wordpress blog stats
Connect with us

Hi, what are you looking for?

Deep Dive: Google sued for deceptively collecting user location data and using it for targeted ads

The lawsuit points out how Google uses dark patterns to gather user location data, while at the same time portraying itself as privacy-focused company.

“Since at least 2014, Google has deceived consumers regarding how their location is tracked and used by the company and consumers’ ability to protect their privacy by stopping this tracking. Google leads consumers to believe that consumers are in control of whether Google collects and retains information about their location and how that information is used. In reality, consumers who use Google products cannot prevent Google from collecting, storing, and profiting from their location,” a lawsuit filed by the District of Columbia alleged. Attorneys general from Texas, Washington, and Indiana also filed similar suits in their own states.

Google’s major source of revenue is digital advertising and to support this “lucrative arm of its business,” it harvests consumers’ location data and uses it for targeted advertising, the lawsuit adds.

This lawsuit builds on one filed by Arizona in 2020 and is one of the many lawsuits that Google is facing. The other major suit is against Google’s ad practices filed by seventeen US states, which we’ve covered in a four-part series.

In a statement to The Verge, Google denied the claims in the lawsuit and said:

“The attorneys general are bringing a case based on inaccurate claims and outdated assertions about our settings. We have always built privacy features into our products and provided robust controls for location data.”

What are the allegations against Google?

1. Google’s business model relies on constant surveillance of Google users

“Google is an advertising company, but its business is user data,” the lawsuit states while explaining that the company collects and analyses the personal data of billions of people to build user profiles and provide analytics that supports Google’s digital advertising business, which generated $150 billion in revenue in 2020.

Advertisement. Scroll to continue reading.
  1. How Google collects location data
    1. Through Android: The lawsuit alleges that much of Google’s location data collection occurs through Google’s Android operating system, which is on the majority of smartphones in the US. “Through sensors and APIs installed on Android devices, Google can track the precise location of a device on a continuous basis, using GPS coordinates, cell tower data, Wi-Fi signals, and other signals that the device transmits to Google,” lawsuit claims.
    2. Through Google Apps: Google also collects location data through other its apps and web-based services, such as Google Search, Google Maps, Chrome, YouTube, Google Play Store, and Google Assistant, which are available for both Android and iOS, the lawsuit states.
      1. Data collected even when not necessary: “Google collects and stores users’ location data when they interact with certain Google apps and services, even when a user’s location is not needed to support the core functionality of the app or service,” the lawsuit alleges.
      2. Multiple prompts to provide location access: When it comes to Android devices, certain Google apps are granted permission to collect users’ location data by default while other Google apps ask permission from users. If a user declines to grant permission, the may continue to prompt the user to enable location permission, the lawsuit stated. These apps continue to transmit that data to Google unless the user remembers to revoke permission. 
      3. Some location data is obtained even when overall location sharing is disabled: Although Android allows users to disable all location sharing with a “master switch,” this will disallow the user from using any apps that need locations, such as Uber, the lawsuit states. But even with this, Google gets the approximate location from IP address.
  2. Why location data is highly valuable to Google

“Some Google consumer products can be used at no direct financial cost to the consumer, but that does not mean that Google provides these products for free. Google collects exhaustive personal data about its users when they engage with these products. Google then processes this data to draw inferences about users that it monetizes through advertising.” – Lawsuit

    1. Location-data makes for more effective advertising: According to the lawsuit, Google actively publicizes its ability to provide more effective advertising through geo-targeting and location-based analytics.
    2. Multiple deceptive tactics to get location data: Since location data is key to Google, the company “has employed and continues to employ a number of deceptive and unfair practices to obtain users’ “consent” to be tracked and to make it nearly impossible for users to stop Google from collecting their location data. These practices include privacy-intrusive default location settings, hard-to-find location settings, misleading descriptions of location settings, repeated nudging to enable location settings, and incomplete disclosures of Google’s location data collection and processing,” the lawsuit alleges. 

