$95 Million Settlement in Apple-Siri Lawsuit

January 31, 2025
SRI International Artificial Intelligence

By Anuradha Gandhi and Rachita Thakur

Introduction

The case of Lopez v. Apple, Inc., heard in the United States District Court for the Northern District of California, delves into the critical issues surrounding privacy and consumer rights in the digital age. The plaintiffs, individual users of Apple’s Siri enabled devices, have brought forward a Class Action alleging that Apple violated Privacy Laws by recording and utilizing voice data without explicit consent. Central to the dispute are claims of inadvertent Siri activations leading to unauthorized recordings of private conversations, which were allegedly disclosed to third-party contractors for quality improvement purposes.

A Brief History of Siri

The Siri app originated as a spin-off from the SRI International Artificial Intelligence Center and stemmed from the CALO Project, a US Defense Advances Research Projects Agency – funded initiative aimed at integrating various AI technologies into a cognitive assistant. Siri was developed by Dag Kittlaus, Tom Gruber, and Adam Cheyar. Initially, the developers intended to release Siri on Android and Blackberry devices, but Apple’s Acquisition of the app in April 2010, which was led by Steve Jobs, altered those plans. This marked a significant milestone for Apple as the iPhone 4s launched, on October 4, 2011 with a beta version of Siri.[1]

What is a Class Action Lawsuit?

In California, Section 1781 of the California Civil Code, 1872 entitles a consumer to bring an action on behalf of similarly affected consumers to seek damages or other reliefs.[2]

Can a Class Action Lawsuit be instituted in India?

In India, class action lawsuit can be instituted under different provisions of Law.

  1. The Code of Civil Procedure, 1908 – in Order 1 Rule 8 of the Code of Civil Procedure, 1908[3] wherein when multiple persons share the same interest in a legal suit, one or more of them may, with the Court’s permission, sue, be sued, or defend the case on behalf of all interested parties.
  2. The Consumer Protection Act, 2019 – Section 17 of the Consumer Protection Act, 2019 provides that a complaint regarding the violation of consumer rights, unfair trade practices, or false and misleading advertisements harmful to consumers as a class may be submitted in writing to the District Collector, the Commissioner of the regional office or the Central authority[4]. Further, Section 35(1)(c)[5] lays down that if multiple consumers share the same interest, they may file a complaint with the District Commission, on behalf of all affected consumers with the commission’s permission.

Approximate Class Size

In 2018, Apple claimed that Siri was being used in approximately 500 million devices[6]. By 2024, approximately 1,462 million people worldwide were iPhone Users with around 155 million users just in the USA.[7] In India this figure was approximately 46.8 million last year.[8]

Claims against Apple

  1. Unauthorized interception of Private Communications
    Virtual assistant would activate without any intentional trigger by the user. These unintended activations reportedly resulted in the recording of private conversations in various sensitive settings.
  2. Disclosure of Recorded Conversations to Third Parties
    Apple disclosed the recorded private conversations to third party contractors as part of a “quality improvement program” aimed at enhancing Siri’s functionality. The plaintiffs argued that Apple failed to ensure that these recording were anonymized or securely managed, exposing their sensitive information to external entities.
  3. Economic and Contractual Breach
    The privacy violations rendered Siri, a central feature of their Apple devices, useless for the plaintiffs, thereby causing economic harm.
  4. Targeted Advertising based on Private Data
    In one instance, after discussing a medical condition near a Siri-enabled device, a plaintiff started receiving targeted advertisements for related medications. The intercepted communications of the plaintiffs were not only disclosed but also analyzed and monetized.
  5. Failure to notify and obtain Consent
    Apple provided no clear mechanism for users to know when Siri had activated or what data was being recorded and disclosed. There was a failure to obtain informed consent from users regarding the collections and use of their private communications.[9]

Timeline of the Lawsuit

In 2011, Apple launched the virtual assistant as an app in its iPhone 4s model. Thereafter, Siri was integrated in the IOS software in September, 2014 and was advertised to activate upon the uttering of the trigger words, “Hey Siri”. In August 2019, a group of plaintiffs, being users of Siri-enabled devices, filed a Class Action Lawsuit against Apple on the grounds of violation of Privacy. Apple, in October 2019, claimed to have permanently deleted the individual Siri audio recordings collected before the date of this claim.[10] After half a decade of litigation, Apple settled this lawsuit on 31st December, 2024. This settlement agreement is pending approval from the United States District Court for the Northern District of California which is scheduled for 14 February, 2025

Relevant US Privacy Laws

  1. Right to Privacy under the Constitution of California – Article 1 Section 1 of the Constitution of California recognizes the Right to Privacy as a Constitutional Right.
  2. California Invasion of Privacy Act – CIPA, passed in 1967, was enacted in response to growing concerns about wiretapping and electronic eavesdropping. The act added 3 main provisions relating wiretapping and eavesdropping in the Penal Code.
    a. Section 631 prohibits wiretapping in the form of unauthorized interception or recording of communications, including phone calls and electronic messages, without the consent of all parties involved.
  3. b. Section 632 prohibits eavesdropping and protects confidential conversations, requiring all-party consent to record conversation where there is reasonable expectation of privacy.
    c. Section 637.2 enables individuals to sue for damages when their privacy rights under CIPA are violated.[11]

