Richard Lloyd – Court Ruling (United Kingdom, 2021)

Court Ruling
DPA EWCA10 November 2021United Kingdom
final
Court Ruling

General GDPR enforcement action

This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.

A UK court ruled that Google illegally tracked Apple iPhone users without their consent by using cookies. This case is significant because it shows that companies can be held accountable for unauthorized data tracking practices. Businesses should ensure they obtain proper consent before using tracking technologies.

What happened

Google was found to have secretly tracked Apple iPhone users by placing cookies without their knowledge.

Who was affected

Apple iPhone users whose browsing data was tracked by Google.

What the authority found

The court determined that Google violated privacy laws by bypassing user consent for tracking through cookies.

Why this matters

This ruling serves as a warning to companies about the legal risks of unauthorized tracking. Businesses must prioritize user consent and transparency in their data collection practices.

National Law Articles

AI-identified

Section 4(4) DPA 1998
Section 13 DPA 1998
Decision AuthorityUK Supreme Court
Reviewed AuthorityEWCA (UK)
Source verified 10 April 2026
articles corrected
national law identified
authority corrected
Full Legal Summary
Detailed

Google secretly tracked Apple iPhone users between late 2011 and early 2012 and using their data collected in that way for commercial purposes. Google bypassed privacy settings on Apple iPhones and the default blocking of third party cookies on Safari with its “DoubleClick Ad” cookie by relying on an exception devised by Apple. Google placed this cookie without the user’s knowledge or consent. This cookie was enabled if users visited a website that included DoubleClick Ad content (advertising content). The cookie identified visits by a specific device on websites using this advertising content, including data and time of visit; time spent by the user on the website; what advertisement was viewed for how long; and using IP address, the user’s geographical location. As a result, Google could infer the user’s internet surfing habits, location, as well as interests, race or ethnicity, social class, political or religious beliefs, health, sexual interests, age, gender and financial situation. Google then used this aggregated information to give them labels (eg “football lovers”) and eventually offering these group labels to advertising organisations looking to target specific groups when using Google’s DoubleClick service. This allegation was brought in the US and Google settled a charge of $22.5 million with the US Federal Trade Commission and $17 million to settle consumer based actions in the US. Three individuals in the UK sued Google in 2013 for the same allegation and their claim was settled by Google (Vidal-Hall v Google Inc). Lloyd has filed a claim before the UK courts on behalf of everyone that resides in England and Wales and owned an Apple iPhone at the time of the secret tracking. Lloyd filed this class action with the intention of recovering damages for more than 4 million people affected. He claimed that compensation (£750 suggested) should be awarded under the Data Protection Act 1998 for loss of control of personal data without having to demonstrate

Outcome

Court Ruling

A ruling by a national court on a data-protection matter.

Violations (2)

Cookies Placed Before Consent
critical

Non-essential cookies (tracking, advertising) are placed on the user's device before obtaining valid consent.

Art. 6(1) GDPR

Third-Party Cookies Without Consent
critical

Third-party tracking cookies or scripts are loaded without obtaining prior user consent.

Art. 13, 14 GDPR

Related Cases (0)

No other cases found for Richard Lloyd in UK

This is the only recorded case for this entity in this jurisdiction.

Details

Ruling Date

10 November 2021

Authority

DPA EWCA

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
AI-verified and classified

Cite as: Cookie Fines. Richard Lloyd - United Kingdom (2021). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: