A federal judge has rejected Google’s bid to dismiss a privacy lawsuit claiming it commingled user data across different products and disclosed that data to advertisers without permission.
Saying his decision was a close call, U.S. District Judge Paul Grewal in San Jose, Calif., ruled on Monday night that Google must face breach of contract and fraud claims by users of Android-powered devices who had downloaded at least one Android application through Google Play.
“Like Rocky rising from Apollo’s uppercut in the 14th round, plaintiffs’ complaint has sustained much damage but just manages to stand,” Grewal wrote in a 28-page decision. Grewal had dismissed two earlier versions of the lawsuit.
Google did not immediately respond on Tuesday to a request for comment. Mark Gardy and Joseph Sabella, lawyers for the plaintiffs, did not immediately respond to similar requests.
The lawsuit arose after Google on March 1, 2012, scrapped a variety of privacy policies for different products, and created a single, unified policy letting it merge user data generated through platforms such as Gmail, Google Maps and YouTube.
Users complained that Google made this change without their consent, and with no way to opt out, in a bid to better compete for ad revenue against Facebook and other social media companies “where all of a consumer’s personal information is available in one site.”
They said this jeopardized their privacy by exposing names, email addresses and geographic locations, increasing the threat of harassment or identity theft by third parties.
Google reported $15.42 billion of revenue in the first quarter, of which 90 percent came from advertising.
This article originally appeared on Recode.net.