Google UPS Package Tracking Lawsuit, Woodley v. Google LLC Class Action Says “Track Your Package” Shared Your Data With Advertisers

Two California residents have filed a proposed class action against Google LLC and United Parcel Service of America, Inc. (UPS). They say the “Track your package” box on Google Search tells users that only their tracking number will be sent to the carrier, while clicking the Track button allegedly sends much more data to outside advertising and analytics companies.

The case is Woodley, et al. v. Google LLC, et al., Case No. 5:26-cv-11715, filed October 9, 2026 in the U.S. District Court for the Northern District of California.

These are allegations only. No class has been certified, and no court has found Google or UPS liable. As of the coverage reviewed, neither company had publicly responded to the complaint. There is no settlement, no claim form and no payout available right now. You do not need to do anything to be included in the proposed class.

Google UPS Package Tracking Lawsuit: Quick Facts

Detail	Information
Case name	Woodley, et al. v. Google LLC, et al.
Case number	5:26-cv-11715 (docket shows an “SVK” judge suffix)
Court	U.S. District Court, Northern District of California (San Jose)
Filed	October 9, 2026
Plaintiffs	Lennie Woodley (Huntington Park, CA) and Joseph S. Schrant (Isleton, CA)
Defendants	Google LLC; United Parcel Service of America, Inc.
Not defendants	FedEx and the U.S. Postal Service (mentioned in the complaint only)
Plaintiffs’ counsel	Gutride Safier LLP (Seth A. Safier, Marie A. McCrary, Todd Kennedy)
Main allegation	The widget’s “Only your tracking number will be sent” statement was false because other data allegedly went to third parties
Reported UPS test	415 network requests to at least 28 domains
Reported FedEx test	142 network requests to at least 19 domains
Claims	Wiretapping (California Invasion of Privacy Act), invasion of privacy, intrusion upon seclusion, fraud/deceit/misrepresentation, unjust enrichment
Class status	Proposed; not certified
Docket activity as of Oct. 12	Complaint (88 pages), civil cover sheet and proposed summonses; no responses yet
Settlement or settlement website	None
Claim form	None
Official case document	88-page complaint, Dkt. No. 1 (N.D. Cal. docket; also posted at classaction.org/media/google–ups-complaint.pdf)

What Does the Lawsuit Say Happened?

When someone searches a tracking number on Google, a “Track your package” box can appear. For UPS packages, the complaint says it states: “Only your tracking number will be sent to UPS.”

The plaintiffs say that was not true. According to the complaint, pressing the Track button sent “massive amounts of data” to outside companies including Adobe, Meta, Microsoft, The Trade Desk and Yahoo, and also involved Google’s own Analytics and DoubleClick services and others such as Quantum Metric and Tealium. The data allegedly included:

• IP addresses, browser and device details
• Cookies and persistent user identifiers
• Referring URLs and session information
• Browsing history and website interactions
• User inputs, interests and preferences
• Demographic and geolocation information
• Package tracking numbers in some requests

The complaint alleges that a UPS tracking search triggered 415 network requests to at least 28 domains, and a FedEx search triggered 142 requests to at least 19 domains.

Who is blamed for what

• Google: The plaintiffs say Google wrote the widget and its “only your tracking number” statement, and that its code sent UPS the user’s IP address, cookies, referrer and browser details along with the tracking number.
• UPS: The plaintiffs say UPS installed third-party tracking code on its website that ran as soon as a user arrived from the Track button, and that it knowingly helped by configuring its site to send extra data.

The complaint also points to Google’s carrier requirements, which reportedly say Google does not accept personal or geographic data about a package’s sender or recipient. The plaintiffs allege Google nonetheless received such data through Analytics and DoubleClick.

Both plaintiffs say they would not have used the tool had they known their information would be shared.

What 415 requests does and does not mean

A “network request” is a technical event. 415 requests does not mean 415 companies each got all your data. What each request carried, who received it and whether it was unlawful are separate questions the court has not decided. The technical analysis is the plaintiffs’ allegation, not a finding.

Why a tracking number can be sensitive

The complaint alleges that with a UPS tracking number, a person may be able to see details such as recipient name, origin and destination, tracking history and whether the address is residential. Combined with browser identifiers, the plaintiffs argue, this can help link a shipment to a person. How sensitive the data really was, and what each recipient actually received, will be contested.

Who Could Be in the Proposed Class?

The plaintiffs ask the court to certify two groups:

• Nationwide class: Everyone in the United States who used the “Track your package” box on Google Search and clicked or pressed the Track button.
• California subclass: People in that class who did so while located in California.

The definition does not mention a UPS account and is not limited to one carrier. The named plaintiffs describe using the feature for UPS, FedEx and (for Schrant) USPS packages. Even so, FedEx and USPS are not defendants.