  4. California Civil Jury Instructions (CACI) 1809 – The instructions lay down 5 essentials to establish guilt under Section 632[12]:
    a. Defendant intentionally eavesdropped on/recorded Plaintiff’s conversation by using an electronic device;
    b. Plaintiff had a reasonable expectation that the conversation was not being overheard or recorded;
    c. Defendant did not have the consent of all parties to the conversation to eavesdrop on/record it;
    d. Plaintiff was harmed;
    e. Defendant’s conduct was a substantial factor in causing Plaintiff’s harm.
  5. Title 18 of US Code, Section 2511 – It criminalizes the unauthorized interception, use, or disclosure of wire, oral, or electronic communications.[13]
    a. Section 2511(1)(a) prohibits intentional interception, attempts to intercept or procuring others to intercept any wire, oral, or electronic communication.
    b. Section 2511(1)(b) specifically addresses oral communications and includes additional safeguards. The conviction can be ordered either under Section 2511(1)(a) or Section 2511(1)(b) but not under both.
    c. Section 2511(1)(c) & (d) penalize the disclosure and use of illegally intercepted communications when the individual knows or should know they were obtained unlawfully
  6. Relevant Privacy Laws in India

    1. Right to Privacy under the Indian Constitution – The Supreme Court of India, in the case of Justice K.S. Puttaswamy[14], declared that Right to Privacy is recognized as a fundamental right under Article 14, 19 and 21 of the Indian Constitution.
    2. Digital Personal Data Protection Act, 2023 – The act lays down that the Personal Data processing requires data principal’s lawful and informed consent, with a prior notice detailing purpose, rights and grievance redressal. Data fiduciaries have to ensure security, report breaches and erase data upon consent withdrawal. Significant Data fiduciaries have to appoint a Data Protection officer and an Independent Data Auditor. The act also gives the Data Principals the right to request correction, updating or deletion of their data.
    3. Consumer Protection Act, 2019 – The act defines ‘unfair trade practice’ to include disclosing the personal information of a consumer to any other person unless such disclosure is in accordance with the law.
    4. Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009 – These rules prohibit any person from monitoring, intercepting or decrypting information in any computer resource without an order from the competent authority. Intermediaries and authorized persons shall not violate obligations related to maintaining the secrecy and confidentiality of information or permit unauthorized interception, monitoring or decryption of information.

    Relevant findings of the Court

    1. Standing and Plausibility of Privacy Claims
      The Court noted that a private environment alone could establish a reasonable expectation of privacy and that the inadvertent activations of Siri led to the violation of the reasonable expectation of Privacy of the Plaintiffs. The information was exclusively in Apple’s possession and the Plaintiffs received targeted advertisements tied to the content of their private conversations recorded by Siri.
    2. Lack of Intentional Interception
      The Court observed that the plaintiffs’ allegations supported the claim that Apple knowingly and intentionally retained and shared recording of accidental activations with third parties for quality improvement, rather than deleting them.
    3. Consent by Users
      The Court disagreed that users provided implied consent by continuing to use Siri-enabled devices observing activation alerts stating that activation alerts did not constitute informed consent.

    Current Status of the Lawsuit

    The lawsuit has reached a settlement. Apple has agreed to pay $95 million to resolve claims that its Siri Voice assistant improperly recorded private conversations and shared the data with third parties without user consent. The settlement includes compensation of $20 per device for eligible users who owned Siri-enabled devices between September 17, 2014 and December 31, 2024[15]. While Apple denies any wrongdoing, the settlement acknowledges that accidental Siri activations and potential privacy breaches were significant concerns raised by the plaintiffs. The settlement requires final approval by the Court before claims can be processed. Users will need to submit claims to receive their share of the settlement.

    What if similar proceedings were instituted in India?

    In India, similar proceedings can result in remedies being granted under multiple provisions of Law.

    1. The Code of Civil Procedure, 1908
      A consumer can institute a representative suit under Order 1 Rule 8 of the Code of Civil Procedure, 1908 claiming damages. The Court may grant remedial civil damages in the form of monetary penalties considering the magnitude and the degree of harm caused.
    2. The Consumer Protection Act, 2019
      A complaint can also be filed before the under Section 17 and Section 35(1)(c) in cases of collective harm. If the Central Authority, after investigation, finds sufficient evidence of violation, it may issue necessary orders, including recalling hazardous goods or withdrawing unsafe services, reimbursing affected consumers, and discontinuing unfair trade practices.
    3. The Digital Personal Data Protection Act, 2023
      Post the enactment of the Digital Personal Data Protect Act, 2023[16], a data principal can also file complaint before the Data Protection Board on the grounds of breach of duties by a Significant Data Fiduciary. However, there is no provision for a collective complaint being filed. The Data Protection Board may impose a penalty extending to Rs. 150 Crore under Section 33(1) of the Act.

