On March 11, 2025, Ius Omnibus filed a collective action lawsuit at the Lisbon District Court to defend consumers aged 13 (thirteen) or older, residing in Portugal, against illegal practices by Google (Alphabet Inc., Google LLC, Google Ireland Limited and GGLE Portugal, hereinafter ‘Google’) and to restore legality.
The lawsuit seeks to protect all consumers aged 13 (thirteen) or older who have used and/or use Google products and services after March 1, 2012, and who were 13 (thirteen) years old or over when they first used Google products and services or at a later date.
Google’s surveillance system collects, associates and combines personal data from consumers of all its products and services residing in Portugal, which it uses mainly for the benefit of its personalized advertising services. Google’s surveillance system works at the expense of the privacy of users of its products and services.
Google collects and processes a huge amount of personal data from consumers residing in Portugal, including sensitive personal data, without their consent, contractual necessity, or legitimate interest.
Google does not process the personal data of consumers aged 13 (thirteen) or older, residing in Portugal, who use its products and services, in accordance with personal data protection rules, including under conditions that ensure adequate protection of personal data against unauthorized or unlawful processing.
Google transferred personal data of consumers aged 13 (thirteen) years or older, residing in Portugal, to the US without a valid basis and without adopting adequate safeguards to ensure that the personal data of these consumers benefited from the same level of protection as in the EU, subjecting these consumers and their personal data to unauthorized surveillance by US public authorities.
Google exploits the asymmetry of information in relation to its users, particularly due to their age and credulity, by implementing misleading design tools and misleading actions and omissions that distort and/or are likely to distort their behavior in relation to Google services and products and the collections and processing of their personal data, including them to provide more personal data than they would have provided if they had been properly informed and acted freely.
Google is thus violating fundamental rights guaranteed by the Constitution, personality rights, the Unfair Commercial Practices Act and the General Data Protection Regulation.
If successful, the lawsuit will force Google to end its unlawful practices and to compensate users harmed.
Ius Omnibus is represented in this lawsuit by the law firm Sousa Ferro & Associates.
Identification of the Parties
Plaintiff: Associação Ius Omnibus
Defendants: Alphabet Inc., Google LLC, Google Ireland Limited e GGLE Portugal
Court
Lisbon District Court – Lisbon Central Civil Court (Judge 3)
Number of the process
6669/25.6T8LSB (Popular action)
Request (in summary)
a) Declare that the Defendants, since March 1, 2012, have violated rules on the protection of privacy and personal data and the protection of consumer rights, by adopting misleading commercial practices that violate privacy, by unlawfully processing personal data without obtaining the free, informed, specific and unambiguous consent of the represented consumers, manifested through a positive and clear act, by failing to process personal data and information of the represented consumers on the basis of contractual necessity and legitimate interest and in accordance with lawful purposes; by placing cookies and other tracking technologies on the devices of represented consumers without valid consent, and without contractual necessity; by adopting unreasonable conditions, not properly and sufficiently clarifying how they collect, process and share data, by improperly sending this data outside the European Union, and of course, in pursuit of their goal of generating profits, exposing and creating risks of exposure of the intimacy of their private and family life, subjecting and exposing represented consumers to excessive surveillance, used to influence their decisions and behaviour in a significant way, manipulating their digital and extra-digital conduct, restricting free and independent decision-making, distorting or risking distorting consumer choices;
b) That the Defendants be ordered to communicate the possibility of the represented consumers giving their free, informed, specific and unequivocal consent, manifested through a positive and clear act, for the storage and processing of the personal data that the Defendants have already carried out, under penalty of the same data being deleted;
c) The Defendants be ordered to cease the unlawful practices in question:
i. Implementing mechanisms to ensure that the processing of the personal data of the represented consumers is only carried out on a vlaid legal basis and in accordance with lawful purposes and to the extent necessary for those purposes;
ii. Refraining from continuing to process the personal data of the represented consumers without a valid legal basis and in accordance with lawful purposes and to the extent necessary for these purposes;
iii. Implementing mechanisms to ensure that cookies or other tracking technologies are placed on the devices or used in conjunction with the devices and/or browsers of the represented consumers only when there is valid consent from the represented consumers or strict contractual necessity;
iv. Providing information to represented consumers in a concise, clear, and easily accessible manner about the processing and extent of their personal data;
d) To declare that the Defendants’ practices have caused damage to the diffuse interests and/or collective interests of freedom, self-determination, and free development of the personality, moral integrity, protection of personal data, protection of consumer relations and protection of privacy;
e) To declare that the Defendants’ practices have caused damage to the homogeneous individual interests of the represented consumers;
f) That the Defendants be ordered, jointly and severally, to fully compensate all the represented consumers in the lawsuit for the damages caused to them by the unlawful practices in question.
