Google Now Required to Disclose Use of Location Tracking to Users, Says Calif. AG

California’s $93 million settlement with Google resolves a multiyear investigation into the tech company’s location-privacy practices, said Attorney General Rob Bonta (D) in a Thursday news release. The California Department of Justice determined Google was ” deceiving users by collecting, storing, and using their location data for consumer profiling and advertising purposes without informed consent,” Bonta said.

Google was “telling its users one thing – that it would no longer track their location once they opted out – but doing the opposite and continuing to track its users’ movements for its own commercial gain,” Bonta said, saying California is “holding Google accountable” with the settlement.

Under the settlement, Google is required to show additional information to users when enabling location-related account settings and provide more transparency about location tracking, Bonta said. The company has to provide users “detailed information” about the location data Google collects and how it is used through a “Location Technologies” webpage, he said.

Google will also be required to disclose to users that their location information may be used for ad personalization, disclose to users before using their historical location data to build ad targeting profiles, and obtain review by the company’s internal privacy working group and document approval “for all material changes to location-setting and ads personalization disclosures that will have a material impact on privacy,” Bonta said.

The state of California’s Thursday privacy complaint (docket 23-cv-422424) for injunction, civil penalties and equitable relief, in Superior Court of California in Santa Clara County, alleged violations of the state’s Unfair Competition Law and False Advertising Law for the company's collection, use and retention of consumers’ geolocation data.

A critical feature of Google’s advertising platform is geo-targeted advertising, “as advertisers greatly prefer to precisely target users in narrow geographical locations,” said the complaint. In addition to advertising to users based on their location, Google also uses their location data to build behavioral profiles of them, which can determine which ads they are shown, it said.

Google collects, stores and uses location-related data via three features: Location History, Web & App Activity, and Ads Personalization, the complaint said. They can be enabled or disabled on a user-by-user basis within a Google device’s account settings, but they are not device-specific. For a given Google account, the settings are either on or off, regardless of the number of devices used to log into the account.

Many users don’t know about or understand Google’s Location History and Web & App Activity settings, but had "unwittingly enabled them due to Google’s deceptive disclosures, thereby allowing Google to track their precise location,” said the complaint. In addition, Google “misrepresented that when users disabled Ads Personalization it would stop using the user’s location to target advertisements" to them, "when in fact it continued to do so,” it said.

Location History continually tracks a person’s movements and the places they visit. When it is enabled, Google receives a person’s updated location from their mobile phone, the complaint said. When a user creates a Google account, the Location History setting is “supposedly off by default," it said, but from 2014-2018, Google showed users "deceptive prompts when they used certain Google apps to mislead users into unwittingly enabling Location History,” the complaint said.

The complaint showed a pop-up from Google Maps, encouraging users to “enhance” their Google Maps experience, saying Google needs to “periodically store your location to improve your search suggestions, route recommendations and more.” By enabling the “enhancement,” a user “unknowingly turned on Location History,” the complaint said, allowing Google “to collect and store the user’s location accountwide—even outside Maps.” By clicking, “Yes, I’m in” in Google Maps, users were “actually consenting to the collection and use of their location data 24/7 by Google,” it said. Google also failed to disclose “the material fact that it was also using the location data for the wholly unrelated purpose of profiling the user for advertising purposes,” it said.

For years, said the complaint, Google told users if they turned off the location history setting, the company wouldn’t store their location data. A screenshot of a box told users they could turn off location history at any point and that places they go to “are no longer stored.” It told users that when they turn off location history, “it’s turned off for all devices associated with that Google Account,” it said. Though the statement was clear and direct, “it was also fake,” said the complaint. “Even when a user turned Location History off, Google continued to collect and store that user’s location data through other sources, including a user’s Web & App Activity, which has been (and continues to be) defaulted to on when a user creates a Google account.”

Web & App Activity, meanwhile, saves a record of a user’s activities on various Google products and services, “including a time-stamped location,” the complaint said. It referenced an Associated Press article that said with Location History turned off, “Google continued recording user locations when they merely opened the Google Maps app, updated the daily weather on their phones, or even when they searched for items that had nothing at all to do with their location, like ‘chocolate chip cookies.’”

Google's Ads Personalization setting governs the degree to which the company tailors ads to users, “including the extent to which Google uses location information to profile and target ads to consumers,” the complaint said. But even with the setting disabled, Google “still uses people’s location to geotarget ads at them,” said the complaint. When users create an account, Google “seemingly gives users the choice of whether to receive advertisements personalized to them” by having them select either a box for ads personalized to them or ones that aren’t, it said.

“Users naturally assumed this means what it says," said the complaint: "if they choose the option labeled ‘Show me ads that aren’t personalized’ then Google will not serve” personalized ads, the complaint said. “But that is not true,” it said: “Even if a user turns off this setting, Google still uses the user’s real-time location information to serve them targeted ads.” Despite the “plain language of the setting options, users are not actually able to choose whether the ads they see are personalized to them,” it said.