In the largest multistate data privacy settlement in U.S. history, Google agreed to a $391.5 million settlement with 40 states. Following a 2018 article by the Associated Press, the states’ attorneys general investigated and learned that Google was tracking people’s location information regardless of their privacy settings, says CBS News. Google allegedly misled users; they tracked user locations even when they were logged out of Google apps.

The state attorneys general involved in the investigation said Google was using the location data to target consumers with ads related to their location data, making it easier to identify a person’s identity and routines and also violating consumer protection laws.

“Consumers thought they had turned ‘off’ their location tracking features on Google, but the company continued to secretly record their movements and use that information for advertisers,” said said Ellen Rosenblum, the Oregon attorney general, in a November 14, 2022 statement.

“Consumer privacy is one of my office’s top priorities. That’s why it’s so important to me that Oregon played a key role in this settlement. Until we have comprehensive privacy laws, companies will continue to compile large amounts of our personal data for marketing purposes with few controls,” Rosenblum added.

Connecticut Attorney General William Tong also commented on the settlement in a statement.

“This $391.5 million settlement is a historic win for consumers in an era of increasing reliance on technology. Location data is among the most sensitive and valuable personal information Google collects, and there are so many reasons why a consumer may opt-out of tracking,” said Attorney General Tong.

In their article, the AP said that approximately 2 billion Android users who use Google’s operating system and hundreds of millions of iPhone users who used Google maps or Google search were impacted.

In addition to the settlement, Google said it will make its practices more transparent to users starting in 2023. The practices will include showing users when they can turn location settings on and off, and providing users with a webpage that shares information with users about the data Google collects. Some of their practices have already been corrected, reports The New York Times. Google will be required to notify users how to disable location tracking, delete data already collected, and set data retention limits.

“Consistent with improvements we’ve made in recent years, we have settled this investigation, which was based on outdated product policies that we changed years ago,” said José Castañeda, a spokesman for the company.

In October, Arizona Attorney General Mark Brnovich agreed to an $85 million settlement with Google for tracking user locations to sell ads, reports USA Today. In May 2020, the Arizona attorney general sued Google, alleging they tracked user locations through the use of deceptive practices and design tactics built into their software.

In January, the states of Indiana, Texas, Washington and the District of Columbia also filed suits against Google, reports The New York Times.

“Google falsely led consumers to believe that changing their account and device settings would allow customers to protect their privacy and control what personal data the company could access,” said Karl A. Racine, attorney general for the District of Columbia. “The truth is that contrary to Google’s representations it continues to systematically surveil customers and profit from customer data.”

Insider Take

The European Union kicked off date privacy investigations and settlements following their enactment of General Data Protection Regulation (GDPR) on May 25, 2018. Since then, several U.S. states have enacted their own privacy regulations. Companies like Google who were already in violation skated under the radar for a while, but it looks like the veil has been lifted. We expect to see more of these kinds of cases in the future.

Even this huge settlement, however, is unlikely to deter companies like Google who may try to get away with this type of behavior in the future. For example, during the third quarter of 2022, Google had total revenue of $69.1 billion with $54.5 billion coming from Google advertising alone. Year-to-date, Google reported $206.8 billion in revenue. A settlement of $391.5 million is just a fraction of what Google made in one quarter. This isn’t even a slap on the wrist to them, especially when the settlement is spread out among 40 states. The benefit of such a settlement is really awareness – letting users know what’s really happening behind the curtain and letting Google know that, while they may get away with dark patterns for a while, they will eventually get caught.