Status of the lawsuit
In progress
Consumer’s summons
06.05.2025 – Order summoning the consumers, through the posting of a notice at the Court and publication of an announcement on the Ministry of Justice’s publicly accessible website, setting a deadline of 30 (thirty) days for them to intervene in the proceeding, if they wish, and to declare in the case file whether or not they accept being represented by the Plaintiff, or if, on the contrary, they exclude themselves from such representation, failing which their passivity will be deemed to constitute acceptance.
You can consult the notice here.
This is a collective action lawsuit for the protection of consumer relations and privacy and protection of personal data, to protect the free development of personality and self-determination, to defend moral, psychological, and physical integrity and health, and to defense the homogeneous individual interests of consumers, filed by Ius Omnibus.
The action is filed under articles 52(3) and 60(3) of the Constitution of the Portuguese Republic, articles 2, 5, 6 and 12 of the Collective Actions Law (Decree-Law 114-A/2023, of December 5), and articles 31 and 546(2) of the Code of Civil Procedure.
At issue is the adoption of a series of misleading commercial practices, the violation of privacy and the improper processing of the personal data of users of Google products and services residing in Portugal who, after March 1, 2012, and on their first use of Google products and services or at late date, were 13 (thirteen) years old or over.
Since March 1, 2012, Google has been processing the personal data of users of Google products and services residing in Portugal who are aged 13 (thirteen) years or over, without obtaining their consent, and does not process personal data of represented consumers on the basis of contractual necessity and legitimate interest, in accordance with lawful purposes. Google collects and processes personal data, including sensitive personal data, from users of its numerous services and products residing in Portugal, without their explicit consent and without any other valid legal basis for the processing. Google’s processing of consumers’ personal data is intrusive.
Google does not process the personal data of users of its products and services residing in Portugal who are 13 (thirteen) years or over in such a way as to ensure their security, including protection against unauthorized or unlawful processing, and has not adopted appropriate technical or organizational measures. Google does not adopt effective mechanisms to ensure the protection of these consumers, harming them and exposing them to dangers, namely to their safety, as well as to the privacy of their private and family life.
Until July 9, 2023, Google transferred personal data of users of its products and services residing in Portugal aged 13 (thirteen) years or over to the United States of America, without ensuring that the personal data of these consumers benefited from a level of protection in that country equivalent to that of the European Union and, in particular, without adopting adequate safeguards to ensure protection against the risk of unauthorized and improper access and surveillance by US public authorities.
Google adopts conditions that are not very clear and does not properly and sufficiently clarify the extent of consumers’ personal data that it collects and processes, including the processing of their personal data for the purposes of personalized advertising and for the creation and development of artificial intelligence models.
Google has placed and continues to place cookies and other tracking technologies on the devices of the represented consumers without obtaining their consent, and without many of these cookies and/or other tracking technologies being strictly necessary for the provision of Google services and products.
Through these behaviors, Google exposes and creates risks of exposure of the privacy of represented consumers, subjecting them to excessive surveillance, used to influence their decisions and behaviors in a significant way, manipulating their digital and extra-digital conduct, and restricting the free and independent decision-making of the represented consumers.
Represented in this collective action are all consumers residing in Portugal who, after March 1, 2012, 13 (thirteen) years old or older when they first used Google products and services or later. They will only be represented in this action for the period in which they were users of Google products and services aged 13 (thirteen) or over.
Consumers don’t have to do anything to be represented in the action and to be entitled to compensation if the action is successful (they only have to claim their compensation at that point).
Any consumer who does not wish to be represented in this action may exercise the right to opt out, through their legal representatives if the consumer is a minor, by notifying the court of this intention. Consumers may also decide to intervene in the proceedings, through their legal representatives if the consumer is a minor, in support of Ius Omnibus, within the time limit set by the court.
