Lloyd v Google: UK tracking claims need proof of harm

Safari blocked third-party cookies by default. The claim alleged that Google found a way round that block and placed its DoubleClick Ad cookie on iPhones anyway, then used the browsing data for advertising. Lloyd wanted one uniform payment for every affected user. The Supreme Court held that UK law did not allow that.

These are allegations, as summarised in the Supreme Court judgment. No court decided whether they were true.

• Between 9 August 2011 and 15 February 2012, Google used the "Safari workaround" to place the DoubleClick Ad cookie on Apple devices without the user’s knowledge or consent (paras 9 to 12).
• The cookie let Google see which sites a user visited, when and for how long, which adverts they saw and, through the IP address, roughly where they were (para 11).
• Google used the data to sort users into advertising groups such as "football lovers" and offered those groups to advertisers (para 14).
• Lloyd argued that each user could recover a uniform sum for "loss of control" of their data, with no need to prove financial loss or distress. A letter of claim suggested £750 each, which the court said would total about £3 billion (para 5).

The judgment explains that Apple built exceptions into Safari’s third-party cookie block so that some popular web functions still worked. Those exceptions were in place until March 2012, and the alleged workaround used them (para 12).

Inth’s technical interpretation: a browser privacy setting is a signal of what the user wants. Code that works around it, rather than respecting it, is the pattern to look for, whatever the legal route in a given country.

1. 9 August 2011 to 15 February 2012Period of the alleged tracking
2. August 2012Google agrees to pay a US$22.5m civil penalty to settle US FTC charges based on the same allegation (para 2)
3. 2018High Court refuses permission to serve the claim, [2018] EWHC 2599 (QB)
4. 2019Court of Appeal reverses that decision, [2019] EWCA Civ 1599
5. 10 November 2021Supreme Court allows Google’s appeal and restores the High Court order

The court allowed Google’s appeal and restored the order "refusing the claimant’s application for permission to serve the proceedings on Google outside the jurisdiction" (para 160). Under the Data Protection Act 1998, compensation needs proof of damage or distress for each person, which a representative claim for a uniform sum could not provide. The case ended there.

No damages in the UK. The judgment records that Google had earlier agreed to pay US$22.5m to the FTC and US$17m to settle US consumer actions over the same allegation (para 2).

This is why mass tracking claims are rare in the UK compared with the US. It does not mean tracking is lawful: the conduct was never tried, the case was under the 1998 Act, and regulators can still act. German courts have gone the other way and award damages for loss of control under the GDPR; see Meta Business Tools in Germany.

• Website audit records what loaded before a choice and after Reject, with the page, time, region and consent state.
• Code audit flags a pull request that adds an advertising tag, ad-cookie write or storage write outside the consent check.
• Consent banner: under the EU opt-in policy, optional tags wait until the visitor chooses.

This page does not claim that Inth detects browser-specific workarounds. Test each browser’s default privacy settings separately.

In the repository

• Search for code that detects a browser and changes how cookies or storage are written.

In the browser and network

• Test in Safari and Firefox with default privacy settings and list any third-party identifiers that still appear.

With the people responsible

• Ask vendors whether their tags use any method to set identifiers that the browser would otherwise block.

• UK Supreme Court case page
• [Judgment, [2021] UKSC 50 (PDF)](https://supremecourt.uk/uploads/uksc_2019_0213_judgment_995458ff66.pdf)

Source review: 20 October 2026. This page describes the cited records and procedural stage. It does not audit Google’s current systems. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.

Related: Meta Business Tools in Germany, Google Fonts in Munich, GDPR and ePrivacy cookie rules