The next day, then-DC Attorney General Karl Racine announced a similar settlement agreement. In the two settlements, Google agreed to pay Indiana and the District of Columbia a total of $29.5 million (his $20 million and $9.5 million, respectively). These settlements follow similar settlements with 40 US state attorneys general and Australian regulators last year.
The settlement highlights the government’s expectation that companies will obtain appropriate consent, including strict disclosure of data practices, for sensitive personal information such as location information.
Regulatory and litigation history
Google offers several apps and platforms, such as Google Search and Google Maps, that collect your location information, especially from your mobile device. Google has used this information to support business operations in a number of ways, including disclosing your location to other companies. For example, you can learn how digital advertising drives visits to your physical store. Following reports in 2018, state attorneys general, including Attorneys General Rokita and Attorney General Racine, claimed that Google collected location information without users’ consent. This included methods such as misleading users into thinking that certain settings restricted the collection of location data.
These allegations include:
- Consumer deception that privacy can be protected through Google account settings
- Misrepresenting or omitting important facts about location history or Web & App Activity settings;
- Misrepresenting or omitting any material fact about whether a consumer has control over their privacy through their Google account settings
- Misrepresenting or omitting any material facts about Google Ads personalization settings
- Consumer deception that privacy can be protected through device settings
- Deploy deceptive practices that undermine consumers’ ability to make informed choices about their data, including dark patterns.
important point
Pursuant to the Settlement, in addition to payment, the Company will review its data practices before obtaining consent to collect location information, provide users with additional account controls, and introduce restrictions on data use and retention practices. A conspicuous disclosure must be made. Certain aspects of the settlement deserve special attention.
- Under the settlement, Google will issue notices, such as pop-up notifications and emails, to users who allow certain location tracking settings through Google services or devices, disclosing whether location information is being collected and limiting the collection. , should provide instructions on how to remove the collected positions. information. Google must also notify users by email of any material changes to its privacy policy regarding the collection, use, and retention of user’s location information.
- Google must establish and maintain a “Location Technology” webpage that discloses Google’s location data policies and practices and how users can limit and remove location information collection. Google also provides hyperlinks to this webpage in its privacy policy, account creation flow, and whenever users are asked to enable or enable location-related account settings while using a Google product. need to do it.
- The settlement requires Google to implement more specific language in several places.
- Settings webpage, About Location: “Your location is saved and used based on your settings. Learn more.”
- Geolocation Technology Webpages, Ads: You may receive personalization across services and devices based on your activity on Google services, such as Google Search, YouTube, and websites and apps that partner with Google to display ads. You can’t prevent your location from being used in your ads.
- Google may only share your precise location information with third-party advertisers if you have explicitly consented to its use and sharing. that third party.
- Before Google makes any material changes to how certain settings pages affect your precise location information or how Google shares your precise location information in connection with such settings, must conduct an internal privacy impact assessment.
While there are many notable aspects to these settlements, it’s also worth noting that this has occurred as many states begin to implement new privacy laws and regulations. location information.
See press releases from Indiana AG and District of Columbia AG. where (IN) When here (DC)Please contact any of the authors to find out more about the implications of these developments.