2. Google users must navigate numerous, conflicting controls to protect their location data

“Google users must navigate numerous, conflicting settings that supposedly control when and how Google collects, stores, and uses their location information,” the lawsuit alleged. These settings can be classified into two categories:

  1. Location-related Google Account Settings: These settings apply to data collected from any device that is signed in to a Google Account. There are three independents settings here:
    1. Location History: This captures all the places a Google user goes to and allows Google to build a “private map” that users can review and edit, the lawsuit explains. This is a significant data source for Google. For example, Google uses this data “to provide advertisers with “store conversion” rates—i.e., the number of users who have viewed ads and then visited the advertised store,” the lawsuit claims. “Google’s ability to track users’ physical locations after they click on digital ads is a unique selling point for its advertising business,” the lawsuit adds.
    2. Web & App Activity: This is related to a user’s “transactional location,” which is the location of a signed-in user’s device when the user interacts with certain Google products, the lawsuit states. “For example, when a signed-in user conducts a search for “chocolate chip cookie recipe” on the Google Search app, Google collects the user’s location at the time of the search, along with details about the search, and stores that information to the user’s Web & App Activity log,” the lawsuit explains.
    3. Google Ad Personalization (GAP): This setting provides signed-in users with the ability to opt-out of personalized ads served by Google. “However, Google continues to target ads to a user based on a user’s location even if the user opts out of ads personalization by disabling the GAP setting,” the lawsuit alleged.
  2. Location-related device settings: These settings apply only to the specific device on which the setting appears and do not require a user to be signed in to a Google Account. According to the lawsuit, Android devices have multiple location-related device settings:
    1. Location master-switch: Android has a location “master switch” that can be used to prevent any apps or services from accessing data from the device’s location sensors. When this switch is enabled, it allows Google to periodically collect and use location from the user’s device in order to improve Google Location Services, the lawsuit states.
    2. App-specific location settings: The user can also go to an app’ specific location setting and grant or deny it permission to access location data.
    3. Other settings: Other features like scanning for nearby WiFi points or Bluetooth devices, as well as “low battery” mode also impact location data collection.

3. Google deceives users regarding their ability to protect their privacy through Google Account Settings

  1. Google misrepresented and omitted facts regarding the Location History and Web & App Activity Settings: The lawsuit alleges that from 2014 to 2019, Google had a public webpage which claimed that turning off Location History stopped the collection of new location information, but this was deceptive because even with Location History off, Google collected location data through other means such as Web & App Activity. “Google’s statements prompting users to turn on Location History deceptively implied that this setting alone allowed Google to store a user’s location,” the lawsuit alleges. A 2018 AP story revealed that Google captured almost two dozen precise, time-stamped GPS coordinates when Web & App Activity was enabled but Location History was disabled the lawsuit states. Following this revelation, “in internal discussions, Google employees agreed that Google’s disclosures regarding Location History were “definitely confusing” and that the user interface for Google Account settings “feels like it is designed to make things possible, yet difficult enough that people won’t figure it out,”” the lawsuit states. Furthermore, the lawsuit alleges that Google concealed from users that the Web & App Activity setting controlled Google’s storage and use of their location information in at least three ways:
    1. Not disclosing Web & App Activity setting when users sign up: Until 2018, Google did not disclose the Web & App Activity setting when users set up Google Accounts for the first time and turned on the setting by default.
    2. Not disclosing the Web & App Activity setting to users when they set up new devices using existing Google Accounts: The Web & App Activity setting applies to all devices signed in to the user’s Google Account. And because most Android users sign in to their Google accounts, this allowed Google to begin tracking that device as long, the lawsuit alleges.
    3. Users unlikely to discover the location tracking nature of Web & App Activity setting: Google did not identify Web & App Activity as a location-related setting in the places where a user would expect to find that information, the lawsuit claims. For example, “until around 2019, users who explored location settings on their Android devices would not find Web & App Activity listed among them,” the lawsuit gave as one of the many examples.
  2. Google misrepresent and omits facts regarding users’ ability to control their privacy through Google Account Settings: “Google offers simple “privacy controls” to attract users but continues to exploit users’ location data regardless of their choices with respect to these settings,” the lawsuit alleges. The lawsuit claims that Google has been making misleading promises since 2014 saying users can control the information Google collects about them by adjusting settings, but this is not true because “regardless of whether the user has disabled Web & App Activity or Location History, Google collects, stores, and uses location data when a user uses certain Google products.” Furthermore, Google only provides partial visibility into the location data Google collects about them, the lawsuit adds.
  3. Google misrepresented and omitted facts regarding the Google Ad Personalization Setting: “Google’s disclosure misleads consumers to believe they can turn off the GAP setting to prevent Google from using location data to show personalized ads. But this setting only provides an illusion of control. In reality, Google continues to target ads based on a user’s location—both on and off Google products—even if the user opts out of ads personalization by disabling the GAP setting,” the lawsuit alleges. 