Being described in a proposed class does not entitle anyone to money. The court may narrow, change or reject the definitions, or the case may be dismissed or settled first.

Related article: BarkBox Putative Class Action, “Internal Use Only” Employee Discount Emails Allegedly Misled Washington Shoppers Under CEMA

Legal Claims in the Complaint

1. California Invasion of Privacy Act (CIPA), Penal Code § 631

CIPA’s wiretapping provision prohibits, among other things, intentionally tapping or connecting to a communication line, or willfully reading or learning the contents of a communication in transit without the consent of all parties, and aiding or conspiring with others to do so. The plaintiffs say the tracking setup caused their communications and data to be transmitted to third parties without consent.

Expect the defendants to raise defenses that have been central in recent CIPA website-tracking cases:

• Party exception: A party to a communication generally cannot “wiretap” it. Courts have split on whether embedded third-party vendors are separate eavesdroppers or merely an extension of the website.
• Consent: Whether users were told about the data flows.
• “Contents”: Whether the data was the contents of a communication or only record information such as device details.

Civil damages: Penal Code § 637.2 lets a person injured by a violation seek the greater of $5,000 per violation or three times actual damages, plus injunctive relief. That is a requested remedy, not a guaranteed payout. A court decides whether the claim succeeds and how violations are counted. The 415 requests will not automatically become 415 separate $5,000 awards.

2. Invasion of privacy (California Constitution, Article I, § 1, and common law)

California recognizes privacy as an inalienable right. These claims generally require a legally protected privacy interest, a reasonable expectation of privacy, and a serious, highly offensive intrusion. The plaintiffs argue users reasonably expected only their tracking number to be sent.

3. Intrusion upon seclusion

This claim requires an intentional intrusion into a private matter in a way that would be highly offensive to a reasonable person. Whether routine analytics-type data flows meet that standard is a common battleground.

4. Fraud, deceit and misrepresentation

Based on the “only your tracking number” statement. Fraud generally requires a false representation, knowledge, intent to induce reliance, actual reliance and resulting harm, and must be pleaded with particularity under Federal Rule of Civil Procedure 9(b). This claim is brought for the nationwide class.

5. Unjust enrichment

The plaintiffs seek restitution of benefits the defendants allegedly gained from the data. Courts in California have differed on whether unjust enrichment is a stand-alone cause of action.

How Much Money Could Be at Stake?

The complaint asks for compensatory, statutory, punitive and nominal damages, restitution, an order stopping the alleged conduct, and attorneys’ fees and costs. None has been awarded. If the plaintiffs win or settle, any payment would depend on which claims survive, the evidence, class certification and the remedies the law allows. No amount, claims administrator or deadline exists.

Legal Hurdles the Case Will Face

• Federal court basis: The docket lists diversity jurisdiction under 28 U.S.C. § 1332, which for class actions generally means the Class Action Fairness Act (§ 1332(d)): at least $5 million in controversy, at least 100 class members and minimal diversity.
• Article III standing: Plaintiffs must show a concrete injury. After TransUnion LLC v. Ramirez (2021), courts have dismissed some online-tracking suits for lack of concrete harm. In 2025 the Ninth Circuit applied that reasoning to a session-replay wiretap claim in Popa v. Microsoft. Expect standing to be argued.
• Motion to dismiss: Under Rule 12(b)(6), defendants commonly challenge whether the facts state a claim. A defendant normally has 21 days after being served to respond (60 days if service is waived), though extensions are common.
• Class certification (Rule 23): The court must find numerosity, common questions, typical claims and adequate representation (Rule 23(a)), and for damages classes that common issues predominate (Rule 23(b)(3)). Differences in what each user saw, consented to or had stored in cookies can make certification harder.
• Settlement approval (Rule 23(e)): Any settlement binding class members needs court approval after notice to the class.
• Limitation periods: Courts generally apply a one-year period to CIPA statutory-penalty claims, with some applying two years. Privacy torts are typically two years (Code of Civil Procedure § 335.1) and fraud three years (§ 338(d)). The widget has reportedly existed since 2019, so timing may be argued.
• Terms of service: The defendants may point to the terms and privacy policies users accepted.
• Related litigation: Google has faced other California privacy cases over data collection, including Rodriguez v. Google LLC, in which a jury returned a verdict against Google in 2025. Those cases involve different facts and say nothing about the merits here.

What About the California Consumer Privacy Act?

The CCPA and CPRA create consumer rights to know, delete, correct and opt out of certain sharing and sales, but private lawsuits under them are limited to specific data breaches (Civil Code § 1798.150). Enforcement of other provisions rests with the California Attorney General and the California Privacy Protection Agency. The Woodley complaint instead uses CIPA and common-law claims.

What Should You Do Now?

