Potter Handy and the Rise of Mass Privacy Litigation: From Google Incognito to Data Breaches and Tracking Claims

Potter Handy occupies a very different place in the privacy plaintiffs’ bar than a lawyer such as Scott Kamber.

Kamber’s privacy career stretches back to the earliest generation of Internet class actions, when courts were first being asked to apply laws such as the Electronic Communications Privacy Act and Video Privacy Protection Act to online tracking. Potter Handy represents something closer to the next stage of the market: privacy claims pursued at mass scale, using large claimant pools, standardized allegations and litigation structures capable of handling tens of thousands of individual consumers.

That distinction matters because privacy litigation itself is changing.

What began largely as traditional class actions over tracking, data breaches and consumer deception is increasingly being supplemented by mass individual actions, arbitration campaigns and high-volume privacy claims that can be economically viable even when a class is never certified.

Potter Handy is one of the firms operating directly in that environment.

The San Francisco-based firm describes its practice broadly as consumer protection and class-action litigation, and its current public materials actively recruit claimants for privacy-related matters including Google Incognito tracking and data breaches. The firm’s lawyer roster also specifically identifies data privacy as an area of practice for some attorneys.

Its recent cases show why companies should pay attention.

Google Incognito became one of Potter Handy’s largest privacy campaigns

One of Potter Handy’s most visible privacy matters arose from allegations that Google continued tracking users while they were browsing in Chrome’s Incognito mode.

Google has long explained that Incognito primarily prevents browsing history, cookies and certain information from remaining on the local device after the session ends. Plaintiffs, however, alleged that users were led to believe Incognito offered broader protection from Google itself while Google continued receiving information through analytics and advertising technologies embedded across third-party websites.

The original federal class litigation resulted in a major settlement requiring changes to Google’s practices and deletion or remediation of large amounts of collected browsing data, but the court did not approve a monetary class fund for individual users.

That opened another path.

Individual plaintiffs could still pursue monetary damages.

And Potter Handy moved aggressively into that opportunity.

Reuters reported in July 2024 that Potter Handy said it represented approximately 70,000 clients pursuing privacy claims against Google related to Incognito browsing. Other firms, including Boies Schiller Flexner and Morgan & Morgan, were pursuing thousands of additional individual cases involving tens of thousands of consumers.

That number alone illustrates how different modern privacy litigation can look.

This was not one named plaintiff representing a proposed nationwide class.

It was potentially tens of thousands of individual claimants.

Potter Handy’s own website framed the allegations forcefully, accusing Google of presenting Incognito as private while continuing to track users and seeking compensation for California consumers. The firm states that it is no longer accepting new clients for that matter.

Whether every legal characterization on a plaintiffs’ recruitment page would ultimately survive litigation is a separate issue. Google has denied wrongdoing in the underlying privacy disputes.

But the strategic model is important.

If class certification becomes difficult, the claims do not necessarily disappear.

They can become individual cases.

Privacy litigation is increasingly moving from class actions to mass actions

That transition may be one of the most consequential developments in consumer privacy litigation.

Traditional class actions give plaintiffs enormous leverage because one plaintiff can potentially represent millions of consumers. But certification requirements under Rule 23 create substantial hurdles involving commonality, predominance, standing and damages.

If a court refuses to certify a class, plaintiffs’ counsel can face an obvious problem.

The legal theory may still exist, but pursuing one consumer’s relatively modest statutory damages is rarely economical using conventional litigation.

Mass litigation changes the equation.

Instead of:

One plaintiff
↓
One class action
↓
Millions of proposed class members

the model becomes:

Thousands of clients
↓
Thousands of individual claims
↓
Centralized legal and technical infrastructure

That can be much harder for defendants to dismiss economically.

A company may defeat class certification and still face tens of thousands of individual cases or arbitration demands.

Privacy statutes are particularly well suited to this model when they provide statutory damages.

The economics no longer necessarily depend on demonstrating that each individual suffered thousands of dollars in conventional financial loss.

The statute itself can provide the damages theory.

The Potter Handy Google complaints show how broad the legal theories can become

Complaints associated with Potter Handy’s Google litigation have asserted an unusually broad collection of causes of action.

Court records from California cases show allegations under the federal Wiretap Act, California Invasion of Privacy Act Sections 631 and 632, California’s Comprehensive Computer Data Access and Fraud Act, intrusion upon seclusion, breach of contract, unfair competition and other state-law theories.

That is significant because modern privacy litigation rarely depends on a single statute anymore.

A tracking event might generate allegations under:

• a federal wiretap statute;
• a state wiretap statute;
• computer-access law;
• consumer-protection law;
• common-law privacy;
• contract theories;
• specialized statutes such as the VPPA.

When one theory weakens, another may remain.

That is exactly what companies are seeing in website privacy litigation today.

