Endpoint Security , Governance & Risk Management , Next-Generation Technologies & Secure Development
Google Hit With Lawsuit Over Location Tracking
Tech Giant Clarifies: Pausing 'Location History' Alone Won't Stop All TrackingA lawsuit accuses Google of "the surreptitious location tracking of millions of mobile phone users via its Android mobile operating system and mobile apps."
See Also: A Closer Look at Password Strength
The plaintiff in the lawsuit, filed in U.S. District Court in the Northern District of California on Friday, is Napoleon Patacsil of San Diego. He says he's owned an iPhone since 2016 and set his "location history" to "off" in an effort to prevent Google and other third parties from tracking his location, according to the complaint, which was filed by Michael Sobol, a partner at Lieff Cabraser Heimann & Bernstein.
"Nevertheless, Google continued to track his location information," claims the lawsuit, which accuses Google of violating the U.S. Children's Internet Protection Act as well as the Penal Code of California, and more broadly users' "reasonable expectations of privacy." The complaint seeks class action status and a trial by jury.
"Despite users' attempts to protect their location privacy, Google collects and stores users' location data, thereby invading users' reasonable expectations of privacy, counter to Google's own representations about how users can configure Google's products to prevent such egregious privacy violations," the lawsuit states.
The lawsuit seeks both "damages and punitive damages in an amount to be determined at trial," calling for the latter "because Google's actions - which were malicious, oppressive and willful - were calculated to injure plaintiff and class members and made in conscious disregard of [their] rights. Punitive damages are warranted to deter Google from engaging in future misconduct."
Google declined to comment.
Associated Press Report Sparks Lawsuit
The lawsuit was sparked by an Aug. 13 Associated Press report that some Google apps tracked and time-stamped users' locations even if a user deactivated the "location history" setting..
Google's location history support page stated: "You can turn off location history at any time. With location history off, the places you go are no longer stored."
But the AP found that some Google apps, even after location history was turned off, continued to "automatically store time-stamped location data without asking."
The AP said it had confirmed its findings with a researcher in the lab of Jonathan Mayer, the former chief technologist for the Federal Communications Commission's enforcement bureau, who's now a computer scientist at Princeton University.
Google initially dismissed the assertions. "We provide clear descriptions of these tools and robust controls so people can turn them on or off, and delete their histories at any time," a spokesman told AP.
Google Revises Location History Description
On Friday, however, Google changed tack, and said that some of its services do continue to track users, even if the location tracking setting has been disabled.
Google's location history support page now reads: "Some location data may be saved as part of your activity on other services, like Search and Maps."
Some privacy watchers expect the FCC to take a closer look at how Google was tracking users' locations. The FCC didn't immediately respond to a request for comment about whether it plans to launch an investigation.
But Princeton's Mayer says he doesn't think Google was acting maliciously, but rather that it had described what it was doing - or not doing - very poorly.
"I think location history is poorly named, explained and designed, and I'm glad Google is rethinking it," Mayer said via Twitter.
Google has revised its explanation of what happens when you turn off Location History.
— Jonathan Mayer (@jonathanmayer) August 16, 2018
I've received some Qs about whether I think Google intentionally misled users. I don't. I think Location History is poorly named, explained, and designed, and I'm glad Google is rethinking it. pic.twitter.com/DK88Xp7bEf
Researcher Discovered Tracking
The AP says it was alerted to the location history problems via K. Shankari, a graduate researcher at UC Berkeley who studies volunteers' travel patterns to help community designers and urban planners to design better transportation options.
Shankari said she began looking into Google's location tracking after being prompted by Google Maps on her Android smartphone to rate her visit to a Kohl's department store, even though she'd deactivated location history and could find no reference to such tracking in any of Google's privacy policies. "I clearly wasn't using Google Maps to navigate the racks at Kohl's, and I hadn't even used it to get there. So how did Google Maps know where I was?" Shankari wrote in a May blog post.
In May, Google initiated an updated privacy policy in response to the EU's General Data Protection Regulation going into effect. "I was curious to see whether they had made any changes in location tracking, and they had. And the changes seem to answer some of my questions and raise a host of others," Shankari said.
Shankari told AP that Google's changes were a "good step forward," but added "they can make it better." In particular, she says a setting called "web & app activity" can be deactivated, which will stop Google apps from recording and time-stamping a user's location data.