The Federal Court has found Google misled Android users about how it collected and stored location data.

In a landmark case brought forward by the Australian Competition and Consumer Commission (ACCC), Google was found to have misrepresented what personal information would be affected by the ‘Location History’ setting.

Justice Tom Thawley found Google’s conduct “misleading or deceptive” in his judgement which closely examined whether a reasonable Google user would have understood that ‘Location History’ was the only setting controlling location data, when the sensitive data was also managed by the ‘Web & App Activity’ setting.

ACCC chair Rod Sims said the judgement was “an important victory” and a step toward greater transparency around how data harvesting operations like Google treat personal information.

“Companies that collect information must explain their settings clearly and transparently so consumers are not misled,” Sims said.

“Consumers should not be kept in the dark when it comes to the collection of their personal location data.

“This is an important victory for consumers, especially anyone concerned about their privacy online, as the Court’s decision sends a strong message to Google and others that big businesses must not mislead their customers.”

The ACCC took the case to the Federal Court in October 2019 and is now seeking financial penalties.

It also wants Google to issue a notice to its Australia users in order to better inform them about how their location data is governed.

Last year, the ACCC also began court proceedings against Google for harvesting web data of its users without their informed consent.

A Google spokesperson told Information Age via a written statement that the company disagreed with the court’s findings and was considering an appeal.

“We provide robust controls for location data and are always looking to do more – for example we recently introduced auto delete options for Location History, making it even easier to control your data,” the spokesperson said.

If you want to stop Google from accessing your location data, turn off both ‘Location’ and ‘Web & App Activity’ in your Google account settings.

Three scenarios

Justice Thawley considered three scenarios in which an Android user might have accessed ‘Location History’ between January 2017 and December 2018.

The first was when a new user was setting up a Google account on an Android device – something around 6.3 million Australian users did during the time in question.

While looking at the ‘Privacy and Terms’ screen in the account set-up phase, Thawley concluded, some people who chose to view more privacy options may have “incorrectly concluded … that the ‘Location History’ setting was the setting which controlled whether Google would obtain person data about the user’s location”.

He also found some users would have reasonably thought “Google would not, even on a once off basis, obtain or use personal data about a user’s location if the ‘Location History’ setting was off”.

Thawley also thought about people who had gone into their Google account settings for the purpose of turning ‘Location History’ off (even though it was off by default).

For these people, he said there were “reasonable users” who would have thought that switching ‘Location History’ off meant Google “would not be able to obtain retain or use and use location data,” or if it did use data Google wouldn’t have been able to store the data and use it later.

Finally, Thawley considered the information given to Android users who were considering turning off ‘Web & App Activity’ off.

In his judgement, Thawley said Google “conveyed a representation” that disabling the setting wouldn’t let the company keep location data even though Google used the setting to determine whether to keep information about in-app location services.

The ‘Oh Shit’ meeting

Google’s actions in keeping the full gamut of location data split across different settings was first reported on by the Associated Press in August 2018.

According to Thawley’s judgement, the article caused an internal stir at Google with the company urgently pulling staff into what some called “the ‘Oh Shit’ meeting”.

Internally, it seemed Googlers agreed that it wasn’t right to suggest location data was controlled by ‘Location History’ when there was another setting – ‘Web & App Activity’ – that also mattered.

“Location off should mean location off; not except for this case or that case,” said one Google software engineer in an internal forum.

“The current UI feels like it is designed to make things possible, yet difficult enough that people won’t figure it out.”

What that engineer was tacitly referring to is also known as a ‘dark pattern’: a kind of trick used by designers to effectively control or funnel behaviour toward a desired outcome – like thinking ‘Location History’ was the only setting needed to control your location history, or the labyrinthine set of steps needed to actually delete an Amazon account.

Once the Associated Press broke the story, Google noticed a 500 per cent increase in users turning off both ‘Location History’ and ‘Web & App Activity’.