).
- IP addresses are removed or obscured.
- Cookie matching — a technique used to link external data profiles to Google’s auction signals — is blocked.
The control applies at the account level, works whether the user is signed in or out, and covers activity across devices for a period of at least three years. Google must also notify eligible U.S. users (potentially over 169–200 million Google account holders) about the new option via email and other outreach.
Plaintiffs’ counsel had touted the mechanism as one that would “fundamentally alter Google’s business practices” by making it far harder for auction participants to identify or track users who activate the control.
The Judge’s Skepticism: Opt-In Realities vs. Marketing Hype
Judge Gonzalez Rogers pushed back on that optimistic framing. She noted that media coverage, including an AdExchanger analysis, has repeatedly pointed out a well-known industry truth: opt-in (or “affirmative activation”) controls rarely achieve high adoption rates. Most users never change default settings, and history shows that privacy tools requiring extra effort often go largely unused.
She wrote that while the settlement provides some measure of choice, accountability, and transparency, it falls short of the transformative change plaintiffs’ lawyers claimed. The court had previously denied class certification for monetary damages (requiring individualized proof of harm) but had signaled support for injunctive relief that gives users more meaningful control.
Connecticut Attorney General William Tong supported the deal, highlighting that it offers a single, consolidated account-level option — a step up from managing multiple scattered privacy toggles. Still, the judge’s tempered language suggests she views it as a modest improvement rather than a sweeping reform.
Why RTB Privacy Matters — And Why Change Has Been So Hard
Real-time bidding powers the majority of programmatic advertising. Google dominates this space, but the system has drawn fire from privacy advocates, regulators, and even some lawmakers for enabling widespread, often non-transparent sharing of personal data with data brokers, advertisers, and intermediaries.
The Federal Trade Commission has separately scrutinized RTB practices, including a notable action against data broker Mobilewalla for improperly retaining and using sensitive location data harvested from bidstreams. These auctions can broadcast precise location, device details, and behavioral signals that, when combined, create highly invasive user profiles.
Google maintains it already has some of the industry’s strictest RTB restrictions. A company spokesperson said it was “pleased to put this case behind us” and emphasized its existing safeguards.
Privacy experts, including those at the Electronic Frontier Foundation (EFF), have welcomed the new control as a step forward but stress that true reform likely requires stronger legislation or defaults that protect users without requiring them to hunt for settings.
Broader Context: Google’s Ongoing Privacy Battles
This settlement arrives amid other high-profile Google privacy disputes. The company recently faced a $425 million jury verdict in a separate case involving allegations it ignored user opt-outs for location tracking. While that verdict is under appeal or further challenge, it underscores growing judicial and regulatory scrutiny of Google’s data practices across search, Android, and advertising.
Class counsel’s attorneys’ fees request was significantly reduced from an initial $128 million ask down to approximately $21.8 million, with the court citing “speculative” valuation estimates and billing inefficiencies.
What Users Should Do — And What Comes Next
For ordinary Google users, the practical takeaway is simple but important: watch for an email or in-account notification about the new RTB Control in the coming weeks and months. Enabling it could reduce the amount of identifiable data leaked into the ad ecosystem, making it harder for advertisers and data brokers to build persistent profiles.
However, because it is opt-in rather than a default-on protection, its overall effect on Google’s vast advertising machine may prove limited unless adoption rates exceed historical norms for privacy tools.
The ruling brings to a close a five-year legal battle but highlights a persistent tension in digital privacy: incremental settlements and self-regulated controls often struggle to deliver systemic change when user inertia is high and business incentives favor maximum data flow.
As programmatic advertising continues to evolve — and as AI-driven targeting becomes even more sophisticated — pressure is likely to grow for stronger defaults, clearer consent mechanisms, and greater transparency around exactly who receives bidstream data and how they use it.
This settlement offers Google users a new tool, but its success will ultimately depend on whether people actually discover and use it — and whether future regulatory or legislative efforts go further in reining in the opaque world of real-time bidding.
