The Australian competition and consumer regulator is suing Google for allegedly misleading customers over how it collects personal location data. The ACCC found that even when Android users have Location History turned off, Google was collecting personal location data through its web services and apps, without properly informing customers. The regulator has asked the court to impose fines and a compliance programme so Google changes its practices.
The ACCC claims that from at least January 2017, Google breached the Australian Consumer Law when it made on-screen representations on Android mobile phones and tablets that the ACCC alleges misled consumers about the location data Google collected or used when certain Google Account settings were enabled or disabled. This includes violations during both the set-up of Android devices and in the Google Account settings on Android phones and tablets.
Google should have informed customers that not only Location History, but also the 'Web & App activity' tracking setting needed to be disabled if they did not want Google to collect personal location data. Furthermore, from around mid-2018 until late 2018, Google represented to consumers that the only way they could prevent Google from collecting and using their location data was to stop using certain Google services, including Google Search and Google Maps. However, this could be achieved by switching off both ‘Location History’ and ‘Web & App Activity’.
Google's practices on location data have come under scrutiny in the US and Europe already, where other regulatory investigations and lawsuits are underway. A report by news agency AP in 2018 prompted the company to change some of the language in its user settings, and earlier this year Google gave users more control over storing and deleting location data.
The ACCC earlier recommended in its Digital Platforms Inquiry that privacy legislation be strengthened to avoid such problems. This should include updating the definition of “personal information” in the Privacy Act to clarify that it captures technical data such as IP addresses, device identifiers, location data, and any other online identifiers that may be used to identify an individual; and strengthening notification and consent requirements to ensure consumers can make informed decisions about the personal data they allow digital platforms to collect.
