The ACCC has begun legal proceedings against Google in Australia, alleging the search giant engaged in misleading conduct and made false or misleading representations to consumers about the personal location data Google collects, keeps and uses.
The legal action follows the watchdog’s long-running investigation into digital platforms and their market dominance, and is in-line with a wider global crackdown on data collection practices.
Google says they are reviewing the allegations and plan to defend the matter.
The ACCC claims that from at least January 2017, Google breached the Australian Consumer Law when it made on-screen representations on Android mobile phones and tablets that the ACCC alleges misled consumers about the location data Google collected or used when certain Google Account settings were enabled or disabled.
The watchdog said the representations were made to consumers setting up a Google Account on their Android mobile phones and tablets, and to consumers who later accessed their Google Account settings through their Android mobile phones and tablets.
“We are taking court action against Google because we allege that as a result of these on-screen representations, Google has collected, kept and used highly sensitive and valuable personal information about consumers’ location without them making an informed choice,” ACCC Chair Rod Sims said.
The ACCC is seeking penalties, declarations and orders requiring the publication of corrective notices and the establishment of a compliance program.
A Google spokesperson provided the following statement: “We are currently reviewing the details of these allegations. We continue to engage with the ACCC and intend to defend this matter.”
The ACCC case argues that Google wasn’t transparent enough with consumers in a way that would allow them to make their own choices about providing their location data to Google.
The ACCC’s case regarding the collection of location data focuses on two Google Account settings: one labelled ‘Location History’; and another labelled ‘Web & App Activity’.
The ACCC alleges that from January 2017 until late 2018, it was misleading for Google to not properly disclose to consumers that both settings had to be switched off if consumers didn’t want Google to collect, keep and use their location data.
The ACCC alleges that when consumers set up a Google Account on their Android phone or tablet, they would have incorrectly believed, based on Google’s conduct, that ‘Location History’ was the only Google Account setting that affected whether Google collected, kept or used data about their location.
Even if “Location History” is turned off, when the Web & App Activity setting is turned “on”, Google obtains and keeps personal data relating to the user’s activities on Google apps and services, including personal data in relation to the user’s location, the ACCC said.
“Our case is that consumers would have understood as a result of this conduct that by switching off their ‘Location History’ setting, Google would stop collecting their location data, plain and simple,” Sims said.
“We allege that Google misled consumers by staying silent about the fact that another setting also had to be switched off.
“Many consumers make a conscious decision to turn off settings to stop the collection of their location data, but we allege that Google’s conduct may have prevented consumers from making that choice.”
The ACCC also alleges that from around mid-2018 until late 2018, Google represented to consumers that the only way they could prevent Google from collecting, keeping and using their location data was to stop using certain Google services, including Google Search and Google Maps. However, this could be achieved by switching off both ‘Location History’ and ‘Web & App Activity’.
The on-screen messages that Google displayed represented that location data would only be collected and used by Google for the consumer’s use of Google services. The ACCC alleges Google did not disclose that the data may be used by Google for a number of other purposes unrelated to the consumer’s use of Google’s services.
“We consider that because of Google’s failure to disclose this use of data, consumers were and still are deprived of the opportunity to make an informed choice about whether to share their personal location data with Google,” Sims said.
“Transparency and inadequate disclosure issues involving digital platforms and consumer data were a major focus of our Digital Platforms Inquiry, and remain one of the ACCC’s top priorities.”
Strengthening privacy protections
The ACCC’s Digital Platforms Inquiry final report recommended that privacy legislation be strengthened, including by updating the definition of “personal information” in the Privacy Act to clarify that it captures technical data such as IP addresses, device identifiers, location data, and any other online identifiers that may be used to identify an individual.
The final report also recommended strengthening notification and consent requirements to ensure consumers can make informed decisions about the personal data they allow digital platforms to collect.
DIGI, the body representing the technology industry including Google and Facebook pushed back strongly against any changes to privacy legislation.