Blog post

Google reaches $392 million secrecy agreement over location data

Comment

Google has agreed to pay $391.5 million to 40 states to settle an investigation into its location practices, a coalition of state attorneys general announced Monday.

The investigation had focused on what Oregon Attorney General Ellen Rosenblum (D), one of the state’s law enforcement officers who led the investigation, called deceptive tactics and misleading about user location data. “Consumers thought they had turned off their location tracking features on Google, but the company continued to secretly record their movements and use that information for advertisers,” she said in a statement.

According to the coalition, the agreement was the largest such confidentiality agreement entered into by US attorneys general in US history. It also forces Google to “be more transparent about its practices,” the group said. The measures include banning Google from hiding “key location tracking information” and requiring the search giant to “provide users with detailed information about the types of location data” it collected and how they are used.

In a blog post, Google called the agreement “another step on the road to providing more meaningful choices and minimizing data collection while providing more useful services.”

Google spokesman José Castañeda said in a statement that the privacy issues have already been resolved. “In line with the improvements we have made over the past few years, we have settled this investigation which was based on outdated product policies that we changed years ago,” he said, adding that the settlement was intended to resolve the investigation and not a trial.

Arizona sues Google over allegations it illegally tracked locations of Android smartphone users

Google has been the subject of a legal review for an alleged violation of users’ privacy regarding location data. Last month, the company reached an $85 million settlement with Arizona, whose attorney general Mark Brnovich (R) alleged in a 2020 lawsuit that the tech company “engaged in deceptive and unfair practices towards users by tracking their location data even when the company has been ordered to stop.

In January, Texas, Indiana, Washington and the District of Columbia relied on Brnovich’s claims and filed individual lawsuits against Google for the alleged privacy violations. (The four states and DC were not part of the class whose settlement was announced on Monday.)

The state investigations and lawsuits were sparked by a 2018 Associated Press report that found that Google “records your movements even when you explicitly tell it not to.” Although Google Maps users have the option to opt out of tracking their location history, the company continues stored location data when consumers opened the Maps app or searched for something unrelated to location, the AP reported.

Google said at the time that it uses customer location data in a number of ways “to improve user experience, including: location history, web and app activity, and through device-level location services”. He added that consumers can “turn them on or off and delete their histories at any time.” The AP reported that it could be difficult and work-intensive.

In January, France fined Google more than $150 million for allegedly making it difficult to opt out of cookies, which track users’ web browsing.

Location information is often very sensitive, and “under certain circumstances, the availability of location information can jeopardize an individual’s personal safety,” said Eric Goldman, a law professor at Santa Clara University, whose the research focuses on the Internet and privacy.

For people seeking abortions, digital privacy is suddenly critical

After U.S. Supreme Court overruling Roe vs. Wade in June, privacy advocates warned that location data could be used against people seeking clandestine abortions. Google said after the court ruling that it would erase its users’ location history whenever they visit sensitive locations such as an abortion clinic.

Goldman said while it “makes sense” for attorneys general to sue Google over alleged privacy violations, recent state laws such as the California Privacy Rights Act (CPRA), passed by US voters state in 2020, “will restrict Google’s use of location information more severely than this regulation does.

The CPRA builds on a previous law, the California Consumer Privacy Act (CCPA), which took effect in 2020 and allowed consumers to ask companies to stop storing or selling their data. The CCPA was widely seen as setting a new national standard for data privacy; the CPRA added more protections and created a state agency to enforce the law.