On April 14, 2025, Ius Omnibus filed a collective action lawsuit at the Lisbon District Court to protect children under the age of 13 (thirteen) residing in Portugal against unlawful practices by Google (Alphabet Inc., Google LLC, Google Ireland Limited and GGLE Portugal, hereinafter ‘Google’) and to restore legality.
The lawsuit aims to protect all children under the age of 13 (thirteen) who have used and/or use Google products and services after March 1, 2012, and who were not yet 13 (thirteen) years old when they first used Google products and services or later.
Google’s surveillance system collects, associates and combines personal data from consumers of all its products and services residing in Portugal, including consumers under the age of 13 (thirteen), which it uses mainly for the benefit of its personalized advertising services. Google’s surveillance system works at the expense of the privacy of users of its products and services, including children under the age of 13 (thirteen).
Google states that it does not authorize the use of its products and services by children under the age of 13 (thirteen), such use by these minors being dependent on the authorization of a parent or legal guardian. However, Google does not implement mechanisms that prevent the registration through a Google Account and/or use of its products and services without prior registration through a Google Account by these minors, without the due authorization of the holders of parental responsibilities.
Google collects and processes a huge amount of personal data of children under the age of 13 (thirteen) residing in Portugal, including sensitive personal data, without their consent or the consent or authorization of their respective holders of parental responsibilities, contractual necessity and without proportionate legitimate interest.
Google does not process the personal data of children under the age of 13 (thirteen) residing in Portugal, who use its products and services, in accordance with personal data protection rules, including under conditions that ensure adequate protection of personal data against unauthorized or unlawful processing.
Google also fails to adopt mechanisms for the protection of these children, collecting and processing their personal data, harming them and exposing them to dangers to their moral, psychological and physical integrity and to their safety and health, as well as to the intimacy of their private and family life. Google gives children access to all kinds of content and its algorithm makes it easier for children to be exposed to content that is inappropriate and not suitable for their age.
Google transferred personal data of children under the age of 13 (thirteen) residing in Portugal to the US without a valid basis and without adopting adequate safeguards to ensure that the personal data of these consumers benefited from the same level of protection as in the EU, subjecting these minors and their personal data to unauthorized surveillance by US public authorities.
Google exploits the information asymmetry and vulnerability of children, due to their age and credulity, in particular by implementing misleading design tools that distort and/or are likely to distort their behaviour in relation to Google services and products and the collection and processing of their personal data, including inducing them to provide more personal data than they would have provided had they been properly informed and acted freely.
Google is thus violating fundamental rights guaranteed by the Constitution, personality rights, the Unfair Commercial Practices Act and the General Data Protection Regulation.
If successful, the lawsuit will force Google to end its unlawful practices and to compensate users harmed.
Ius Omnibus is represented in this lawsuit by the law firm Sousa Ferro & Associates.
Identification of the Parties
Plaintiff: Associação Ius Omnibus
Defendants: Alphabet Inc., Google LLC, Google Ireland Limited e GGLE Portugal
Court
Lisbon District Court – Lisbon Central Civil Court (Judge 19)
Number of the process
10621/25.3T8LSB (Popular action)
Request (in summary)
a) Declare that the Defendants, since March 1, 2012, have violated rules on the protection of privacy and personal data and the protection of consumer rights, by adopting misleading commercial practices that violate privacy, by unlawfully processing personal data without obtaining the free, informed, specific and unambiguous consent of the represented consumers and their holders of parental responsibility, manifested through a positive and clear act, by failing to process personal data and information of the represented consumers on the basis of contractual necessity and legitimate interest and in accordance with lawful purposes; by placing cookies and other tracking technologies on the devices of represented consumers without valid consent, and without contractual necessity; by adopting unreasonable conditions, not properly and sufficiently clarifying how they collect, process and share data, by improperly sending this data outside the European Union, and of course, in pursuit of their goal of generating profits, exposing and creating risks of exposure of the intimacy of their private and family life, subjecting and exposing represented consumers to excessive surveillance, used to influence their decisions and behaviour in a significant way, manipulating their digital and extra-digital conduct, restricting free and independent decision-making, distorting or risking distorting consumer choices;
b) That the Defendants be ordered to communicate the possibility of the holders of parental responsibility giving their free, informed, specific and unequivocal consent, manifested through a positive and clear act, for the storage and processing of the personal data that the Defendants have already carried out, under penalty of the same data being deleted;
c) The Defendants be ordered to cease the unlawful practices in question:
(i.) Implementing mechanisms to ensure that children under the age of 13 cannot register for Google service accounts without proper authorization from their holders of parental responsibilities;
(ii.) Closing all Google product and service accounts of users under the age of 13, safeguarding the possibility of consent being given by the respective holders of parental responsibilities for maintaining the account;
(iii.) Closing all accounts for Google products and services for which they are unable to confirm that users are over 13 years of age;
(iv.) Implementing mechanisms to ensure that they process the personal data of minors under the age of 13 on the basis of a valid legal basis, ensuring that they obtain valid consent from the holders of parental responsibilities for minor users Google;
(v.) Implementing mechanisms to ensure that cookies or other tracking technologies are placed on the devices of the consumers represented only when there is valid consent from the holders of parental responsibilities for the users who are minors Google;
(vi.) Implementing mechanisms to ensure that only transfers personal data of the Google represented consumers to countries outside the EEA that ensure an adequate level of protection of such data are carried out.