Ius Omnibus asks the Court, in summary, to:
a) Declare that the Defendants, since March 1, 2012, have violated rules on the protection of privacy and personal data and the protection of consumer rights, by adopting misleading commercial practices that violate privacy, by unlawfully processing personal data without obtaining the free, informed, specific and unambiguous consent of the represented consumers, manifested through a positive and clear act, by failing to process personal data and information of the represented consumers on the basis of contractual necessity and legitimate interest and in accordance with lawful purposes; by placing cookies and other tracking technologies on the devices of represented consumers without valid consent, and without contractual necessity; by adopting unreasonable conditions, not properly and sufficiently clarifying how they collect, process and share data, by improperly sending this data outside the European Union, and of course, in pursuit of their goal of generating profits, exposing and creating risks of exposure of the intimacy of their private and family life, subjecting and exposing represented consumers to excessive surveillance, used to influence their decisions and behaviour in a significant way, manipulating their digital and extra-digital conduct, restricting free and independent decision-making, distorting or risking distorting consumer choices;
b) That the Defendants be ordered to communicate the possibility of the represented consumers giving their free, informed, specific and unequivocal consent, manifested through a positive and clear act, for the storage and processing of the personal data that the Defendants have already carried out, under penalty of the same data being deleted;
c) The Defendants be ordered to cease the unlawful practices in question:
(i.) Implementing mechanisms to ensure that the processing of the personal data of the represented consumers is only carried out on a vlaid legal basis and in accordance with lawful purposes and to the extent necessary for those purposes;
(ii.) Refraining from continuing to process the personal data of the represented consumers without a valid legal basis and in accordance with lawful purposes and to the extent necessary for these purposes;
(iii.) Implementing mechanisms to ensure that cookies or other tracking technologies are placed on the devices or used in conjunction with the devices and/or browsers of the represented consumers only when there is valid consent from the represented consumers or strict contractual necessity;
(iv.) Providing information to represented consumers in a concise, clear, and easily accessible manner about the processing and extent of their personal data;
d) To declare that the Defendants’ practices have caused damage to the diffuse interests and/or collective interests of freedom, self-determination, and free development of the personality, moral integrity, protection of personal data, protection of consumer relations and protection of privacy;
e) To declare that the Defendants’ practices have caused damage to the homogeneous individual interests of the represented consumers;
f) That the Defendants be ordered, jointly and severally, to fully compensate all the represented consumers in the lawsuit for the damages caused to them by the unlawful practices in question.
The consumer mass compensation mechanism used here, provided for in the Portuguese class action rules, has not yet been tested in practice to the last step. However, according to the law, the following will happen if the court finds in favor of Ius Omnibus:
1) The court will set the overall amount of compensation to be paid by Google to consumers, and will determine how the individual compensation will be distributed to each consumer (e.g. direct payment by a Defendant, or distribution by an entity designated by the court);
2) The court will set the manner and deadline for represented consumers to claim their share of the compensation (not distributed directly) and this information will be publicized in various ways;
3) Consumers (who do not receive compensation directly from a Defendant) will have to contact the entity responsible for managing the compensation fund, through their legal representatives if the consumer is a minor, as well as send the evidence decided by the court and payment instructions, in order to receive their share of the compensation;
4) At the end of the period set by the court, a portion of the total amount of compensation remained unclaimed by the consumers:
(i.) This amount will be used to pay the costs incurred by Ius Omnibus as a result of the action;
(ii.) What is left over will be handed over to the State, the proportion of 60% to the Fund for the Promotion of Consumer Rights and 40% to the Institute for Financial Management and Justice Equipment, I.P.
Consumers do not have to contact the Court or Ius Omnibus, but it may be in their interest to do so.
All consumers residing in Portugal who, after March 1, 2012, on their first use of Google products and services or at a later date, are 13 (thirteen) years old or older, are automatically represented in this class action.
If they do not wish to be represented, they will have to exercise their right to opt out, through their legal representatives if the consumer is a minor
If they want to be represented, they don’t need to do anything else for now to be entitled to compensation if Ius Omnibus wins this case.
At the end of the process, if the action is successful, they can contact the entity designated by the Court (if applicable) to request their compensation, through their legal representatives if the consumer is a minor.
However, if they wish to intervene in the action in support of Ius Omnibus, they can do so, within the time limit to be set by the Court, through their legal representatives if the consumer is a minor.
All consumers represented in this action are invited to contact Ius Omnibus now, through their legal representatives if the consumer is a minor, so that their details can be registered and they can be informed by Ius Omnibus of all developments in the case, ensuring that they do not miss the opportunity to claim their compensation when the time comes. You can do this using the form available on this page.
Preparing a lawsuit of this nature in an adequate manner, allowing it to succeed, is extremely expensive, requiring the hiring of specialized lawyers and consultants. The success of the action depends on the proper handling of broad and technical facts, within an extremely complex area of legal, economic and technological knowledge. Effective reaction is also subject to the vast financial and human resources that will be mobilized by the counterparties.
However, consumers will never have to pay any money, bear any costs or waive any part of the compensation to which they are entitled. The case is financed by a foreign law firm that specializes in consumer protection actions, Lieff Cabraser Heimann & Bernstein.
The financing contract is subject to the scrutiny of the court, without the financier being able to interfere or determine the management of the case by Ius Omnibus.
The funder assumes all the risk and costs. If Ius Omnibus loses the case, the funder is not entitled to any compensation. If Ius Omnibus wins the case, the funder will receive the amount that the court decides is appropriate and fair.
The funder will only receive this amount if a portion of the overall compensation paid by the Defendants remains after the deadline for consumers to apply for individual compensation has expired. The remaining amount is then allocated in accordance with the applicable legal provisions.