Two years ago, the Arizona Attorney General sued Google for allegedly tricking people into giving up their location data, even after they tried to turn off the company’s location data settings. Google agreed to pay $US85 million (around $130 million) to settle the lawsuit this week and fix an incorrect description of what its Location History setting actually does. The search giant tried to demystify its handling of your location data a bit. Experts and Gizmodo’s own attempts suggest the company’s success was middling at best and intentionally confusing at worst.
Google has a setting called Location History. It controls whether or not Google makes a nice little map you can look at with a list of where you’ve been. What it doesn’t control is whether Google collects your location data. It used to be pretty hard to figure that out; for years the company’s help page said “With Location History off, the places you go are no longer stored.” If you wanted to stop location data collection altogether, though, you had to adjust a second setting, called Web & App Activity.
That’s still true. Location History still doesn’t turn off location data collection, the only thing that’s changed is Google’s description of what the setting does. Google did not respond to a request for comment.
Now when you turn off Location History, you see a popup — which starts by telling you about all reasons you should leave the setting on — and then mentions in paragraph three of six that “This setting does not affect other location services on your device.”
“There’s a lot of fine print when you pause location history. Most people aren’t going to read it, and even if you do, it is confusing,” says Lorrie Cranor, a professor at Carnegie Mellon University whose research includes privacy settings and interfaces. “I’m a privacy expert and I still find it difficult to understand exactly what is getting turned off.”
The change is definitely an improvement. The original settings were so confusing that even Google employees complained about them. “Speaking as a user, WTF? More specifically I **thought** I had location tracking turned off on my phone,” one Google engineer said, according to documents that surfaced during the lawsuit.
Google did fix the problem which prompted the Arizona lawsuit. The language describing the Location History control isn’t literally incorrect anymore. But if you don’t read carefully, it would be easy to adjust the Location History setting without realising that Google would still be following you around.
If it sounds familiar, that’s because there was a similar case in Australia. In August, Google agreed to pay $60 million in penalties to settle claims that it misled some users about personal location data collected through Android devices for two years.
The settlement was a big monetary win for Arizona. “I am proud of this historic settlement that proves no entity, not even big tech companies, is above the law,” Arizona Attorney General Mark Brnovich said in a press release. But the settlement doesn’t force Google to make any changes, or lay out rules about the company’s behaviour going forward. Google didn’t admit any wrongdoing in the settlement, but the company is facing lawsuits over the same issue in Washington, D.C., Indiana, Texas, and Washington State.
The Arizona settlement is emblematic of issues that keep cropping up in tech industry regulation, says Jonathan Mayer, a professor at Princeton University, who consulted on the original report that uncovered Google’s location settings problem.
“Settling claims for a cash penalty and modest concessions is usually much easier than changing how a company does business,” Mayer says. “Privacy litigation in the U.S. is often grounded in consumer deception claims. If a company simply updates its notice to users, that can be sufficient for legal compliance.”
The real problem for privacy fans is there are very few laws about how companies handle your data in the United States. The government has come closer than ever to passing a comprehensive privacy law this year, but it’s stalled in Congress, and it’s likely to get watered down if it ever passes.
For now, it’s business as usual. Companies can basically do whatever they want with your data. They can’t lie to you about it, but they can make it quite difficult to determine the truth.