The Australian Competition and Consumer Commission (ACCC) announced a legal action against Google “alleging they engaged in misleading conduct and made false or misleading representations to consumers about the personal location data Google collects, keeps and uses” according to the agency’s press release. In its initial filing, the ACCC is claiming that Google mislead and deceived the public in contravention of the Australian Competition Law and Android users were harmed because those that switched off Location Services were unaware that their location information was still be collected and used by Google for it was not readily apparent that Web & App Activity also needed to be switched off. ACCC Chair Rod Sims explained that “[w]e are taking court action against Google because we allege that as a result of these on-screen representations, Google has collected, kept and used highly sensitive and valuable personal information about consumers’ location without them making an informed choice.” Moreover, it is being reported in the Australian press that the ACCC is preparing an anti-competitive action against Google based on its actions against an Australian competitor, Unlockd, that subsequently filed for administration last year.
In its press release, the ACCC claimed
[T]hat from at least January 2017, Google breached the Australian Consumer Law when it made on-screen representations on Android mobile phones and tablets that the ACCC alleges misled consumers about the location data Google collected or used when certain Google Account settings were enabled or disabled. The representations were made to consumers setting up a Google Account on their Android mobile phones and tablets, and to consumers who later accessed their Google Account settings through their Android mobile phones and tablets.
The ACCC stated that its “case regarding the collection of location data focuses on two Google Account settings: one labelled ‘Location History’; and another labelled ‘Web & App Activity’.” The agency alleged “that from January 2017 until late 2018, it was misleading for Google to not properly disclose to consumers that both settings had to be switched off if consumers didn’t want Google to collect, keep and use their location data.’ The ACCC claimed that “when consumers set up a Google Account on their Android phone or tablet, consumers would have incorrectly believed, based on Google’s conduct, that ‘Location History’ was the only Google Account setting that affected whether Google collected, kept or used data about their location.” The agency further added that “if consumers later accessed their Google Account settings on their Android device, Google did not inform them that by leaving ‘Web & App Activity’ switched on, Google would continue to collect location data.”
The ACCC stated its allegations “that from around mid-2018 until late 2018, Google represented to consumers that the only way they could prevent Google from collecting, keeping and using their location data was to stop using certain Google services, including Google Search and Google Maps.” The ACCC noted that “this could be achieved by switching off both ‘Location History’ and ‘Web & App Activity’.”
In terms of possible liability, since much of Google’s alleged conduct occurred before a rewrite of the Australia Competition Law that will allow for higher possible fines, including up to 10% of annual turnover and/or A$10 million per violation, any possible fine could be relatively small (on the order of A$1.2 million per violation). This is not Google’s first privacy violation fine this year. In January, France’s Commission nationale de l’informatique et des libertés (CNIL) aka (the French Data Protection Authority) levied a €50 million fine under the General Data Protection Regulation (GDPR) “for lack of transparency, inadequate information and lack of valid consent regarding the ads personalization.” In September, the Federal Trade Commission (FTC) and New York Attorney General Leticia James announced a $170 million settlement with Google and its subsidiary YouTube regarding alleged violations of the “Children’s Online Privacy Protection Act of 1998” (COPPA) and Section 5 of the FTC Act. To date, this is the largest settlement to resolve alleged COPPA violations.
Earlier this year, the ACCC released its final report from its “Digital Platforms Inquiry” that “proposes specific recommendations aimed at addressing some of the actual and potential negative impacts of digital platforms in the media and advertising markets, and also more broadly on consumers.” Not surprisingly, the report focuses entirely on Facebook and Google but not Amazon, which the ACCC remarked was still relatively small in Australia.
Moreover, the ACCC explained
Many digital platforms increasingly collect a large amount and variety of user data. The data collected often extends far beyond the data users actively provide when using the digital platform’s services. Digital platforms may passively collect data from users, including from online browsing behaviour across the internet, IP addresses, device specifications and location and movement data. Once collected, digital platforms often have broad discretions regarding how user data is used and also disclosed to third parties.
The ACCC articulated its “view that consumers’ ability to make informed choices is affected by:
The information asymmetry between digital platforms and consumers. The ACCC found that consumers are generally not aware of the extent of data that is collected nor how it is collected, used and shared by digital platforms. This is influenced by the length, complexity and ambiguity of online terms of service and privacy policies. Digital platforms also tend to understate to consumers the extent of their data collection practices while overstating the level of consumer control over their personal user data.
Michael Kans 