Google will be facing a legal challenge from the District of Columbia and the states of Texas, Washington and Indiana over its privacy settings. The coalition of states claims that settings that ostensibly turned off location tracking did not actually disable it fully, allowing Google to continue collecting user location data through other methods.
Google location tracking remains on in “stealth mode” in background, lawsuit alleges
The case centers on Google’s privacy settings for Android devices and users of its services, which are supposed to allow the end user to opt out of location tracking. The “Location History” and “Location Reporting” settings are accessed through a person’s Google Account and can be turned off (Location History is off by default with versions of Android from 8.0 and up). Google’s support page says that disabling these features stops location data from being “automatically recorded”; the lawsuit asserts that it is still being collected and used in other ways.
The current suit builds on an existing case brought by the Arizona Attorney General in 2020. Both cases allege that various Google services continue running location tracking features even when the user has opted out: the search bar, the weather app and the Chrome web browser among the most commonly used example. The Arizona suit is seeking compensation for state residents that use Google tools, in addition to imposing a fine that could range up to $10,000 per violation under the state’s consumer fraud laws. A jury trial is pending following a recommendation by a judge after finding that there was not enough evidence to indicate Google was actively trying to deceive users.
The current location tracking suit goes further by alleging that Google does actively “nudge” users and “mislead” them into believing that their data is not being shared with the company. The complaint asserts that users of Android and Google services can thus never really be sure when location tracking is taking place, no matter how they have configured their settings.
The suit specifically asserts the use of “dark patterns” by Google, or design techniques that will dissuade the user from following all the way through to all of the relevant privacy settings or that are meant to distract them in the midst of getting there. This has been documented since at least 2018, and something that Google has run into prior issues with in the European Union.
Google denies the claims and said that it would “vigorously defend” its legal rights in court.
Google services, apps create “complex web” of location tracking
Even when certain location tracking features are found and disabled in the settings menus, they are not fully disabled (and sometimes cannot be). Location History has already been mentioned; while now off by default in modern Android devices, it doesn’t actually hide the location of one’s device from Google (as can be seen by it still appearing in Maps, as one example).
There is also “Web & App Activity,” which must be manually turned off to stop search history from being recorded. But search history logged prior to disabling this element remains, requiring diving deeper into a personal account to remove completely. Prior actions in individual apps, like Maps and Gmail, may also need to be chased down in their own set of menus to scrub from storage.
Google Ad Personalization is also something that needs to be manually opted out of, but it does not unplug one entirely from the company’s web-spanning ad tracking network. While turning this off limits the collection of personal characteristics, it does not stop Google from using the device IP address for ad delivery and location tracking is still at least theoretically possible by using a variety of alternate signals.
Location data is regarded as a category of sensitive personal information in many jurisdictions. In addition to the potential for physical tracking of an individual, logged location data can reveal a great deal about a person’s other characteristics over time: religion, sexuality, health conditions, political affiliation, and so on. Much can be inferred just from visits to specific locations, particularly repeat visits and regular patterns of movement.
At the moment, there is no single federal privacy law that regulates the collection of location tracking data. What scanty protections there are also dwindle as this data is handed off from the collector to various third parties (bounty hunters very often find targets by purchasing cell phone location data from brokers that in turn have purchased it directly from the phone carriers). There is a greater level of regulation on GPS data, but very little for the collection of data points that tech giants accumulate for their “secret sauce” formulas of location tracking by identifying specific devices.
