Last week, a report revealed that Google continues to collect location data from users even when “Location History” is disabled in its options. The company was unapologetic but did change its location policy. Now, a man in California is going to court to accuse Google of violating the state’s privacy laws.
The Associated Press first broke the news that Google’s location-tracking settings were more complicated than they appeared. The issue came down to the labelling of various features in Google’s “Activity Controls” menu. A slider control on the Location History section seemed to state that this was a one-stop shop to prevent Google hanging onto your location data. A support page for the feature read, “With Location History off, the places you go are no longer stored.” But that wasn’t entirely true. In order to fully opt-out of having your location activity stored by Google, you have to also pause the Web & Activity control as well. This is acknowledged if a user digs deeper into Google’s product documentation.
At the time, Google defended itself, saying, “We provide clear descriptions of these tools, and robust controls so people can turn them on or off, and delete their histories at any time.” On Friday, it changed the wording on its support page to make it clear that some Google services would continue following you around. Friday was also the day that Napoleon Patacsil filed a lawsuit against Google in San Francisco federal court and requested a judge grant the case class-action status so that other Google users could join.
Reuters first reported on the lawsuit, a copy of which was reviewed by Gizmodo. Patacsil presents as evidence the AP’s map of activity that was recorded when a volunteer turned off Location History and moved around Manhattan. It also includes screenshots of Google’s unaltered policy and claims the company’s “principal goal was to surreptitiously monitor Plaintiff and Class members and to allow third-parties to do the same.”
The suit accuses Google of violating California’s privacy laws on three counts. It cites section 637.7 of the penal code that “prohibits the use of an electronic tracking device to determine the location or movement of a person.”
The second count builds on the first and claims Google violated the plaintiff’s reasonable expectation of privacy. This claim goes on to say that “Google engaged in true tracking of location history deceptively and in direct contradiction of the express instructions of Plaintiff and the members of the Class.”
The third count goes further, saying that the Plaintiff’s “solitude, seclusion, right of privacy, or private affairs” were violated “by intentionally tracking their location.” The suit claims that Google has caused harm to its users “because they disclosed sensitive and confidential location information, constituting an egregious breach of social norms” and were the victims of an “intrusion into their private affairs.”
The biggest question the courts will have to consider is whether or not Google met its legal obligation to obtain consent from its users. Does burying all of the information a user needs deep within separate documents on separate web pages adequately inform a user about what they are agreeing to? If all that information is collected in one document located at a separate portal, would that qualify as sufficient explanation of a company’s policies?
By changing its policies last week, it appears that Google understands some users could be confused by its previous approach. But that doesn’t mean it’s admitting any wrongdoing, only that it’s responding to user feedback. We asked Google if it intends to fight this lawsuit if it moves forward but did not receive an immediate reply.
If the suit is granted class-action status, practically every breathing American could potentially join in as a Plaintiff. It does not specify an amount for the damages it hopes the court will award, but California reserves the right to revoke the business licence of a company that violates its privacy act.
On the same day that Patacsil filed his lawsuit, activists from the Electronic Privacy Information Center sent a letter to the Federal Trade Commission encouraging it to investigate Google for potentially violating a consent decree it signed with the agency in 2011. At the time, the company was accused of using deceptive tactics and violating its own privacy promises. Google agreed not to engage in future privacy misrepresentations and periodic independent audits of its privacy practices for the next 20 years.