The account signup process for new users of Google services is facing privacy complaints filed in multiple EU countries, as consumer groups organize to challenge the transparency and fairness of the process.
The complaints are being coordinated by the France-based European Consumer Organisation (BEUC) and include affiliated privacy groups in the Czech Republic, Greece, Norway and Slovenia. Additional consumer groups in Denmark, Germany, the Netherlands and Sweden have written warning letters to Google and to their respective data protection authorities (DPAs) about the company’s account signup practices.
Consumer groups organize to target language, click funnels used in Google account signup process
The privacy complaints focus on Google’s centralized account signup process, used for access to multiple free ad-supported services such as Gmail and Google Voice. The consumer groups take issue with the language Google uses during this process, the number of clicks users are subjected to in order to enable privacy settings, and the alleged “nudges” the company uses to encourage users to opt in to tracking. The privacy complaints contend that all of this prevents users from making informed choices about how their data will be handled, and may be in violation of General Data Protection Regulation (GDPR) processing rules.
Google responded to the privacy complaints by issuing a statement defending its account signup process, citing input into the design from various EU nation DPAs and its “clearly labeled” options for user privacy.
The GDPR has certain provisions requiring opt-out processes to be relatively as simple and straightforward as the opt-in process was. The consumer groups contend that this is not the case with Google account signups. The privacy complaints document a five-step process that involves 10 clicks in total to reach all of the options that limit the company’s use of personal data, as compared to a one-step “express lane” option that enables all of these settings and quickly moves the user along to whatever service they were signing up for.
The complaints also mention that Android devices require the user to set up a Google account in order to access the Play Store (the most convenient conduit through which to download apps) and make full use of some included operating system services, such as email and Google Maps.
Five groups, including the BEUC, have filed complaints in their respective countries. Four other groups have written letters either to Google or to their national DPAs regarding the account signup issues.
Privacy complaint may trigger new trouble for Google under new EU DPA cross-border agreement
EU privacy regulations have already taken a bite out of Google, though not always due to violations of the GDPR. A July 2018 fine that equaled $5.1 billion was for breaching EU antitrust rules; the company has been fined a total of €8.4 billion in the EU, but the largest GDPR fine it has faced thus far has been for about €50 million for personalized advertising issues in France.
Privacy complaints that involve GDPR terms tend to go well for Google as they end up routed through Ireland’s DPC as the lead investigating agency, given Google basing its EU operations in Dublin. The Irish DPC has a developing reputation for stalling out cases involving big tech firms, with existing complaints against Google in different cases that are now approaching three to four years of dragging on. Other countries have demonstrated an ability to take point on these cases when they can demonstrate that the alleged violations occur with Google’s US-based data processing operations, however, as France’s DPA did to levy the prior €50 million fine.
The BEUC is looking for similar national autonomy for this campaign of privacy complaints. It has also strategically organized the consumer groups to strike now, in the wake of an April decision that mandates greater participation by all involved national DPAs when a cross-border case meets a threshold of “strategic importance” (as most cases involving big tech platforms and millions of impacted consumers will). The consumer groups hope that these new rules will help break the regulatory logjam that inevitably forms in Ireland when a Dublin-based tech firm is involved.
If Google’s account signup practices are ultimately found to be in violation of GDPR rules, the company faces a maximum penalty of 2% of its global annual turnover. However, no GDPR fine has yet to approach that amount, even in the most serious cases. Google and Facebook were both previously fined in France for implementation of “dark patterns” that make it intentionally more difficult for users to opt out of data collection; in that case a fine of about $238 million was assessed for failing to make opting out of cookies easy enough for the end user after consumer groups brought similar privacy complaints. France’s DPA has shown more of a willingness to both pursue GDPR fines and shoot for higher amounts than most others in the EU.
