Washington Attorney General Bob Ferguson is suing Google in an effort to change how the company handles users’ personal data.
Ferguson joined attorneys general in Texas, Indiana and the District of Columbia in filing a lawsuit Monday alleging the company misled consumers about its location-tracking services and, at times, collected data without their consent.
In Washington, Ferguson is asking the court to tell Google to change its practices, give up the data it acquired and take back the profits it made from using those tactics in the first place — as well as a $7,500 fee for each violation.
“Location data is deeply personal for consumers,” he said. “Google denied consumers the ability to choose whether [it] could track their sensitive location data to make a profit. Google kept tracking individuals’ location data even after consumers told the corporation to stop.
“This is not only dishonest — it’s unlawful.”
In the lawsuit filed in King County Superior Court, Ferguson claims Google violated the state’s Consumer Protection Act by collecting, storing and using consumers’ location data without their knowledge or consent and, in some cases, directly against their intent.
It’s not yet clear how many Washingtonians were impacted by Google’s practices but the attorney general’s office estimates there could be “hundreds of thousands of potential violations.”
State law requires that any penalties Google pays as a result of violations to the Consumer Protection Act will go to the general fund, Ferguson said.
Google isn’t the only company that has been accused of using misleading messages to collect data from users, which can be a way to sell more advertising, said Bennett Cyphers, a staff technologist at the Electronic Frontier Foundation, a nonprofit based in San Francisco that focuses on digital privacy and free speech.
But it is one of the most influential.
“There’s no one else who does it at the scale that Google does, and there’s no one else that has all the different inroads into your life that Google does,” Cyphers said.
Google says location data plays an important role in providing useful and meaningful experiences to consumers, according to its website. The data is used for things like directions on Google Maps, making sure websites are shown in the right language and telling consumers what restaurants are nearby — and how crowded they typically are at any given time.
At the start of the coronavirus pandemic, Google began releasing anonymous and aggregated reports to track where people were going, and where they were not, to help remediate the impact of the virus. For example, in Washington last week, visits to grocery stores and pharmacies were down 10% compared to a baseline and visits to parks were up 14%.
Google can track someone’s location from real-time signals, like an IP address or a device’s location, as well as using past activity on Google sites and services.
In recent years, the company says it has made improvements to make location data easy to manage and understand while also minimizing the amount of data stored.
It launched an Incognito mode for Google Maps to allow users to browse or get directions without saving information to their Google account. And it set up an auto-delete default for all new Google accounts that will automatically delete any activity data older than 18 months.
“The attorneys general are bringing a case based on inaccurate claims and outdated assertions about our settings,” said José Castañeda, a Google spokesperson. “We will vigorously defend ourselves and set the record straight.”
The complaints lodged Monday come after a 2018 report from The Associated Press that found many Google services on Android devices and iPhones stored users’ location data even if the consumer enabled a privacy setting that said it would prevent Google from doing so.
Washington, D.C., opened an investigation into the company in 2018. And in 2020, Arizona’s attorney general filed a lawsuit arguing that the company set up its Android mobile operating system in a way that enriched its advertising empire and deceived users about the protections afforded to their personal data.
The case in Arizona made it clear Google didn’t have a “real infrastructure or a real plan” for handling user’s requests to turn location tracking off, said Jennifer King, a privacy and data policy fellow at the Stanford Institute for Human-Centered Artificial Intelligence.
“I’m inclined to argue that they had no interest in creating products that assumed you did not want to be tracked by them,” she said. “I don’t think its incompetence or accidental as much as it was just not a priority.”
Along with tracking Android devices even after users turn off location access and collecting location data after users disable “location history,” the lawsuit alleges Google repeatedly “nudges” users to consent to location tracking.
Those nudges could come in the form of a pop-up box alerting a user that a service like Google Maps won’t work as well if the user opts to turn off location tracking. That pop-up box is misleading, according to both Ferguson and King.
The map could still perform its main function — getting a user from one address to another, she said. It just might not be able to point you to the closest fast-food joint.
“They were trying to make it sound as if you were somehow suffering from a depleted user experience because they wouldn’t be able to do the next layer of things they wanted to do, which is the personalization,” King said.
If the court rules against Google, King predicts it would lead to one of two outcomes: The court orders Google to change its practice or the court tells the company to be more transparent about the information it collects.
“If your phone is tracking everywhere you go, that data is used generally to build a portrait of who you are and what you do,” King said. “There’s no constraints on the companies, any company, using that knowledge.”
Ferguson said Monday the first step is to wait for Google to respond and then to start the discovery process to seek more information about the company’s practices and how they impacted Washington residents.
“Google is a big corporation and they may put up a fight,” he said. “I’m here to see this through and get meaningful change for Washingtonians, even if that takes time.”
