Re: Wrong penalty
The State Attorney Generals have a point - distribution of judgements where the affected users get nothing and the lawyers get everything are a bane to our legal system, and the way they tried to hide it in this case is almost criminal. This isn't about Google per se, this is the states going after the lawyers (both sides) and using Google's deep pockets to make a political and societal point.
However, In order for the penalty to be higher you are going to have to substantiate losses. You are going to have to uniquely identify 129 Million people and get them to certify the losses directly caused by the privacy violation, and give them the option to "opt out" of the case.
You aren't going to be able to do that. You are going to be hard pressed to find even a single person who can identify financial damages. This case was never about the "users". This case was never about getting Google to stop doing something - as they had stopped long before the case was filed. This case was always about lawyers on a money grab.
At the core, Google's privacy violation was apparently including the search terms used as part of the URL from their search results page. In other words, it was doing exactly what all search engines were doing, from Alta Vista on down. It was a STANDARD. Nobody thought it was bad - referrer information was one of the building blocks upon which the web was built. back when the web was a much safer and simpler (and naive) place. Users weren't being identified, this wasn't about unmasking or tracking identities, this was just about intentionally leaking search terms.
Around 2010 Google realized that this information could be used for nefarious purposes by proxies and other things (read: governmental sniffing) and started transitioning away, doing so slowly as not to bread everybody's site that depended on the information shared remaining the way it was. Their biggest mistake was saying that it was because of privacy concerns, because that statement was then used against them later on even though it was taken out of context. For once Google was actually being a GOOD corporate citizen (mark it on the calendar, it doesn't happen often) and it still came back to bite them.
For Google this was a nuisance lawsuit. They wanted to pay it off to make it go away because it was cheaper than fighting it. Just the cost of discovery would probably have been more, and nobody else was going to pay Google's costs should they win. It was a simple economic decision. Now, even that decision is biting them.
Not that I mind - Google has a lot of legitimate privacy violations to which they have never been held to account, and if this case is used as a proxy to address them so be it. In hindsight, perhaps it would have been better for google to left the search terms in the query. By taking them out they started an arms race with tracking cookies that resulted in far worse violations of user privacy.