d) To declare that the Defendants’ practices have caused damage to the diffuse interests and/or collective interests of freedom, self-determination and free development of the personality, moral integrity, protection of personal data, protection of consumer relations and protection of privacy;
e) To declare that the Defendants’ practices have caused damage to the homogeneous individual interests of the represented consumers;
f) That the Defendants be ordered, jointly and severally, to fully compensate all the represented consumers in the lawsuit for the damages caused to them by the unlawful practices in question.
Status of the lawsuit
In progress
Consumer’s summons
08.05.2025 – Order summoning the consumers, setting a deadline of 30 (thirty) days for them to intervene in the proceeding, if they wish, and to declare in the case file whether or not they accept being represented by the Plaintiff, or if, on the contrary, they exclude themselves from such representation, failing which their passivity will be deemed to constitute acceptance.
19.05.2025 – Publication of the consumer’s summons in the “Jornal de Notícias” newspaper (here)
19.05.2025 – Publication of the consumer’s summons in the “O Jogo” newspaper (here)
19.05.2025 – Publication of the consumer’s summons in the “Diário de Notícias” newspaper (here)
20.05.2025 – Publication of the consumer’s summons in the “Jornal de Notícias” newspaper (here)
20.05.2025 – Publication of the consumer’s summons in the “O Jogo” newspaper (here)
20.05.2025 – Publication of the consumer’s summons in the “Diário de Notícias” newspaper (here)
This is a collective action lawsuit for the protection of consumer relations and privacy and the protection of personal data, for the protection of children, the protection of the free development of the personality and self-determination of minors, for the defense of the moral, psychological and physical integrity and health of minors and the homogeneous individual interests of consumers, filed by Ius Omnibus.
The action is filed under articles 52(3) and 60(3) of the Constitution of the Portuguese Republic, articles 2, 5, 6 and 12 of the Collective Actions Law (Decree-Law 114-A/2023, of December 5), and articles 31 and 546(2) of the Code of Civil Procedure.
At issue is the adoption of a set of misleading commercial practices, the violation of privacy and the improper processing of the personal data of users of Google products and services residing in Portugal who, after March 1, 2012, and on their first use of Google products and services or at a later date, were not yet 13 (thirteen) years old.
Since March 1, 2012, Google has been processing the personal data of users of Google products and services who are residents in Portugal and under aged 13 (thirteen), without obtaining their consent and the consent or authorization of the respective holders of parental responsibilities, and does not process personal data of represented consumers on the basis of contractual necessity and legitimate interest, in accordance with lawful purposes. Google collects and processes personal data, including sensitive personal data, from users of its numerous services and products residing in Portugal, without their explicit consent, without the consent of their parental guardians and without any other valid legal basis for the processing. Google’s processing of consumers’ personal data is intrusive.
Google does not implement effective mechanisms to prevent the registration through a Google Account and/or use of its products and services without prior registration through a Google Account by minors under the age of 13 (thirteen) without the proper authorization of the holders of parental responsibilities.
