ACCC court action alleges Google misled users over location data

Google will defend world-first ACCC legal action alleging it misled smartphone users about harvesting location data.

The ACCC is accusing Google of breaching consumer law by not telling smartphone users about the data it was collecting. Picture: AFP

US tech giant Google is facing a multi-million dollar fine in Australia, after the consumer watchdog launched world-first federal court action alleging the tech giant misled consumers about the location data it hoovered up.

Announcing the court action on Tuesday, the Australian Competition and Consumer Commission alleged Google breached consumer law when it did not properly inform Android smartphone users about the sheer volume of data they would be handing over.

ACCC chair Rod Sims, who has been a vocal critic of the power wielded by the US tech giants, said Google’s menu settings from January 2017 until late 2018 were misleading, including that users’ location data would continue to be sent to Google even if the ‘Location History’ option was switched off.

Read more: John Durie on why this case is so important

It’s understood that switching off that feature would stop a feature dubbed “Your Timeline” from working on Android devices, but ads and other Google services would still know where you were.

“We are taking court action against Google because we allege that as a result of these on-screen representations, Google has collected, kept and used highly sensitive and valuable personal information about consumers’ location without them making an informed choice,” ACCC chair Rod Sims said in a statement.

A statement shown to consumers who used their Android mobile device to turn off (or “pause”) the Location History setting between early 2017 and late 2018. Picture: ACCC

“Our case is that consumers would have understood as a result of this conduct that by switching off their ‘Location History’ setting, Google would stop collecting their location data, plain and simple.

“We allege that Google misled consumers by staying silent about the fact that another setting also had to be switched off.

“Many consumers make a conscious decision to turn off settings to stop the collection of their location data, but we allege that Google’s conduct may have prevented consumers from making that choice.”

Mr Sims, said Google had violated “the essence of Australian Consumer Law”.

Consumers were not told what would be done with the data Google was collecting, he said.

“What we’re alleging here is basically misrepresentations... this is a classic case,” Mr Sims told reporters.

He said while some of the allegations concerned menu settings that were changed last year, other behaviour was “continuous”.

Mr Sims alleged that Google also misled the public about “the nature, characteristics and suitability for purpose of the Android operating system, Google services and Google Pixel phones”.

Read more: ACCC lays down law on Google, Facebook | ACCC recommends overhaul on how digital giants operate.

A Google spokeswoman told The Australian: “We are currently reviewing the details of these allegations. We continue to engage with the ACCC and intend to defend this matter.”

Mr Sims said the ACCC would be seeking penalties, declarations, public notices of apology and the establishment of a compliance program.

Google could be fined up to $10 million, or 10 per cent of annual turnover, for breaching Australian consumer law.

“We want declarations that the past behaviour was inappropriate. We want declarations that the current behaviour should not continue,” Mr Sims said.

“Secondly, we want significant penalties.

“Thirdly, we want Google to have to let people know what’s gone on, so that people have a greater awareness of what data is actually being collected here.”

Mr Sims said he thought there could be issues with other devices using Google applications, but that this particular case was limited to Android smartphone devices.

Mr Sims also said most of the allegations would fall under previous consumer law penalties, which carried a lower maximum financial punishment of $1.1 million per breach.

“The consumer law penalties changed in September last year to allow the ACCC to seek penalties that are up to 10 per cent of turnover.

“Most of this activity that we’re alleging here is under the old penalty regime where the penalties were up to $1.1 million per breach.

“Those penalties in our view were inadequate. Fortunately, the parliament agreed with that. And so we now have a penalty regime that can be up to 10 per cent of turnover.

“Some of the allegations we’re making today are under the old penalty regime, some under the new, but going forward, Australia now has a penalty regime that can actually make a difference.” Mr Sims said.

ACCC chief Rod Sims. “What we’re alleging here is basically misrepresentations... this is a classic case.” Picture: John Feder

The news follows the watchdog’s landmark digital platforms inquiry final report handed down earlier this year, which recommended the strengthening of Australia’s privacy laws and new notification and consent requirements around personal data.