4. Google deceives users regarding their ability to protect their privacy through device settings

Arguing that Google misrepresents the ability of users to control or limit collection location data through their device settings, the lawsuit gives the following three examples:

  1. Inferring location through IP address even with location sharing disabled: Google tells users that they can completely control their location sharing with the master-switch feature on Android devices, but even if users turn off location sharing Google still derives and stores user location by inferring location from IP address.
  2. App-specific setting does not apply to Google: Android phones allow users to turn off location for specific apps but even if users turn off location for Google apps, the company still deduces a user’s location, the lawsuit claims.
  3. Settings are confusing and conflicting: “Device settings related to specific location signals on Android phones, such as Wi-Fi and Bluetooth, are confusing and conflicting, making it very challenging for users to limit Google’s access to this data. For example, Google uses Wi-Fi scans to compute device locations more accurately and precisely. Android phones include a “Wi-Fi scanning” setting among other location-related settings. However, even if a user toggles this setting “off,” Google can still obtain Wi-Fi scans from the user’s device, the lawsuit states.

“Simply put, even when a user’s mobile device is set to deny Google access to location data, the Company finds a way to continue to ascertain the user’s location. […]  As one Google employee put it, ‘Real people just think in terms of ‘location is on,’ ‘location is off’ because that’s exactly what you have on the front screen of your phone.’” – Lawsuit

5. Google uses deceptive practices that undermine users’ ability to make informed choices about their data

Google makes it difficult for users to decline location tracking or to evaluate the data collection and processing to which they are consenting by using dark patterns, the lawsuit alleges.

“Dark patterns are deceptive design choices that alter the user’s decision-making for the designer’s benefit and to the user’s detriment. Dark patterns take advantage of behavioral tendencies to manipulate users into actions that are harmful to users or contrary to their intent.” – Lawsuit

  1. Dark patterns in Google Account Settings: The lawsuit lists various examples of dark patterns that Google deploys in Google Account Settings. For example, Google’s decision to enable the privacy-intrusive Web & App Activity feature by default, while failing to disclose this setting. Another common use of dark patterns is prompts on Google apps indicating that the Location History feature must be turned on for users to use the app or for optimal functionality, even if the app can function without it. Google also repeatedly asks users to give location permission even if the user has already refused consent. “By repeatedly ‘nudging’ users to enable Google Account settings, Google increases the chances that a user will enable the setting inadvertently or out of frustration,” the lawsuit states.
  2. Dark patterns in Device Settings: Similar dark patterns apply to Android devices, the lawsuit states. For example, if a user turns off location sharing using the master switch, users are subject to repeated prompting to re-enable location when using a Google app. The lawsuit also alleges that Google removed the location master switch button from the easily accessible pull-down menu on some of the devices it manufactured.

“Because location data is immensely valuable to the Company, Google makes extensive use of dark patterns, including repeated nudging, misleading pressure tactics, and evasive and deceptive descriptions of location features and settings, to cause users to provide more and more location data (inadvertently or out of frustration).” – Lawsuit

What does the lawsuit seek?

In its prayer for relief, the lawsuit requests that the Court enter judgment against Google and in favour of District of Columbia as follows:

  1. Permanently enjoining Google from violating the District of Columbia’s Consumer Protection Procedures Act (CCPA)
  2. Order the disgorgement of monies, property, or data (including any algorithms developed using such data) from Google based on its unlawful conduct and/or ordering Google to pay damages and restitution
  3. Award civil penalties in an amount to be proven at trial and as authorized per violation of the CPPA
  4. Award the District the costs of this action and reasonable attorney’s fees
  5. Granting such further relief as the Court deems just and proper

Also Read

Written By

MediaNama’s mission is to help build a digital ecosystem which is open, fair, global and competitive.

Views

News

Looking at the definition of health data, it is difficult to verify whether health IDs are covered by the Bill.

News

The accession to the Convention brings many advantages, but it could complicate the Brazilian stance at the BRICS and UN levels.

News

In light of the state's emerging digital healthcare apparatus, how does Clause 12 alter the consent and purpose limitation model?

News

The collective implication of leaving out ‘proportionality’ from Clause 12 is to provide very wide discretionary powers to the state.

News

The latest draft is also problematic for companies or service providers that have nothing to with children's data.

You May Also Like

News

Google has released a Google Travel Trends Report which states that branded budget hotel search queries grew 179% year over year (YOY) in India, in...

Advert

135 job openings in over 60 companies are listed at our free Digital and Mobile Job Board: If you’re looking for a job, or...

News

Rajesh Kumar* doesn’t have many enemies in life. But, Uber, for which he drives a cab everyday, is starting to look like one, he...

News

By Aroon Deep and Aditya Chunduru You’re reading it here first: Twitter has complied with government requests to censor 52 tweets that mostly criticised...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to our daily newsletter
Name:*
Your email address:*
*
Please enter all required fields Click to hide
Correct invalid entries Click to hide

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