Texas Sets New Standard: $1.375 Billion Google Settlement Signals Dawn of Aggressive State Privacy Enforcement

Compliance Hub

Compliance Hub

— 10 min read
Texas Sets New Standard: $1.375 Billion Google Settlement Signals Dawn of Aggressive State Privacy Enforcement
Photo by Serenity Mitchell / Unsplash

Texas Attorney General Ken Paxton has officially finalized a record-breaking $1.375 billion settlement with Google, marking the conclusion of two of the most significant data privacy enforcement actions ever brought by a single state against a technology giant. This historic agreement, formally signed on October 31, 2025, represents the largest single-state settlement against Google for privacy violations and sends shockwaves through the tech industry.

The Numbers Tell the Story

To understand the magnitude of this settlement, consider the following comparisons:

  • $1.375 billion - Texas's recovery from Google
  • $391 million - Amount secured by a 40-state coalition for similar violations
  • $93 million - The previous largest single-state settlement (California)

Texas secured more than 14 times what California achieved and nearly $1 billion more than what 40 states combined were able to recover. This isn't just a win for Texas—it's a fundamental shift in how states are approaching Big Tech accountability.

Three Years of Litigation: What Google Did Wrong

The settlement resolves multiple lawsuits filed by Attorney General Paxton in 2022, alleging systematic violations of Texas privacy laws. The complaints centered on three core areas of misconduct:

1. Geolocation Tracking Despite Opt-Outs

Google allegedly continued to track users' precise locations even after they disabled location services. The deception was particularly insidious: while users turned off "Location History," Google continued collecting location data through other mechanisms, including:

  • Web & App Activity settings
  • Search activity
  • Maps usage
  • Other Google services integrated into Android OS

Users were led to believe they had control over their location privacy, but Google maintained surveillance through backdoor collection methods that weren't clearly disclosed.

2. The Incognito Mode Illusion

Chrome's "Incognito Mode" promised private browsing, but Google allegedly continued tracking user activity during these supposedly private sessions. The term "incognito" itself created a false sense of security, implying anonymity that Google's own data collection practices undermined. Users who believed their searches and browsing remained private were unknowingly feeding data into Google's massive advertising ecosystem.

3. Unauthorized Biometric Data Collection

Perhaps most troubling were the allegations around biometric data collection through Google Photos, Google Assistant, and Nest Hub Max devices. According to the lawsuit, Google:

  • Collected facial geometry data from anyone appearing in photos uploaded to Google Photos—including individuals in backgrounds who had no idea their image was being processed
  • Captured voiceprints through Google Assistant interactions
  • Used Face Match technology in Nest Hub Max to identify individuals, including children who approached the devices out of curiosity
  • Stored these biometric identifiers indefinitely without obtaining informed consent

This violated the Texas Capture or Use of Biometric Identifier Act (CUBI), which requires companies to inform individuals and obtain consent before collecting biometric data and mandates destruction of such data within a reasonable timeframe.

Texas leveraged multiple state statutes to build its case against Google:

Texas Deceptive Trade Practices Act (DTPA) - The primary weapon for the geolocation and incognito mode claims, allowing the state to seek penalties for misleading and deceptive business practices.

Texas Capture or Use of Biometric Identifier Act (CUBI) - Specifically targeted Google's biometric data collection, with potential penalties of $25,000 per violation—a sum that could reach astronomical levels given the millions of Texans affected.

Texas Data Privacy and Security Act (TDPSA) - While newer, this law strengthens Texas's overall privacy enforcement framework and signals the state's commitment to comprehensive data protection.

What the Settlement Includes (And Doesn't)

The $1.375 billion figure dominates headlines, but the settlement's structure reveals important details:

What Texas Secured:

  • $1.375 billion in monetary penalties
  • A clear message that Texas will pursue Big Tech violations aggressively
  • Precedent for future single-state enforcement actions

What Google Avoided:

  • No admission of wrongdoing or liability
  • No court-mandated changes to products or business practices
  • No requirement to modify consumer disclosures

Google maintains that the settlement resolves "old claims" related to policies the company has already changed. The tech giant emphasized that the agreement doesn't require new product modifications, suggesting Google had already implemented privacy updates in response to previous litigation pressure.

However, the absence of forced operational changes doesn't diminish the settlement's impact. The sheer financial penalty demonstrates that past violations carry substantial consequences, even after companies claim to have reformed their practices.

The Norton Rose Fulbright Factor

Behind this massive recovery stands Norton Rose Fulbright, the private law firm hired by Texas on a contingency basis to represent the state. The firm operated under contracts specifying payment through either:

  • Billable hours multiplied by four, OR
  • A percentage of the settlement (10-27%), whichever is lower

Based on the $1.375 billion recovery, Norton Rose Fulbright's share likely ranges from $137 million to $371 million—a substantial payday that reflects both the case's complexity and the risk the firm assumed in taking it on contingency.

This arrangement demonstrates how states can leverage private sector expertise to take on well-resourced tech giants, even when state AG budgets are limited. It's a model other states may increasingly adopt.

