Watchdog thinks Google tricked Australians into giving up data, sues. Judge semi-agrees
- Reference: 1618572612
- News link: https://www.theregister.co.uk/2021/04/16/watchdog_thinks_google_tricked_australians/
- Source link:
For Google to not collect a device's location data, the user needed to let their wishes be known in both the "Location History" and the "Web & App Activity" setting segments. In its case, which it first brought against the web [2]search giant in July 2020 , the Australian Competition and Consumer Commission (ACC) had argued that Google did not adequately publicise the secondary setting requirement.
[3]
The court ruling [4]handed down revealed that when an August 2018 [5]Associated Press article challenged Google's support page assertion that "With Location History off, the places you go are no longer stored," Google called an emergency meeting referred to internally as the "Oh Shit" meeting.
According to the filing, after the AP article was published, there was a 500 per cent increase in the number of users who disabled their data share in “Location History” and “Web & App Activity.”
[6]
Both ACCC and Google brought forth behavioural economists to argue as to what amount of trouble was reasonable for users to undergo to protect their data and what factors would influence this.
Ultimately, the court said the "partly" misleading behaviour placed Google in breach of section 18 29(1)(g) of consumer law.
Justice Thomas Thawley, who presided over the case, said in the ruling:
Google's conduct would not have misled all reasonable users in the classes identified; but Google's conduct misled or was likely to mislead some reasonable users within the particular classes identified.
The court will determine any declarations, financial penalties, publication orders and compliance orders at a later date. The ACCC also wants Google to explain location data settings to Australians through a published notice.
"Today's decision is an important step to make sure digital platforms are up front with consumers about what is happening with their data and what they can do to protect it," said Rod Sims, chair at the ACC, in a [7]statement .
This enforcement action is a world-first, said the ACCC.
"Between January 2017 and December 2018, consumers were led to believe that 'Location History' was the only account setting that affected the collection of their personal location data, when that simply was not true," Sims added.
Google sent a statement to The Reg :
"The court rejected many of the ACCC’s broad claims. We disagree with the remaining findings and are currently reviewing our options, including a possible appeal. We provide robust controls for location data and are always looking to do more - for example we recently introduced auto delete options for Location History, making it even easier to control your data."
[8]
If you haven't yet stopped Google from collecting personally identifiable location data, you need to switch off the location setting in both your Google Account and the Web & App Activity setting. Already collected personal data can be deleted by the user through their Google Account. ®
Get our [9]Tech Resources
[1] https://www.judgments.fedcourt.gov.au/judgments/Judgments/fca/single/2021/2021fca0367
[2] https://www.accc.gov.au/media-release/correction-accc-alleges-google-misled-consumers-about-expanded-use-of-personal-data
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YHm0lqETqlc5GdV6gt7JRwAAAJY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.judgments.fedcourt.gov.au/judgments/Judgments/fca/single/2021/2021fca0367
[5] https://apnews.com/article/828aefab64d4411bac257a07c1af0ecb
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YHm0lqETqlc5GdV6gt7JRwAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.accc.gov.au/media-release/google-misled-consumers-about-the-collection-and-use-of-location-data
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YHm0lqETqlc5GdV6gt7JRwAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://whitepapers.theregister.com/
Re: Opt In
No I don't think that they (Google) would.
In the old consent form Google had for anyone wanting to use their YouTube service all the settings were set to opt in. With the new look consent form all the options are left blank, neither in or out. So my guess is if you have not positively opted out Google will take that as saying "OK, take all my data to do with as you please."
These people are not to be trusted.
Picking on the big guys again
I wonder (rhetorically) why privacy pundits and regulators only ever seem to go after the big game (that can, incidentally, usually fight back effectively). When we [1]researched GDPR compliance across multiple, jurisdictions, verticals and scales we found that no business in our sample was compliant. The behemoths are not guilty alone.
[1] http://businessinforisk.co.uk/library/Awful_not_Lawful-final-BiR.pdf
Re: Picking on the big guys again
Could it possibly be that taking the smaller, "easier" cases wouldn't get into the news, and wouldn't cause the bigger corporations to stop and think? It might give them the impression that regulators are too scared to go after them?
