Google and UPS sued over 'only your tracking number' package tracking promise

Estimated reading time: 9 minutes.

Key facts

What happened: Two California consumers filed a proposed class action against Google and UPS on October 9, 2026, over the package tracking box that appears in Google Search results.
The core claim: The box tells users "Only your tracking number will be sent to UPS." The lawsuit says clicking it actually sent browsing and device data to UPS and to advertising and analytics companies including Meta, Microsoft Bing, Adobe and The Trade Desk.
The most serious allegation: The complaint says the UPS tracking page started recording users' screen and mouse movements and keyboard inputs and sent that recording in real time to an analytics firm, Quantum Metric.
Who it covers: Everyone in the United States who used the Google Search tracking box and clicked its Track button, plus a California subclass. No class has been certified.
What the plaintiffs want: Damages, including statutory damages under California's wiretapping law, restitution, disgorgement of profits and a court order to change the practice.
Company response: Google and UPS had not filed a response or made a public statement on the case that we could find.
The case: Woodley v. Google LLC, No. 5:26-cv-11715, U.S. District Court for the Northern District of California.

What the lawsuit is about

If you have ever typed a UPS tracking number into Google, you may have seen a small box at the top of the results. It shows the carrier's name, your tracking number already filled in, a "Track" button and a short promise: "Only your tracking number will be sent to UPS."

Lennie Woodley and Joseph S. Schrant say that promise was false. Their 88-page complaint, filed by the San Francisco law firm Gutride Safier LLP, argues that a single click on the Track button set off hundreds of data transfers that neither Google nor UPS disclosed.

"That representation is false," the complaint says. It alleges the click sends data "not only to the relevant carrier... but also to multiple undisclosed third parties."

The case was filed in the U.S. District Court for the Northern District of California and assigned to U.S. Magistrate Judge Susan van Keulen in San Jose.

We first covered this case on our Google and UPS package tracking lawsuit page, which tracks its status. This article explains the complaint in more detail.

How Google package tracking works

Google announced package tracking in Search on December 5, 2019, in a post on its Search Central blog. The feature lets people check delivery status by searching for a tracking number instead of visiting a carrier's website first.

According to the complaint, the feature runs through a Google program for shipping carriers, which Google calls partners. Each carrier built a technical connection, known as an application programming interface (API), so Google could pull delivery status. The complaint says no carrier could join until Google reviewed and approved its setup. Google's current documentation says the program "is no longer accepting new partners."

The complaint quotes Google's own program requirements, which said Google did not accept "any personal data about the recipient or sender of the package" or "any geographical information" about them.

When a user clicks Track, the browser leaves Google and opens the carrier's tracking page. The lawsuit's central argument is that this step, which Google presents as sharing only a tracking number, loads a carrier web page filled with tracking code from many other companies.

Why a tracking number can be sensitive The complaint says anyone who enters a UPS tracking number on the UPS website can see the recipient's name, the locations of the sender and recipient, the tracking history, the type of service and whether the delivery address is residential. Sending the number along with a user's identifiers to advertising firms is part of what the plaintiffs say makes the alleged sharing harmful.

Who the parties are

The plaintiffs. Lennie Woodley lives in Huntington Park, California, and says he used the Google tracking box for UPS and FedEx packages during the past year. Joseph S. Schrant lives in Isleton, California, and says he used it for UPS, FedEx and U.S. Postal Service packages. Both say they read the "only your tracking number" message and would not have used the feature if they had known more data would be shared. The complaint stresses that neither is a "tester" or consumer advocate.

Google LLC. Google is a Delaware company headquartered in Mountain View, California. It runs Google Search and the advertising platforms DoubleClick and Google Analytics.

United Parcel Service of America, Inc. UPS is a Delaware corporation. Its website, ups.com, is the page users land on after clicking Track for a UPS package.

Not defendants. FedEx and the U.S. Postal Service are mentioned because the plaintiffs used the box for their packages, and the complaint describes FedEx data flows. Neither is sued.

What the complaint alleges

These are allegations that have not been tested in court.

Hundreds of requests from one click. The complaint says clicking Track for a UPS package caused the user's browser to send 415 separate network requests to at least 28 different web domains. Those domains include facebook.com, doubleclick.net, bing.com, demandbase.com, adsrvr.org (The Trade Desk), quantummetric.com, tealiumiq.com and yahoo.com, along with ups.com. For a FedEx package, it says one click caused 142 requests to at least 19 domains.

More than a tracking number. According to the complaint, the data sent to these companies included cookies and user identifiers, browsing and visit history, website interactions, typed input, device information, referring web addresses, session information and location, including whether the user was in California. It says this let the companies identify users and link their activity across websites.

Session recording. The complaint calls the data sent to Quantum Metric "particularly troubling." Quantum Metric sells "session replay" software, which it describes as letting a business "watch an end user's session as they experienced it, similar to how you watch a video." The complaint says that the moment a user landed on UPS's site from the Google box, code on the page began recording the user's screen and mouse movements and keyboard inputs and sent the recording to Quantum Metric in real time.