Part of a Pattern: Texas's Big Tech Crusade

The Google settlement isn't an isolated victory. Attorney General Paxton has built an impressive track record of Big Tech enforcement:

July 2024 - Meta Settlement: $1.4 billion for unlawfully collecting and using facial recognition data through Facebook's Tag Suggestions feature

Previous Google Settlements:

  • $700 million for anticompetitive trade practices
  • $8 million for deceptive advertising

Total Recovered from Google and Meta: $2.883 billion

Paxton has positioned Texas as having "the largest data privacy and security initiative of any state," and the numbers back up that claim. No other state attorney general has come close to these recovery amounts.

Beyond settlements, Texas has also pursued aggressive enforcement actions against other tech companies, including filing suit against TikTok for sharing minors' personal data in violation of Texas parental rights laws.

Critical Takeaways for Organizations

This settlement carries profound implications for any organization collecting consumer data, particularly companies operating in Texas or other states with robust privacy laws:

1. Individual States Will Go It Alone

Texas deliberately opted out of the 40-state coalition settlement to pursue its own case—and recovered 3.5 times more than the entire coalition. This signals that individual states, particularly large ones like Texas, California, and New York, may increasingly bypass multistate actions in favor of solo enforcement.

Compliance Implication: Organizations can no longer treat multistate settlements as comprehensive resolution of privacy issues. Individual state AG investigations may follow, requiring separate negotiations and additional penalties.

2. Biometric Data Is High-Risk Territory

With two billion-dollar settlements in two years—both focused on biometric data—Texas has made it crystal clear that unauthorized collection of facial geometry, voiceprints, and other biometric identifiers will result in massive penalties.

Compliance Implication:

  • Implement clear, advance opt-in consent mechanisms before collecting any biometric data
  • Ensure consent language is specific about what biometric data is collected and how it will be used
  • Establish documented retention and destruction policies
  • Pay special attention to Illinois, Texas, Washington, and other states with dedicated biometric privacy laws

3. "We Changed Our Policies" Is Not a Defense

Google's argument that it had already updated the relevant policies didn't prevent Texas from pursuing—and winning—claims based on past conduct. Historical violations remain actionable even after a company reforms its practices.

Compliance Implication: Organizations cannot assume that current compliance shields them from liability for past misconduct. Conduct comprehensive privacy audits to identify potential historical violations and consider proactive disclosure or remediation.

4. Location Tracking Requires Crystal Clear Disclosure

The geolocation allegations highlight the danger of ambiguous privacy controls. If users disable a feature called "Location History," they reasonably expect all location tracking to stop—not just one specific data stream.

Compliance Implication:

  • Review all location tracking disclosures for clarity and accuracy
  • Ensure opt-out mechanisms truly disable all forms of location data collection
  • Avoid technical distinctions that confuse users about what they're consenting to
  • Test privacy controls to confirm they function as described

For users concerned about location tracking, see our guide on How to Disable Tracking on Your Smartphone.

5. Marketing Terms Must Reflect Reality

The "Incognito Mode" allegations demonstrate the risk of using suggestive language that oversells privacy protections. When you use terms like "private," "incognito," or "secure," users form expectations about what those features deliver.

Compliance Implication:

  • Audit marketing materials, product names, and interface language for privacy promises
  • Ensure technical reality matches user expectations created by product descriptions
  • Provide clear, conspicuous disclosures about what data collection continues even in "private" modes

6. State Enforcement Will Accelerate

With federal privacy legislation stalled and uncertainty around federal enforcement priorities in the second Trump administration, state attorneys general are filling the void with aggressive action. Texas's success will likely inspire other states to pursue similarly ambitious enforcement actions.

Compliance Implication:

  • Establish state-specific compliance programs, particularly for states with comprehensive privacy laws
  • Monitor state AG priorities and enforcement patterns
  • Budget for potential multi-state settlement scenarios
  • Consider whether state-by-state variations in data practices might reduce aggregate liability

Industry-Specific Implications

Technology Companies

The Google settlement establishes a new baseline for what tech companies should expect when they mishandle user data. Companies that rely on advertising-driven business models built on extensive data collection face heightened scrutiny.

Healthcare and Biometric Technology Providers

Any organization using facial recognition, voice biometrics, or other biometric authentication must ensure ironclad consent processes and transparent data handling practices.

Mobile App Developers

Apps that request location permissions face particular risk if their data collection practices don't match user expectations or if opt-out mechanisms don't function as advertised.

IoT and Smart Home Device Manufacturers

Devices with cameras, microphones, or sensors that could capture biometric data require explicit consent mechanisms and clear privacy notices.

What Texas Got Right: Lessons for Other States

Texas's success offers a playbook for other state AGs looking to hold Big Tech accountable:

1. Leverage Strong State Privacy Laws - Texas used multiple statutes (DTPA, CUBI, TDPSA) to build a comprehensive case rather than relying on a single legal theory.

2. Go Solo When Justified - While multistate actions have their place, Texas demonstrated that large states with significant affected populations can achieve better results independently.

