State-level regulations continue to catch up with Google’s surreptitious use of location tracking, as the company has agreed to pay a $93 million privacy settlement to California.
The location tracking issue dates back to 2018. Over 40 states have already reached similar privacy settlements with the tech giant, with Google having now paid over $600 million in total due to this issue. At least one more settlement may be forthcoming in Texas, where the company is still dealing with an open lawsuit.
Google’s collection of state-level privacy settlements barely scratch $280 billion annual revenue
While Google has now been held to at least some kind of account over surreptitious location tracking in the majority of states, the grand total represents just a little more than 1% of the company’s $55 billion revenue growth from 2022 to 2023 alone.
The California privacy settlement was announced by the state Attorney General’s office, concluding a now years-long Department of Justice investigation into Google’s location tracking practices. Google was found to have failed to obtain proper informed consent for tracking the movements of users of its services and using that information for targeted advertising, and in addition to the fine will be placed under an injunction that requires it to improve numerous aspects of its data privacy practices.
The central issue of the case, also the centerpiece of the other state lawsuits and investigations that led to privacy settlements, is that turning off “Location History” in Google’s Android and web browsing settings did not actually stop certain apps from tracking user movements and storing location data. Putting a full end to tracking in certain apps, such as Maps (which comes preinstalled on Android devices and auto-loads from web browsers), required navigating to a more obscure setting called “Web & App Activity.”
The California injunction will require Google to more clearly communicate how location-related account settings and location tracking work, clearly disclose that location history and information may be used for building targeted advertising profiles, and have an internal Privacy Working Group review and approve material changes to location-setting and ad personalization disclosures.
Google calls location tracking practices “outdated product policies”
Google has not admitted liability in any of the prior privacy settlements, the largest of which was a joint effort by 40 states. The company has also come to similar settlements in Arizona, Washington and Indiana.
Given how relatively small the total fine count is, it might seem as if Google is simply buying its way out of its location tracking trouble (injunction requirements aside). The legal trouble over its targeted advertising is far from over, however. In January the Biden administration filed an antitrust suit against the company, the second filed against it by the US government. The more recent suit focuses on Google’s ad business and calls for it to be broken up due to a stranglehold on the market. Antitrust cases are the single type of regulatory action most likely to do serious damage to tech giants, but also generally take years to play out. The first federal suit was filed under the Trump administration and focuses on its search business, and has just now gotten underway earlier in September.
Google has been hit with more frequent regulatory action in the EU under the terms of the GDPR, though not necessarily for larger financial damage and not necessarily for its location tracking policies. The company currently holds four of the top 25 largest GDPR fines: a total of about $160 million in penalties in 2021 for cookie consent issues, $55 million in 2019 for not being transparent enough about targeted advertising policies, and about $10.5 million in Spain in 2022 for illegal data transfers. In 2022 Google was also sued by a Swedish price comparison site called PriceRunner for $2.4 billion, under the argument that its Google Shopping app has been in continual breach of a European Commission antitrust enforcement order issued in 2017.
Though it is clearly illegal in the US to track someone via GPS without their consent, there is yet to be federal law that clearly addresses how mobile phones conduct location tracking for advertising purposes and exactly what the required standard of “consent” is in these circumstances. Such matters are expected to be taken up by an eventual federal-level data privacy law, but every seemingly promising effort seems to stall out for one reason or another and experts expect nothing will get done until after the 2024 election at absolute minimum.
As the privacy settlements demonstrate, individual states have more legal room to be aggressive in this area, particularly as they establish their own data privacy laws. At the federal level, some individual regulatory agencies (such as the FTC and FCC) have started using their existing powers and updating rules to provide some means of federal action against both big tech platforms and mobile carriers.