California’s 2026 reform of CIPA’s pen-register provision may eliminate a substantial number of claims brought under that particular section, but it does not prevent plaintiffs from examining the same underlying data flow under Section 631, the federal Wiretap Act, the VPPA or another state’s privacy statute. Reuters reported that the California reform could wipe out thousands of pending web-tracking matters, while privacy lawyers have already begun focusing attention on alternative causes of action.

The technology does not have to change.

Only the legal theory does.

Potter Handy is also pursuing mass privacy claims against Temu

An even more striking example of Potter Handy’s mass-action strategy appears in litigation involving Temu operator Whaleco.

A federal docket in the Eastern District of New York is literally captioned:

In re Whaleco/Potter Handy Data Privacy Mass Actions.

The matter contains an extraordinarily large plaintiff list and reflects litigation originally filed in California before transfer. Court records also show discussion of allowing batches of claims to proceed through informal dispute resolution and then potentially into AAA arbitration.

That structure is worth studying.

It shows privacy litigation moving toward something that resembles mass-tort infrastructure.

Instead of filing one enormous class action and asking a judge to certify everyone, plaintiffs’ counsel can recruit and represent large numbers of individual consumers, then process claims in groups.

That changes the defendant’s exposure.

Even if each case is individually small, thousands of cases create substantial:

• filing costs;
• arbitration fees;
• discovery burdens;
• defense fees;
• settlement pressure;
• operational distraction.

The underlying claim can therefore become valuable because of volume rather than solely because of one spectacular damages award.

Mass arbitration has changed the leverage calculation

Arbitration clauses were originally adopted by many companies partly to reduce class-action exposure.

For years, businesses successfully argued that users who agreed to arbitration provisions could not pursue class claims in court.

Then plaintiffs’ lawyers adapted.

If a company requires every consumer to arbitrate individually, counsel can sometimes file thousands of individual arbitration demands.

Many arbitration agreements require the business to pay significant administrative fees.

The economic equation can reverse quickly.

Suppose a company faces:

20,000 arbitration demands
×
individual filing and administrative costs

before the merits are even decided.

Suddenly the arbitration provision designed to prevent class litigation becomes a source of settlement leverage.

The Whaleco litigation shows Potter Handy operating in exactly this environment, with federal court filings referencing large claimant groups and informal dispute resolution before potential AAA proceedings.

Privacy claims are particularly compatible with this strategy because the same technical conduct may affect thousands of users in nearly identical ways.

Potter Handy also maintains an active data-breach practice

Tracking litigation is only one part of the firm’s privacy work.

Potter Handy currently operates an extensive data-breach intake practice aimed primarily at California consumers. Its website lists active or potential matters involving healthcare organizations, medical providers and other businesses that experienced breaches involving personal or protected health information.

That side of the practice relies on a different factual model.

Tracking litigation often alleges that the business itself intentionally deployed technology that disclosed information.

Data-breach litigation generally alleges that the organization failed to protect information from unauthorized access.

But the legal theme is similar:

A company possessed personal data, something happened to that data that allegedly should not have happened, and consumers are seeking monetary relief.

Healthcare breaches can be particularly attractive because the affected information may include Social Security numbers, diagnoses, insurance data, medical histories or other information that cannot easily be replaced.

Potter Handy specifically references California medical privacy laws and recruits individuals affected by breaches involving health data.

Their website itself illustrates how sensitive tracking issues have become

There is an interesting detail on Potter Handy’s own privacy policy.

The firm discloses that it uses third-party CAPTCHA services for spam and abuse prevention and states that those services may process information including IP addresses, browser information, mouse movements, keystrokes and time spent on the site.

That disclosure is notable given the modern wiretapping litigation environment.

Keystroke and mouse-movement collection are precisely the kinds of technical activities that have appeared in session-replay and tracking cases.

The legal issue is not whether CAPTCHA technology is inherently unlawful. It plainly is not.

The issue is disclosure, purpose, consent where required, and what the third party actually receives.

Potter Handy’s own policy demonstrates how routine web functionality can implicate exactly the kinds of data-flow questions plaintiffs’ firms now litigate.

Potter Handy comes from a broader high-volume litigation background

Any serious profile of Potter Handy should also acknowledge that its high-volume litigation model did not begin with privacy.

The firm became well known for filing large numbers of disability-access lawsuits under the Americans with Disabilities Act and California law.

In 2022, the district attorneys for San Francisco and Los Angeles sued Potter Handy and several of its attorneys, alleging that some ADA complaints contained false standing allegations and formed part of a strategy to extract settlements from small businesses.

Potter Handy denied wrongdoing and successfully challenged the case based on California’s litigation privilege. The California Court of Appeal affirmed dismissal in December 2023. Importantly, the appellate ruling did not adjudicate whether the underlying factual allegations made by prosecutors were true; it held that the government’s unfair-competition claim was barred by the litigation privilege and that other enforcement mechanisms remained available.

