So, some users had their browsing habits illegally harvested, stored, analyzed, and sold to an unknown number of parties for an unknown number of purposes, many of them adverserial in nature to the well-being of the individual. So what?
But even under a civil-court "preponderance of evidence" standard, wouldn't you have to prove some material harm to be eligible for damages (not just the potential of the data perhaps maybe being misused possibly)?
Second the problem statement I made above itself shows harm.
The fact that consumers have to worry about who got their private information, what was done with it, what harms happened that they aren't aware of, such as not getting a job, housing discrimination, loan discrimination, etc. is itself a harm.
That these things happen, in general, is eminently provable and that fact causes worry, anxiety, and changes in behavior which is itself a harm.
There might be some precedent in the space (cigarette ad campaigns were severely curtailed during the "Big Tobacco" crackdown in the US), but ads in general? Good luck.
I assume ads targeted towards children would be a good case study.
Given that the way it occurs is by allowing Google to more accurately profile the users, I'd say yes.
Probably not. But how about a fine? Something in the 5 - 10 Billion € range?
That may help to cool a few hot heads who think pulling off shit like that is a good idea.
to me, this seems like the wrong question.
in a broad sense, it makes more sense to ask how harsh the penalty should be. generally, for actions like this, the penalty is expressed as a monetary forfeiture.
whatever the penalty is, the relinquished funds have to go somewhere, and those who can demonstrate being harmed seems like a sensible destination.