The ACCC’s Federal Court salvo on Tuesday is the latest step for Australia, which is largely being seen across the world as a first-mover when it comes to regulating the tech giants.

Class actions have been launched against Google for its privacy misdeeds in other jurisdictions, including in the United Kingdom and California, but this is the first time a regulator has stepped in in this way.

Statement shown to consumers who used their Android mobile device to access the Web & App Activity setting between early 2017 and late 2018. Picture: ACCC

Public scrutiny around Google’s handling of location data forced the tech giant to last year clarify its position, with the company stating that turning off the setting did not affect the other location-based services on a smartphone.

It also added that some location data is saved as part of a user’s activity on services, like Search and Maps.

Read more: How Google is keeping an eye on you

Google had previously stated that when a user turned Location History off, “the places you go are no longer stored”.

Labor’s communications spokeswoman Michelle Rowland said the average person would be astounded at the level and range of data digital platforms like Google have about them.

“It’s up to the ACCC to use the laws at its disposal to ensure consumers are protected, particularly in this day and age when we carry the internet around with us on our mobile phones and smart watches,” she said.

“Mobile towers, Wi-Fi hot spots and apps like Google Maps bring great convenience to our lives. Let’s not kid ourselves, they also track our location and interactions, and this data is being monetised.

“It’s in everyone’s interest that consumers make informed choices about whether their data is collected and used.”

Katharine Kemp, Senior Lecturer, Faculty of Law, UNSW, and co-Leader, “Data as a Source of Market Power” Research Stream of The Allens Hub for Technology, Law and Innovation, UNSW, said Google will likely suffer significant reputational impact from the action.

“Consumers being more aware is not the answer to this problem. Many privacy policies are deliberately drafted to give companies maximum permission to use consumers’ personal data as they choose without giving consumers real information or choices. Consumers have very little power as the law currently stands,” she said.

“The ACCC is taking the lead here, it’s identified major issues in the way digital platforms are putting consumers at risk through their data practices and made recommendations for much-needed improvements to Australia’s privacy laws.

“It’s very encouraging that the ACCC is taking this action, but we ultimately need more fundamental changes in our approach to privacy regulation.”

David Glance, a senior research fellow at the University of Western Australia, told The Australian the ACCC’s action was encouraging, although the consequences would be light for Google.

“It illustrates again how little regard Google has for privacy given its personalised advertising business model that will always be in conflict with doing the right thing for consumers,” he said.

“It also illustrates how developers generally don’t take privacy by design seriously. If privacy was your central important consideration, it would be emphasised in every communication with the user.

“Google will argue a literal defence, saying that location history and location resulting from web activity are two different things.”

Stephen Neville, CEO of Australian tech company BugHerd, said Google is now everywhere in our lives including in our cars and our homes, and consumers need to be weary.

"They collect a staggering amount of information on us, and we choose to allow it because we believe it makes our lives easier. But we never truly know how they use that data," he said.

"When a user says, "don't track my location history," they're making a choice about how they want to interact with that service. For Google to not respect that choice is a breach of that trust. Trust and transparency go hand in hand. How can you trust them to handle your data appropriately if they don't even disclose they have it?

"But as they say, if you're not paying for the product, you are the product. This is just another reminder of how our data choices are as much about the benefit to Google as it is for ours."

Google’s acknowledgement of the “location history” issue prompted a European privacy group to file a complaint against the company.

According to the group, Google routinely used manipulative tactics to ensure it could keep tracking locations of users to send them ads.

The complaint was lodged under EU’s new data protection framework, the General Data Protection Regulation (GDPR), which lets regulators impose major fines for compliance breaches — of up to 4 per cent of a company’s global annual turnover.

Launched in May last year, GDPR imposes rules on how a company can collect, store and use personal data. Most significantly, it forces Facebook and Google to seek explicit permission from consumers before using their data for advertising purposes. If a consumer refuses to provide the permission, the tech companies are still obliged to provide the service.

Changes mooted by the ACCC would bring Australia into line with Europe.

Additional reporting: Supratim Adhikari.