    Similar Allegations against other Voice Assistants

    The eavesdropping and recording of private conversation by voice assistants due to accidental activations is not restricted to Siri.

    1. Google Assistant – As per a 2019 news article, Google home devices often record conversations unintentionally, even without the “Okay Google” command being explicitly given. These recordings include private and sensitive conversations. Google claims that only a small fraction (0.2%) of audio files are analyzed by language experts for technology development.[17]
    2. Amazon Alexa –In 2019, it was reported that Amazon employees listen to Alexa recordings to improve the voice assistant’s performance, including transcribing commands and analyzing system responses. Accidental activations caused by ambient noise has led to unintended recordings with employees encountering disturbing audios such as possible criminal activity, but Amazon has stated that addressing such incidents is beyond its role.[18]

    Voice Assistants and Lawsuits

    1. Amazon Alexa Privacy Lawsuit – In May 2023, Amazon settled a $25 million lawsuit by Federal Trade Commission and the Justice Department alleging violation of Children’s Online Privacy Protection Act of 1998 by deceiving parents and keeping the voice and location data of Children recording by Alexa.[19]
    2. Google Assistant Class Action Lawsuit – A class action lawsuit against Google has been filed before the US District Court Northern District of California, San Jose Division alleging that Google Assistant inadvertently activates and records use communications without intentional trigger, “Okay Google”. Plaintiffs allege that Google unlawfully collects, uses and discloses these recording to enhance its speech recognition technology, violating its privacy assurances. Google denies all allegations. The Court has scheduled a jury trial to begin on September 22, 2025.[20]

    Apple’s Response to the Lawsuit

    Apple issued an apology after a 2019 whistleblower report revealed third party access to sensitive Siri recordings and updated its privacy policy to include allowing users to opt out of data collection, no longer retaining Siri Audio Recording by default, limiting access to recordings, using transcripts for improvement, and prioritizing on-device offline processing with anonymized data.[21] Apple’s spokesperson clarified that the reason behind agreeing to the settlement was to avoid additional litigation moving forward from concerns about third-party grading that they already addressed in 2019. [22]

    Prateek Chandgothia , Intern at S.S. Rana & Co. has assisted in the research of this article.

    [1]https://www.techradar.com/news/siri-10-year-anniversary

    [2]https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1781.&lawCode=CIV#:~:text=(a)%20Any%20consumer%20entitled%20to,provided%20for%20in%20Section%201780

    [3]https://www.writinglaw.com/order-1-rule-8-cpc/

    [4]https://indiankanoon.org/doc/44635917/

    [5]https://www.indiacode.nic.in/show-data?actid=AC_CEN_21_44_00007_201935_1596441164903&orderno=35

    [6]https://voicebot.ai/2018/01/24/apple-siri-devices-total-500-million-not-users-still/

    [7]https://backlinko.com/iphone-users

    [8]https://www.grabon.in/indulge/tech/iphone-users-and-sales-statistics/

    [9]https://digitalcommons.law.scu.edu/context/historical/article/3528/viewcontent/apple_lopez_ruling.pdf

    [10] https://www.bbc.com/news/articles/cr4rvr495rgo

    [11]https://www.enzuzo.com/blog/california-invasion-of-privacy-act#:~:text=CIPA%2C%20passed%20in%201967%2C%20was,or%20consent%20of%20those%20involved.

    [12]https://www.justia.com/trials-litigation/docs/caci/1800/1809/

    [13]https://www.justice.gov/archives/jm/criminal-resource-manual-1050-scope-18-usc-2511-prohibitions

    [14] Justice K.S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors, (2017) 10 SCC 1

    [15]https://www.reuters.com/legal/apple-pay-95-million-settle-siri-privacy-lawsuit-2025-01-02/

    [16]https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf

    [17]https://www.vrt.be/vrtnws/en/2019/07/10/google-employees-are-eavesdropping-even-in-flemish-living-rooms/

    [18]https://www.theguardian.com/technology/2019/oct/09/alexa-are-you-invading-my-privacy-the-dark-side-of-our-voice-assistants

    [19]https://www.thehindu.com/sci-tech/technology/amazon-charged-privacy-violations-alexa-ring-cameras/article66918632.ece

    [20]https://www.googleassistantprivacylitigation.com/

    [21]https://indianexpress.com/article/technology/tech-news-technology/apple-settlement-siri-lawsuit-what-to-know-9761331/

    [22]https://www.indiatoday.in/world/us-news/story/apples-95-million-siri-settlement-what-consumers-could-get-and-key-details-glbs-2659529-2025-01-04

For more information please contact us at : info@ssrana.com