internet user may well have known that, in browsing the internet, her URL information was sent to Google. But such a user would also reasonably expect that her activated cookie blocker meant her URL queries would not be associated with each other due to cookies.130 As the activated cookie blocker equates, in our view, to an express, clearly communicated denial of consent for installation of cookies, we find Google “intru[ded] upon reasonable expectations of privacy.”131 As for whether the alleged conduct is “so serious in nature[] [and] scope . . . as to constitute an egregious breach of the social norms,”132 Google not only contravened the cookie blockers—it held itself out as respecting the cookie blockers. Whether or not data-based targeting is the internet’s pole star, users are entitled to deny consent, and they are entitled to rely on the public promises of the companies they deal with. Furthermore, Google’s alleged conduct was broad, touching untold millions of internet users; it was surreptitious, surfacing only because of the independent 130 It is no matter whether or not a given plaintiff had actual, subjective knowledge of her browser settings and the impact of those settings on the defendants’ tracking practices. Like a principal’s agent, a personal computing device acts as an extension of oneself for purposes of engaging with the internet. The decision to use one or another technology is the decision to choose its features, even if the lay user may not actually know what all those features are in their specifics. 131 Hernandez, 211 P.3d at 1074. 132 Id. at 1073 (internal quotation marks omitted). 55