Google and UPS package tracking privacy lawsuit

Two California residents filed a proposed class action on October 9, 2026, alleging that Google Search's "Track your package" feature sends far more than a tracking number when a user clicks Track. The case is Woodley v. Google LLC, No. 5:26-cv-11715, in the U.S. District Court for the Northern District of California. It names Google LLC and United Parcel Service of America, Inc. as defendants.

The complaint says the widget tells users "Only your tracking number will be sent to UPS," yet clicking Track loads the UPS website, which the plaintiffs say sends data to advertising and analytics companies. The proposed class covers anyone in the United States who used the widget on Google Search and clicked Track, whatever the carrier. Google and UPS had not publicly responded when this article was checked. No court has ruled, and there is no settlement or claim form.

The plaintiffs are Lennie Woodley of Huntington Park, California, and Joseph S. Schrant of Isleton, California. The complaint says Woodley used the widget to track UPS and FedEx packages, and Schrant used it for UPS, FedEx and USPS packages, while in California during the past year.

Google LLC is a Delaware limited liability company based in Mountain View, California, that runs Google Search. United Parcel Service of America, Inc. is a Delaware corporation based in Atlanta. FedEx and USPS are discussed in the complaint but are not defendants.

The plaintiffs are represented by Gutride Safier LLP of San Francisco, including Seth A. Safier, Marie A. McCrary and Todd Kennedy. The case number's "SVK" suffix and the CourtListener docket show assignment to Magistrate Judge Susan van Keulen.

According to the complaint, Google announced a "Package Tracking Early Access Program" in late 2019 so shipping companies could show delivery status directly in Search results. Carriers had to build an interface that received tracking numbers from Google and returned package status. The complaint says Google reviewed and approved each carrier's integration before it went live, and that Google's own program requirements said it would not accept personal or geographic information about a package's sender or recipient.

When a user types a tracking number into Google Search, the widget appears near the top of the results with a Track button. The complaint quotes the widget's promise that "Only your tracking number will be sent" to the selected carrier.

The plaintiffs allege that promise is false. Their complaint says clicking Track for a UPS package caused the user's browser to send 415 separate network requests to UPS and at least 28 domains. It says a FedEx click caused 142 requests to at least 19 domains. The named recipients include Meta's Facebook, Google's DoubleClick advertising platform and Google Analytics, Adobe, Microsoft Bing, Quantum Metric, The Trade Desk, Yahoo and Tealium.

The complaint says the UPS site sends session replay data to Quantum Metric, software that can reconstruct how a visitor moves through a page "similar to how you watch a video." It also says a UPS tracking number itself reveals the recipient's name, the sender's and recipient's locations, the tracking history, the service type and whether the delivery address is residential. The plaintiffs allege the outside companies use this data to build consumer profiles and audience segments and to target ads.

The plaintiffs say Google and UPS made a specific privacy promise, broke it and let third parties intercept private communications without consent. They also say Google approved the UPS integration knowing it did not match the widget's wording. These are allegations that have not been tested.

Google and UPS had not responded to the lawsuit in court or in public statements found on October 15, 2026. MediaPost reported that neither company had answered its request for comment. Nothing in this article should be read as an admission by either company.

The court has decided nothing. It has not found that any data was shared improperly, has not certified a class and has not ruled on whether the widget's wording created a binding promise. The defendants have not yet filed an answer or a motion to dismiss.

The proposed nationwide class is all persons who used the "Track your package" widget on Google Search, in the United States, and clicked or pressed the Track button. A proposed California Subclass covers class members who did so while located in California.

Three points matter. The class is not limited to UPS packages; the wording covers any Track click, including FedEx and USPS. Location in California matters for the wiretapping claim, which is brought for the subclass. And these definitions are proposals that the court may narrow or reject.

There is nothing to file. If you use Google Search to track packages, note roughly when and for which carriers. You can review the activity history in your Google account and the privacy settings in your browser.

People with questions can contact Gutride Safier at (415) 639-9090 or speak with their own lawyer. A Class Action Pulse inquiry is only an inquiry; it does not join the lawsuit or create representation.

No money is available. The complaint asks for compensatory, statutory, punitive and nominal damages, restitution, disgorgement of profits, an injunction and attorneys' fees. For the California Subclass, it seeks statutory damages under the California Invasion of Privacy Act of the greater of $5,000 or three times actual damages for each violation. These are requests, not awards, and courts often treat per-violation demands differently at settlement.

• Late 2019: Google announces the Package Tracking Early Access Program, according to the complaint.
• October 9, 2026: complaint filed in San Jose.
• October 15, 2026: no response from Google or UPS found.

There is no claim, exclusion or objection deadline. Those rights arise only if a class is certified or a settlement is proposed.

A network request is a message a browser sends to a server, such as a request for a script, image or tracking pixel. Session replay is software that records clicks, scrolling and typing so a website can replay a visit. The California Invasion of Privacy Act (CIPA) section 631 bars reading or learning the contents of a communication without consent of all parties. Intrusion upon seclusion is a privacy claim for highly offensive intrusion into private matters. Unjust enrichment is a claim that a party kept a benefit that in fairness belongs to someone else.

Google and UPS must be served and respond. Defendants in browser-tracking cases often move to dismiss, arguing users consented or that no communication contents were intercepted. A magistrate judge can preside over the whole case only if all parties consent, so the assignment may change.

A practical note: if you track packages often, a quick look at your browser's privacy settings now gives you a record of how they were set before any changes the case might prompt.

The complaint supports the parties, the program history, the widget wording, the request counts, the named third parties, the class definitions, the claims and the requested relief. CourtListener supports the filing date and docket. MediaPost supports the absence of company comment. The network counts reflect the plaintiffs' testing and have not been verified by the court or by Class Action Pulse.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.