A bipartisan group of Attorney Generals in the United States is suing Google for allegedly tracking its users’ location data even when they believed they had opted out – saying January 24 that the advertising giant was using “deceptive and unfair practices to obtain valuable consumer location data”.
"Because location data is immensely valuable to the Company, Google makes extensive use of dark patterns, including repeated nudging, misleading pressure tactics, and evasive and deceptive descriptions of location features and settings, to cause users to provide more and more location data (inadvertently or out of frustration)" the complaint alleges. ("Dark patterns" are deceptive design choices that "alter the user’s decision-making for the designer’s benefit and to the user’s detriment", the complaint explains.)
DC Attorney General Karl Racine said Monday that his office was “suing Google for deceiving users and invading their privacy. Google claims that changing your device and account settings protects your data.
"The truth is, since 2014, Google has systematically surveilled users no matter what settings they choose” he added, vowing to end the use of “dark patterns” and “claw back profits made from location data.”
The case, brought by the District of Columbia, alleges breach of the Consumer Protection Procedure Act and claims jurisdiction by the D.C. Code § 13- 423(a) and violation of D.C. Codes §§ 28-3904(f) and (f-1) pertaining to unfair or deceptive trade practices ("fail[ure] to state a material fact if such failure tends to mislead; (f-1) [u]se innuendo or ambiguity as to a material fact, which has a tendency to mislead."
Google sued over location data collection
“Consumers who use Google products cannot prevent Google from collecting, storing, and profiting from their location” the complaint claims.
Noting that the issue was initially flagged by AP reporting in August 2018 (which revealed that even when consumers explicitly opted out of location tracking by turning the Location History setting off, Google recorded consumers’ locations via other means, including via a separate setting called “Web & App Activity”) the plaintiffs say their investigation revealed that Google “also offers other settings that purport to give consumers control over the location data Google collects and uses.
"But Google’s misleading, ambiguous, and incomplete descriptions of these settings all but guarantee that consumers will not understand when their location is collected and retained by Google…”
"From at least 2014 to at least 2019, Google made misrepresentations regarding how the Location History and Web & App Activity settings used and collected location data", the writ – which includes heavily redacted sections about Google’s data collection processes – alleges, noting that the 2018 AP story precipitated a self-titled "oh shit" meeting at Google during which employers admitted that disclosures around location data were "definitely confusing".
"The Attorneys General are bringing a case based on inaccurate claims and outdated assertions about our settings. We have always built privacy features into our products and provided robust controls for location data. We will vigorously defend ourselves and set the record straight" said Google Spokesperson José Castañeda.
The company says that it has made a number of changes in recent years to avoid unwanted location data harvesting, including the launch of auto-delete controls in June 2019 to help people automatically delete their location data on a rolling basis, the arrival of Incognito Mode in Google Maps and the later move in June 2020 to make auto-delete the default setting for all new Google Accounts - "meaning that any activity data older than 18 months is automatically deleted for more than two billion people every day."
The company also claims to have rolled out a "major backend change that prevents precise location information from being stored when people Search on Google - while continuing to provide highly relevant local results. Now, Google always estimates the general area, as opposed to the precise location you’re searching from. This area spans the size of a small town and includes at least 1,000 people to protect user privacy."
While the complaint is explicit about many of the alleged breaches taking place up until 2018, in one partially redacted passage it does explicitly state that "2014 through the present, Google has deceived users by failing to disclose that regardless of whether the user explicitly forbids Google from accessing location via a device, Google derives and stores the user’s location and [REDACTED]."
(Privacy experts who know what has been redacted above get in touch.)
More detail to follow.