Conversely, going after the larger corporations, even if you perhaps don't have the complete victory you hoped for (as in this case) will definitely get into the news and may well cause smaller companies to think, if they can take on the might of Google and win, we don't have a chance - better make sure we're doing things properly in case they come knocking.
Just a thought...
Interesting report of yours, by the way.
M.
Re: Picking on the big guys again
There have been several cases in Germany of smaller companies breaching the DSGVO (German name for GDPR - Datenschutzgrundverordnung) and being fined.
The difference between the big companies and the small ones seems to be that the small companies work with the authorities, actively clean-up their act and receive (and accept) smaller fines as a consequence.
The bigger companies kick up a stink, go to court and hope that the lawyers + fine is going to be cheaper than cleaning up their act.
Guess which ones hit the international press? The small companies that comply and pay their fines like chastised children get a small mention in the middle of the new section of specialist IT magazines and portals. The big companies, actually going to court and kicking up a stink get major coverage.
Re: Picking on the big guys again
Winning a court case against one company with a lot of customers will have more beneficial effect than winning one against a company with a few customers.
Admittedly BigCo probably puts up more of a fight, and with the same resources you could have fought 10 SmallCoes. But the chances are that BigCo has thousands more users than those 10 SmallCoes put together.
Re: Picking on the big guys again
My experience in Spain tells me that the majority of sites think it is OK for site visitors to be told they can limit tracking cookies vie their browser or make it as confusing as possible to opt out.
In fact lately, I visit more US Sites that offer simple opt outs than either UK or European ones.
Perhaps GDPR needs a new set of teeth and regulators who will actively employ them.
Re: Picking on the big guys again
I'm seeing more and more that offer "opt-in" options, but the default is almost always show everything turned off but a big, bright "accept everything" button that you are automatically attracted to and a dull grey button that looks like it is disabled for saving your opted-out choices.
Re: Picking on the big guys again
What you want the ACCC to go after the battlers? Like poor old Bing?
And since when the did the GDPR apply in Australia? Did they join the EU?
what amount of trouble was reasonable for users to undergo to protect their data
The correct answer here is 'none'. Sharing your data should always be voluntary. You should never need to turn anything off, out of the box.
Re: what amount of trouble was reasonable for users to undergo to protect their data
But.. but... users won't opt in! They don't know the benefits that constantly tracking and monitoring can get them: personalized ads, pre-approved loans, potency increasing pills, great investment opportunities! Don't forget about protecting them from terrorists and child molesters.
Re: what amount of trouble was reasonable for users to undergo to protect their data
I think that every packet should be accounted for. At least there won't be any intentional or accidental slurping of say MAC data.
If you put your data online, it's gone public. Sooner or later someone is going to hack it, leak it, or get at it via nefarious settings.
The reason why Google go to these lengths is because you want to use these services, but you don't want to pay for them. So they sell advertising and they sell your details to others who wish to advertise to you. If everyone refused to share their details with all online companies, you'd soon find out the real cost of using the sites, apps, etc. that so many take for granted. TANSTAAFL! Look it up people!
You're right. That's why there was no advertising before the internet.
I'm sorry, but you're not as good a mind-reader as you believe you are. I do want to pay for those services.
However, I've yet to see an option appear that says "pay us xx€ and we don't keep any of your data". Did I miss it?
"We provide robust controls for location data"
Yes, made so robust to ensure Google can't lose control of people's location data. This is just another "dark pattern".
on and off is a view feature.
"If you haven't yet stopped Google from collecting personally identifiable location data, you need to switch off "
It's been a while since I read and tested as suggested, but I suspect its the same as it was 2 years ago.
That this only turns off the ability for the user to see the tracking reports.
I think one of the test methods to find this is having google maps on your phone, turned off, tracking turned off, and it will still track you for the "road traffic" which means you are still being tracked, you just don't get to see the report.
If you have a couple people set up like this and they stop in the road, and you are coming up behind them, it will show on your map as traffic stopped ahead.
That is IF its the same as it was
Re: on and off is a view feature.
I'm sure that behaviour was only the result of a bug, or possibly some "test code", left in by an innocent Google software engineer - who had definitely not been authorised to do so by management.
Remember, the computer is your friend!
Opt In
If they changed the law to make it a requirement that users actively opt in to tracking rather than opt out then I bet Google would make it a damn sight easier to find the settings.