Location tracking continues to face scrutiny after Google’s latest data privacy settlement

Next year, Google will be required to add more disclosures about how users’ locations are being tracked and how it’s being used. Information that Google will be required to share includes the types of information collected, sources of the information, whether it’s a precise location, the extent to which users can prevent data from being a factor in personalized ads, and how to delete data if they want to.

In a statement about the settlement, Google said it already made changes to its platforms and that the case was based on “outdated product policies.” However, New Jersey Attorney General Matthew Platkin said the settlement sends a “clear message that we will hold companies accountable.” And in Oregon, Attorney General Ellen Rosenblum said data privacy remains a “top priority” for the state and that a task force will introduce a new bill in the 2023 legislative session to give consumers more control over their data.

“For years Google has prioritized profit over their users’ privacy,” Rosenblum said in a statement. “They have been crafty and deceptive. Consumers thought they had turned off their location tracking features on Google, but the company continued to secretly record their movements and use that information for advertisers.”

This isn’t the only location-related lawsuit Google has faced this year. Last month, it settled with Arizona, paying $85 million after the state charged it with deceptively obtaining users’ location data and profiting from it. Although Monday’s settlement is the highest amount Google has paid related to privacy allegations, the agreement amount is still less than Facebook paid in 2019 when it settled with the Federal Trade Commission for $5 billion over privacy charges related to the Cambridge Analytica scandal.

Beyond Google, other companies have faced location-related legal battles — including the Weather Channel and data broker Kochava — that also call into question how tracking location could affect advertisers.

Jason Sarfati, chief privacy officer of the location intelligence company Gravy Analytics, said a growing volume of sensitive data related to location and biometrics makes it even more important for regulators to update laws to address how both are collected. However, he said he doesn’t expect a new national privacy law to pass during the lame-duck Congress — and probably also not in the next two years — despite some earlier progress this summer.

Even without a new U.S. law, federal agencies have been increasingly vocal about their plans to investigate how companies collect location data. In August, the Federal Communication Commission said it plans to look into whether mobile carriers are complying with current regulations. Meanwhile, the FTC has been vocal about plans to update the agency’s own rules while also pursuing enforcement actions based on existing laws.

Despite the slowness to update the laws, Sarfati said tech companies have in some ways been quicker than other industries to make changes on their own. (He mentioned the tobacco industry which “went down fighting.”)

“We should focus on the good news here, which is that Google on its own understood that there was a problem that needed to be resolved,” he said. “I’m beginning to speculate, but I do think we can comfortably imply from the language of the settlement that Google fixed this in a vacuum from the actual settlement or even the factual allegations that the attorneys general’s relying on. So that is incredibly refreshing.”

Other companies and trade organizations have also made recent changes. For example, in June, the Network Advertising Initiative announced new standards for location tracking which were adopted by companies such as Foursquare, Cuebiq and Precisely PlaceIQ.

“When you have a settlement like this, it draws a lot of attention,” said David DeLuc, NAI’s vice president of public policy. “In many ways, it’s a good thing for the rest of the industry to see that the regulators are paying attention and really care and that they need to be responsible.”

The settlement also shows the need for companies to coordinate privacy issues and practices across all divisions and apps, according to Murat Kantarcioglu, assistant professor of computer science at the University of Texas-Dallas.

“This sends a strong strong message that what you claim you are doing must be aligned with what you are doing,” Kantarcioglu, a visiting scholar at the Harvard Data Privacy Lab, said. “Big companies with different incentives may not be well aligned with respect to what they claim with data privacy….Tracking shouldn’t be this easy.”