3. Hire Top-Tier Outside Counsel - The contingency arrangement with Norton Rose Fulbright brought sophisticated legal talent without upfront budget constraints.

4. Focus on Clear Harm - The cases centered on concrete violations—unauthorized data collection, misleading privacy controls, absence of consent—rather than abstract regulatory theories.

5. Be Willing to Litigate - Texas filed multiple lawsuits starting in 2022 and maintained pressure through years of litigation before Google agreed to settle.

The Google settlement fits within several larger trends reshaping privacy enforcement:

State Leadership in the Federal Void

With no comprehensive federal privacy law enacted despite years of debate, states have stepped into the breach. Approximately half of all states have now passed general data privacy laws, and enforcement actions are accelerating. For a comprehensive overview of the evolving state privacy landscape, see our 2025 US State Privacy Laws Guide.

Biometric Data as a Priority Category

Illinois pioneered aggressive biometric privacy enforcement under its Biometric Information Privacy Act (BIPA), which includes a private right of action. Texas has now matched Illinois's intensity, securing two of the largest biometric privacy settlements ever. Other states are likely to follow suit.

To understand the broader implications of biometric surveillance, read our analysis of ICE's Mobile Fortify App and Biometric Surveillance Expansion.

The End of the "Move Fast and Break Things" Era

For years, tech companies operated under the assumption that they could launch products with aggressive data collection practices and negotiate settlements later if caught. Multi-billion-dollar settlements change that calculus. The cost of non-compliance now potentially exceeds the business value of unauthorized data collection.

Regulators and courts are increasingly rejecting the idea that users meaningfully consent to data practices through buried terms of service or pre-checked boxes. Genuine informed consent requires clear, specific, understandable disclosures at the point of data collection.

Looking Ahead: What's Next?

The finalization of this settlement raises several questions about what comes next:

Will Other States Follow Texas's Lead?

California, New York, Illinois, and Washington all have significant tech company presence and strong privacy laws. Will their attorneys general pursue similarly aggressive solo enforcement actions rather than joining multistate coalitions?

How Will Companies Respond?

Will tech companies fundamentally reform their data collection practices to avoid future billion-dollar settlements? Or will they view these penalties as simply the cost of doing business in a data-driven economy?

What About Other Big Tech Players?

Google and Meta have now paid Texas a combined $2.883 billion. Amazon, Apple, Microsoft, and others all collect significant amounts of user data. Are they next in line for major enforcement actions?

Will Federal Legislation Finally Pass?

The patchwork of state privacy laws and massive state-level enforcement actions could finally provide sufficient pressure for federal action. A comprehensive federal privacy law would provide clarity and uniform standards—though it could also preempt stronger state protections.

Practical Steps for Compliance Teams

If you're responsible for privacy compliance, here's what you should do immediately:

Immediate Actions (This Week):

  1. Review all biometric data collection practices for proper consent mechanisms
  2. Audit location tracking disclosures and opt-out functionality
  3. Verify that "private" or "incognito" features truly limit data collection as advertised
  4. Document your current privacy practices with timestamp evidence

Short-Term Priorities (This Month):

  1. Conduct a comprehensive privacy impact assessment focused on high-risk data types
  2. Review and update privacy policies to ensure accurate descriptions of data practices
  3. Implement or strengthen consent management platforms
  4. Train product teams on privacy-by-design principles

Long-Term Strategic Initiatives (This Quarter):

  1. Develop state-specific privacy compliance programs
  2. Establish data minimization practices to reduce unnecessary collection
  3. Create internal audit procedures for ongoing privacy compliance monitoring
  4. Build relationships with privacy counsel who specialize in state AG enforcement

The Bottom Line

Attorney General Paxton's statement captures the essential message: "If Big Tech thinks they can get away with abusing user data and illegally spying on Texans without consequences, I will make sure they are proven wrong."

The $1.375 billion settlement proves he means it.

For compliance professionals, the takeaway is equally clear: state privacy enforcement has matured into a serious, costly threat that demands proactive attention. The era when companies could collect data aggressively and settle cheaply if caught has definitively ended.

Organizations that continue treating privacy compliance as a low priority or an afterthought will face consequences measured not in millions but in billions of dollars. Those that embrace privacy as a core business value, implement robust consent mechanisms, and ensure their practices match their promises will navigate this new enforcement landscape far more successfully.

Texas has set a new standard. Other states are watching. And Big Tech is on notice.

About This Settlement

Amount: $1.375 billion
Parties: State of Texas v. Google LLC
Announcement Date: October 31, 2025
Initial Lawsuit Filing: January 2022 (geolocation), May 2022 (incognito mode), October 2022 (biometrics)
Legal Basis: Texas Deceptive Trade Practices Act, Texas Capture or Use of Biometric Identifier Act
Outside Counsel: Norton Rose Fulbright

This article is for informational purposes only and does not constitute legal advice. Organizations should consult with qualified privacy counsel regarding their specific compliance obligations.

Related Reading:

Read more

Generate Policy Global Compliance Map Policy Quest Secure Checklists Cyber Templates