Mr Lloyd alleged that Google had unlawfully tracked Safari users and sought to bring a representative claim for millions of people. The claim was framed around loss of control of data, without proving individual financial loss or distress for each person.
Selected cases
UK Supreme Court · [2021] UKSC 50
Lloyd v Google LLC
The UK Supreme Court considered a proposed representative data protection claim against Google.
UK Supreme Court10 Nov 2021
Plain-English explainers, not legal advice. Use the linked official source for section-level detail, and get advice for your situation.
Get legal helpStart here
Quick read
- The decision reduced one route for large-scale data claims, but it does not make privacy risk small.
- The UK Supreme Court considered a proposed representative data protection claim against Google.
Use this to check
- Do not treat this case as permission for loose tracking practices
- Keep cookie, analytics and advertising-tech flows documented
- Assess privacy claims by regime, loss, evidence and class structure
Decision snapshot
What happened
- Mr Lloyd alleged that Google had unlawfully tracked Safari users and sought to bring a representative claim for millions of people.
- The claim was framed around loss of control of data, without proving individual financial loss or distress for each person.
What the court had to decide
- The issue was whether the representative procedure could be used to recover uniform damages for a large class of people without individual assessment.
What the court decided
- The Supreme Court allowed Google's appeal.
- It held that damages under the relevant data protection regime required proof of material damage or distress, and the claim could not proceed in the way proposed.
Practical impact
Practical read
- The decision reduced one route for large-scale data claims, but it does not make privacy risk small.
- Businesses still need clear tracking, consent, data-use and breach-response practices because regulatory action, individual claims and customer trust remain live issues.
Useful next steps
- Do not treat this case as permission for loose tracking practices
- Keep cookie, analytics and advertising-tech flows documented
- Assess privacy claims by regime, loss, evidence and class structure
How businesses should read it
The decision reduced one route for large-scale data claims, but it does not make privacy risk small. Businesses still need clear tracking, consent, data-use and breach-response practices because regulatory action, individual claims and customer trust remain live issues.
Key takeaways
- Do not treat this case as permission for loose tracking practices
- Keep cookie, analytics and advertising-tech flows documented
- Assess privacy claims by regime, loss, evidence and class structure