Google does not process the personal data of these minors in such a way as to ensure their security, including protection against unauthorized or unlawful processing, and has not adopted appropriate technical or organizational measures.
Google also fails to adopt effective mechanisms to ensure the protection of these children, collecting and processing their personal data, harming them and exposing them to dangers to their moral, psychological and physical integrity and to their safety and health, as well as to the intimacy of their private and family life. Google allows children to access all kinds of content, and its algorithm makes it easier for children to be exposed to content that is inappropriate and not suitable for their age. Google profits from minors under the age of 13 (thirteen) years old, taking advantage of their special vulnerability.
Until July 9, 2023, Google transferred personal data of children under 13 (thirteen) years old to the United States without ensuring that consumers’ personal data benefited from a level of protection in that country equivalent to that of the European Union and, in particular, without adopting adequate safeguards to ensure protection against the risk of unauthorized and improper access and surveillance by US public authorities.
Google adopts conditions that are not clear, and does not properly and sufficiently clarify the amount and extent of consumers’ personal data that it collects and processes, including the processing of their personal data for personalized advertising purposes and for the creation and development of artificial intelligence models.
Google has placed and continues to place cookies and other tracking technologies on the devices of the minors without obtaining their valid consent and the consent or authorization of their respective holders of parental responsibilities, and without many of these cookies and/or other tracking technologies being strictly necessary for the provision of Google services and products.
Through these behaviours, Google exposes and creates risks of exposure of the privacy of minors under 13 (thirteen) years old, subjecting them to excessive surveillance, used to influence their decisions and behaviours in a significant way, manipulating their digital and extra-digital conduct, and restricting the free and independent decision-making of the minors.
Represented in this collective action are all consumers residing in Portugal who, after March 1, 2012, at the time of their first use of Google products and services or at a later date, were not yet 13 (thirteen) years old. They will only be represented in this action for the period in which they were users of Google products and services under the age of 13 (thirteen).
Consumers don’t have to do anything to be represented in the action and to be entitled to compensation if the action is successful (they only have to claim their compensation at that point).
Any consumer who does not wish to be represented in this action may exercise the right to opt out, through their legal representatives if the consumer is a minor, by notifying the court of this intention. Consumers may also decide to intervene in the proceedings, through their legal representatives if the consumer is a minor, in support of Ius Omnibus, within the time limit set by the court.
Ius Omnibus asks the Court, in summary, to:
a) Declare that the Defendants, since March 1, 2012, have violated rules on the protection of privacy and personal data and the protection of consumer rights, by adopting misleading commercial practices that violate privacy, by unlawfully processing personal data without obtaining the free, informed, specific and unambiguous consent of the represented consumers and their holders of parental responsibility, manifested through a positive and clear act, by failing to process personal data and information of the represented consumers on the basis of contractual necessity and legitimate interest and in accordance with lawful purposes; by placing cookies and other tracking technologies on the devices of represented consumers without valid consent, and without contractual necessity; by adopting unreasonable conditions, not properly and sufficiently clarifying how they collect, process and share data, by improperly sending this data outside the European Union, and of course, in pursuit of their goal of generating profits, exposing and creating risks of exposure of the intimacy of their private and family life, subjecting and exposing represented consumers to excessive surveillance, used to influence their decisions and behaviour in a significant way, manipulating their digital and extra-digital conduct, restricting free and independent decision-making, distorting or risking distorting consumer choices;
b) That the Defendants be ordered to communicate the possibility of the holders of parental responsibility giving their free, informed, specific and unequivocal consent, manifested through a positive and clear act, for the storage and processing of the personal data that the Defendants have already carried out, under penalty of the same data being deleted;
c) The Defendants be ordered to cease the unlawful practices in question:
(i.) Implementing mechanisms to ensure that children under the age of 13 cannot register for Google service accounts without proper authorization from their holders of parental responsibilities;
(ii.) Closing all Google product and service accounts of users under the age of 13, safeguarding the possibility of consent being given by the respective holders of parental responsibilities for maintaining the account;
(iii.) Closing all accounts for Google products and services for which they are unable to confirm that users are over 13 years of age;
(iv.) Implementing mechanisms to ensure that they process the personal data of minors under the age of 13 on the basis of a valid legal basis, ensuring that they obtain valid consent from the holders of parental responsibilities for minor users Google;
(v.) Implementing mechanisms to ensure that cookies or other tracking technologies are placed on the devices of the consumers represented only when there is valid consent from the holders of parental responsibilities for the users who are minors Google;
(vi.) Implementing mechanisms to ensure that only transfers personal data of the Google represented consumers to countries outside the EEA that ensure an adequate level of protection of such data are carried out.