That history is relevant not because ADA litigation and privacy litigation are legally identical.

They are not.

It is relevant because Potter Handy has longstanding experience operating legal practices involving large numbers of consumers, repeatable statutory claims and defendants facing significant settlement economics.

Those same organizational capabilities translate naturally into privacy litigation.

Privacy statutes provide the kind of economics mass litigation requires

Privacy law can be unusually attractive to plaintiffs’ firms because many statutes contain fixed damages.

CIPA historically allowed statutory damages of $5,000 per violation for qualifying claims.

The VPPA allows statutory damages of $2,500.

The federal Wiretap Act can provide statutory damages under qualifying circumstances.

Biometric statutes such as Illinois BIPA have historically created substantial per-violation exposure as well.

The practical effect is that plaintiffs do not always need to prove traditional financial damages.

A person does not necessarily need to show:

The tracking pixel cost me $8,000.

Instead, the argument may be:

The statute establishes a protected privacy right, the defendant violated it, and the legislature established statutory damages.

That makes standardized technical conduct economically litigable.

The website itself becomes the evidence source

Another reason this area scales so efficiently is that plaintiffs can investigate many claims without access to the defendant’s internal systems.

A lawyer or investigator can open the browser’s network tools and inspect:

Meta requests
Google requests
Microsoft requests
session replay endpoints
chat vendors
advertising IDs
URLs
query strings
form events
device identifiers

In some cases, those requests can be captured, reproduced and attached directly to a complaint.

That dramatically reduces the investigation cost.

The plaintiff does not need discovery merely to establish that the technology existed.

That evidence may already be available publicly from the website.

This is why consent has become such a central issue

Many contemporary privacy cases ultimately turn on timing.

Did the user consent before the alleged transmission?

A website can have an extensive privacy notice and still encounter trouble if tracking begins before the visitor has an opportunity to make a choice.

The litigation increasingly focuses on questions such as:

Did the pixel fire at page load?

Did the session-replay tool initialize before consent?

Did Reject All actually stop the vendor?

Was consent sufficiently conspicuous?

Was the user merely given a footer privacy-policy link?

Reuters’ 2026 analysis of pixel litigation described exactly this problem, noting cases in which plaintiffs challenged tracking that occurred before meaningful consent and courts scrutinized whether passive browsewrap disclosures were sufficient.

Those are technical questions as much as legal ones.

Companies should understand Potter Handy as part of a larger structural change

The temptation is to look at firms like Potter Handy as an isolated plaintiffs’ firm pursuing aggressive claims.

That misses the larger trend.

The cost of identifying privacy issues is collapsing.

Consumer recruitment is digital.

Evidence is reproducible.

Claims can be standardized.

Arbitration can be mass-filed.

Plaintiff groups can contain tens of thousands of people.

Litigation management software can handle workloads that once would have required enormous legal teams.

Privacy statutes frequently provide statutory damages.

Taken together, those conditions create a litigation market capable of operating at a scale that would have been difficult even ten years ago.

Potter Handy is one of the clearest examples.

The next phase may be mobile, CTV and AI

The same litigation model is unlikely to remain confined to browser privacy.

Mobile SDKs can be tested.

Connected TV applications can be monitored.

AI systems can expose or process personal information.

AI agents can connect to enterprise systems.

Consumer devices increasingly transmit information to multiple third parties.

The core technical question stays the same:

What data left, where did it go, and was that transmission legally permitted?

Once that behavior can be measured reliably, the same mass-litigation infrastructure can potentially be applied.

The plaintiffs’ privacy bar does not need entirely new legal machinery.

It needs new factual patterns to feed into machinery that already exists.

Potter Handy illustrates how privacy litigation is becoming industrialized

Scott Kamber’s career helps explain the intellectual history of Internet privacy litigation.

Potter Handy helps explain its industrialization.

The firm’s Google Incognito campaign demonstrates that the failure of a class mechanism does not necessarily end a privacy claim. Tens of thousands of people can instead pursue individualized relief.

The Whaleco matter demonstrates how mass privacy actions can be organized around large claimant populations and arbitration processes.

Its data-breach practice shows the same intake infrastructure applied to cybersecurity incidents involving personal and medical information.

The important development is not simply that Potter Handy files privacy cases.

It is the scale at which modern plaintiffs’ firms can now identify claimants, organize evidence and pursue statutory privacy rights.

For businesses, that changes the risk calculation.

A company should no longer ask only:

Could someone file a class action over this?

The better question is:

If this technology affects 50,000 users, could 50,000 individual claims be generated from the same conduct?

Increasingly, the answer may be yes.

That is why privacy compliance cannot be designed solely around avoiding one headline class action.

Companies need to understand the underlying behavior before it becomes reproducible evidence.

Because once a data flow can be tested, documented and repeated across thousands of consumers, plaintiffs’ firms such as Potter Handy have shown that the legal claim itself can scale with it.