Google benefits too. The complaint says Google received personal and location data through its own DoubleClick and Google Analytics tools on the UPS page, despite telling carriers it would not accept such data. It argues Google and UPS both earn money from the data through advertising and analytics.

No disclosure. The plaintiffs say neither company told users about this sharing. Instead, they say, Google's message "affirmatively promise[d] that there will be no such data sharing."

The key date on the calendar The court has set an initial case management conference for January 12, 2027, at 9:30 a.m. by videoconference, with a joint case management statement due January 5. These are scheduling steps, not rulings on the claims, and they can move if the parties file early motions.

The legal claims

The complaint lists five claims.

Invasion of privacy under the California Constitution. California's constitution protects a right to privacy. To win, the plaintiffs must show a protected privacy interest, a reasonable expectation of privacy and a serious invasion. They argue Google's promise created that expectation.

Intrusion upon seclusion. This common-law claim covers highly offensive intrusions into private matters.

California Invasion of Privacy Act, Penal Code § 631. This wiretapping law bars reading or recording the contents of a communication without consent. It is brought for the California subclass only. Under Penal Code § 637.2, a person harmed can seek $5,000 per violation or three times actual damages, whichever is greater. California courts are divided on how this decades-old law applies to website tracking tools, which makes these claims a frequent subject of motions to dismiss.

Common-law fraud. The plaintiffs say the "only your tracking number" message was a false statement they relied on.

Unjust enrichment. They argue Google and UPS profited from data they obtained unfairly and should give up those profits.

The plaintiffs ask the court to certify the class and award compensatory, statutory, punitive and nominal damages, restitution, disgorgement, an injunction and attorneys' fees. The complaint says the amount in dispute exceeds $5 million, the threshold for bringing a class action in federal court under the Class Action Fairness Act.

Who may be affected

The proposed nationwide class covers all persons in the United States who used the Google Search package tracking box and clicked the Track button. The proposed California subclass covers class members who did so in California.

No sign-up is needed right now There is no claim form, settlement website or deadline in this case. Be cautious of any site or message that asks you to pay a fee or share sensitive details to "join" the Google and UPS lawsuit.

Being in a proposed class does not mean you will receive money. The court must first decide whether the case can go forward as a class action, and the plaintiffs must win or settle. If either happens, class members would normally receive notice explaining any next steps. You do not need to do anything now to stay in the proposed class.

If you want to keep records, a note of roughly when you used the Google tracking box and for which carriers may help if a claim process is ever set up. For other cases that are open now, see our list of class action cases you can join.

Timeline

Date	Event
December 5, 2019	Google announces package tracking in Search
October 9, 2026	Woodley and Schrant file Case No. 5:26-cv-11715 in San Jose
October 13, 2026	Court issues case schedule; clerk notes proposed summonses must be refiled
January 5, 2027	Joint case management statement due
January 12, 2027	Initial case management conference set for 9:30 a.m. by videoconference

What happens next

The court docket shows that on October 13, 2026, the clerk flagged an electronic filing error, saying the plaintiffs' proposed summonses could not be processed and had to be refiled. A summons is the formal notice that starts a defendant's deadline to respond, so Google and UPS's response dates depend on when they are served.

Once served, Google and UPS will likely respond to the complaint, often with a motion to dismiss some or all claims. Privacy class actions over website tracking frequently turn on whether users consented and whether a wiretapping law covers the data at issue.

The court has scheduled an initial case management conference for January 12, 2027, with a joint statement due January 5. Dates in federal cases often shift as the parties file motions.

What remains unclear

When Google and UPS were served. The docket did not show completed service when we checked.
How the companies will respond. Neither had addressed the claims in court or in public statements we could find.
Whether the tracking box has changed. The complaint does not say whether the alleged data flows continue today.
How many people used the feature. The complaint does not estimate class size.
Whether other carriers face claims. FedEx and USPS data flows are described, but those carriers are not defendants.
Whether the case will stay before a magistrate judge. Parties in the Northern District of California may decline to have a magistrate judge decide their case, which can lead to reassignment.

This article is for information only and is not legal advice.

Frequently asked questions

What is the Google UPS package tracking lawsuit about?

It claims the package tracking box in Google Search told users that only their tracking number would be sent to UPS, while clicking it actually sent browsing, device and location data to UPS and to advertising and analytics companies.

Who filed the lawsuit?

California residents Lennie Woodley and Joseph S. Schrant filed it on October 9, 2026, represented by Gutride Safier LLP. They seek to represent everyone in the United States who used the feature.

Is there a settlement or claim form?

No. The case was just filed, no class has been certified and there is no settlement, claim form or deadline.

What companies allegedly received the data?

The complaint names Meta (Facebook), Google's DoubleClick and Analytics platforms, Adobe, Microsoft Bing, Quantum Metric, The Trade Desk, Yahoo and others.

Does the case include FedEx or USPS packages?

The plaintiffs used the feature for FedEx and USPS packages too, and the complaint describes FedEx data flows. But only Google and UPS are defendants.

How much money could class members receive?

That is unknown. California's wiretapping law allows $5,000 per violation for the California subclass, but any payment depends on the court certifying a class and the plaintiffs winning or settling.