d) To declare that the Defendants’ practices have caused damage to the diffuse interests and/or collective interests of freedom, self-determination and free development of the personality, moral integrity, protection of personal data, protection of consumer relations and protection of privacy;
e) To declare that the Defendants’ practices have caused damage to the homogeneous individual interests of the represented consumers;
f) That the Defendants be ordered, jointly and severally, to fully compensate all the represented consumers in the lawsuit for the damages caused to them by the unlawful practices in question.
The consumer mass compensation mechanism used here, provided for in the Portuguese class action rules, has not yet been tested in practice to the last step. However, according to the law, the following will happen if the court finds in favour of Ius Omnibus:
a) The court will set the overall amount of compensation to be paid by Google to consumers, and will determine how the individual compensation will be distributed to each consumer (e.g. direct payment by a Defendant, or distribution by an entity designated by the court);
b). The court will set the manner and deadline for represented consumers to claim their share of the compensation (not distributed directly) and this information will be publicized in various ways;
c) Consumers (who do not receive compensation directly from a Defendant) will have to contact the entity responsible for managing the compensation fund, through their legal representatives if the consumer is a minor, as well as send the evidence decided by the court and payment instructions, in order to receive their share of the compensation;
d) At the end of the period set by the court, a portion of the total amount of compensation remained unclaimed by the consumers:
(i.) This amount will be used to pay the costs incurred by Ius Omnibus as a result of the action;
(ii.) What is left over will be handed over to the State, the proportion of 60% to the Fund for the Promotion of Consumer Rights and 40% to the Institute for Financial Management and Justice Equipment, I.P.
Consumers do not have to contact the Court or Ius Omnibus, but it may be in their interest to do so.
All consumers residing in Portugal who, after March 1, 2012, on their first use of Google products and services or at a later date, were not yet 13 (thirteen) years old, are automatically represented in this collective action.
If they do not wish to be represented, they will have to exercise their right to opt out, through their legal representatives if the consumer is a minor
If they want to be represented, they don’t need to do anything else for now to be entitled to compensation if Ius Omnibus wins this case.
At the end of the process, if the action is successful, they can contact the entity designated by the Court (if applicable) to request their compensation, through their legal representatives if the consumer is a minor.
However, if they wish to intervene in the action in support of Ius Omnibus, they can do so, within the time limit to be set by the Court, through their legal representatives if the consumer is a minor.
All consumers represented in this action are invited to contact Ius Omnibus now, through their legal representatives if the consumer is a minor, so that their details can be registered and they can be informed by Ius Omnibus of all developments in the case, ensuring that they do not miss the opportunity to claim their compensation when the time comes. You can do this using the form available on this page.
Preparing a lawsuit of this nature in an adequate manner, allowing it to succeed, is extremely expensive, requiring the hiring of specialized lawyers and consultants. The success of the action depends on the proper handling of broad and technical facts, within an extremely complex area of legal, economic and technological knowledge. Effective reaction is also subject to the vast financial and human resources that will be mobilized by the counterparties.
However, consumers will never have to pay any money, bear any costs or waive any part of the compensation to which they are entitled. The case is financed by a foreign law firm that specializes in consumer protection actions, Lieff Cabraser Heimann & Bernstein.
The financing contract is subject to the scrutiny of the court, without the financier being able to interfere or determine the management of the case by Ius Omnibus.
The funder assumes all the risk and costs. If Ius Omnibus loses the case, the funder is not entitled to any compensation. If Ius Omnibus wins the case, the funder will receive the amount that the court decides is appropriate and fair.
The funder will only receive this amount if a portion of the overall compensation paid by the Defendants remains after the deadline for consumers to apply for individual compensation has expired. The remaining amount is then allocated in accordance with the applicable legal provisions.