You do not need to file anything. There is no official claim process. If you want to protect your privacy and your options:

1. Track on the carrier’s own site or app instead of the Google box. That avoids the widget, though the carrier’s own site may use analytics too.
2. Keep tracking numbers private. Do not post them publicly, because they can expose delivery details.
3. Review browser privacy settings. Limit third-party cookies and use tracking-protection features, knowing they do not block everything.
4. Keep simple records if you wish: the approximate date, carrier and any screenshots of the notice you relied on. Do not share tracking numbers or private delivery details publicly.
5. Beware of claim scams. Do not enter personal information on any site that promises payments in this case. No settlement website exists.
6. Consider legal advice. If you believe you were harmed, a licensed attorney can explain your options.

What Happens Next?

1. Google and UPS respond, likely with motions to dismiss some or all claims.
2. The court rules on the pleadings. Claims may be dismissed, narrowed or allowed to proceed.
3. If claims survive, the parties exchange discovery, including technical evidence about the data flows.
4. The plaintiffs move for class certification.
5. The case may be dismissed, settled with court approval or proceed to summary judgment or trial.

As of October 23, 2026, the public docket reviewed (last updated October 12) showed only the complaint, a civil cover sheet and proposed summonses. AllAboutLawyer.com will update this page if a settlement is announced or the court rules on key motions.

Key Dates

Date	Event
Late 2019	Google announces its Package Tracking Early Access Program, according to the complaint
Oct. 9, 2026	Complaint and proposed summonses filed
Oct. 13, 2026	Daily Journal reports on the suit
Oct. 2026	MediaPost, ClaimDepot and Open Class Actions publish coverage; no response from Google or UPS reported
Oct. 23, 2026	No settlement, certified class or court ruling verified

Frequently Asked Questions

Is the Google and UPS package tracking lawsuit real?

Yes. Woodley v. Google LLC, No. 5:26-cv-11715, was filed October 9, 2026 in the Northern District of California. The allegations have not been proven.

Can I file a claim?

No. There is no settlement or claim form. Be cautious of any site that says otherwise.

Who is in the proposed class?

Everyone in the U.S. who used Google’s “Track your package” box and clicked Track, plus a California subclass. The court may change this.

Do I need a UPS account?

The proposed definition does not require one. The court could narrow it.

Are FedEx and USPS being sued?

No. Only Google LLC and UPS are named defendants.

Does the lawsuit prove Google or UPS broke the law?

No. A judge has not ruled on any claim.

Could I get $5,000?

The complaint seeks statutory damages under Penal Code § 637.2 (the greater of $5,000 per violation or three times actual damages). That is a requested remedy, not a promise to class members. Any payment would depend on the court and on any settlement terms.

What have Google and UPS said?

Neither had publicly responded in the coverage reviewed.

How can I follow the case?

Check the Northern District of California docket for Case No. 5:26-cv-11715 through PACER, and watch for updates on this page.

This article describes allegations in a legal complaint and is general consumer information, not legal advice. Google and UPS have not been found liable, the proposed class has not been certified, and no settlement or consumer claim process exists. AllAboutLawyer.com is not a law firm. Laws and court rules may change.

Related Reading

• Capital One Data Tracking Lawsuit: They Secretly Sent Your Financial Data to Meta and Google, Lawsuit Alleges (AllAboutLawyer.com)
• OpenAI Class Action Lawsuit: ChatGPT Allegedly Sent Your Private Queries to Meta and Google (AllAboutLawyer.com)
• Google Web & App Activity Lawsuit: Is Rodriguez v. Google LLC a Scam or Legit? (AllAboutLawyer.com)

Sources

1. Complaint, Woodley, et al. v. Google LLC, et al., No. 5:26-cv-11715 (N.D. Cal. filed Oct. 9, 2026), Dkt. No. 1
2. Court docket for No. 5:26-cv-11715, via PacerMonitor (updated Oct. 12, 2026)
3. MediaPost: Google, UPS Hit With Privacy Suit Over Package Tracking
4. Daily Journal, Oct. 13, 2026: Google, UPS sued over alleged data sharing through package tracking tool
5. ClaimDepot: Google, UPS lawsuit alleges package tracking widget secretly shared consumer data with dozens of companies
6. Open Class Actions: Google, UPS package tracking privacy class action lawsuit
7. California Penal Code §§ 631, 637.2; California Constitution, Art. I, § 1; California Civil Code § 1798.150; Code of Civil Procedure §§ 335.1, 338 (leginfo.legislature.ca.gov)
8. Federal Rules of Civil Procedure 9(b), 12, 23; 28 U.S.C. § 1332(d) (uscourts.gov; uscode.house.gov)
9. TransUnion LLC v. Ramirez, 594 U.S. 413 (2021); Popa v. Microsoft Corp. (9th Cir. 2025)