Oregon Attorney General Ellen Rosenblum today, along with 39 other state attorneys general, announced an historic $391.5 million settlement with Google over its location tracking practices. The settlement, which was led by Oregon AG Rosenblum and Nebraska AG Doug Peterson, is the largest attorney general-led consumer privacy settlement ever. Because of Oregon’s leadership role in the bipartisan investigation and settlement, Oregon will receive $14,800,563.
As outlined in the settlement, Google misled its users into thinking they had turned off location tracking in their account settings, when, in fact, Google continued to collect their location information. In addition to the multimillion-dollar settlement, as part of the negotiations with the AGs, Google has agreed to significantly improve its location tracking disclosures and user controls starting in 2023.
“For years Google has prioritized profit over their users’ privacy,” said Attorney General Rosenblum. “They have been crafty and deceptive. Consumers thought they had turned off their location tracking features on Google, but the company continued to secretly record their movements and use that information for advertisers.”
Location data is a key part of Google’s digital advertising business. Google uses the personal and behavioral data it collects to build detailed user profiles and target ads. In fact, location data is among the most sensitive and valuable personal information Google collects. Even a limited amount of location data can expose a person’s identity and routines and can be used to infer personal details.
The attorneys general opened the Google investigation following a 2018 Associated Press article that revealed Google “records your movements even when you explicitly tell it not to.” The article focused on two Google account settings: Location History and Web & App Activity. Location History is “off” unless a user turns on the setting, but Web & App Activity, a separate account setting, is automatically “on” when users set up a Google account, including all Android users.
“Consumer privacy is one of my office’s top priorities. That’s why it’s so important to me that Oregon played a key role in this settlement. Until we have comprehensive privacy laws, companies will continue to compile large amounts of our personal data for marketing purposes with few controls,” continued AG Rosenblum.
The attorneys general found that Google violated state consumer protection laws by misleading consumers about its location tracking practices since at least 2014. Specifically, Google confused its users about the extent to which they could limit Google’s location tracking by adjusting their account and device settings.
The settlement requires Google to be more transparent about its practices. In particular, Google must:
- Show additional information to users whenever they turn a location-related account setting “on” or “off”;
- Make key information about location tracking unavoidable for users (i.e., not hidden); and
- Give users detailed information about the types of location data Google collects and how it’s used at an enhanced “Location Technologies” webpage.
In 2019, Attorney General Rosenblum formed the Oregon Consumer Privacy Task Force to answer the growing call for legislation that would give consumers more control over their online privacy and require businesses to adhere to basic standards when handling personal information. The task force has now grown into more than 150 participants from a variety of perspectives.
The task force will introduce comprehensive consumer data privacy legislation in the upcoming 2023 legislative session. If the bill is successful, consumers will have more control over their personal data. They will have the right to know what personal information a company is collecting, to whom or where their data was disclosed, and they will receive a copy of all the data a company has about them. Companies would also need to correct inaccuracies in personal data or delete their information. In addition, the task force plans to introduce companion legislation to create a state registry of data brokers, companies that often operate under the radar but make billions selling personal consumer data.
In addition to Oregon and Nebraska, the other states assisting in the negotiations include: Arkansas, Florida, Illinois, Louisiana, New Jersey, North Carolina, Pennsylvania, and Tennessee. The settlement is also joined by Alabama, Alaska, Colorado, Connecticut, Delaware, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Nevada, New Mexico, New York, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Utah, Vermont, Virginia, and Wisconsin.
Attorney General Rosenblum thanked and congratulated her Consumer Protection (CP) team, particularly CP Chief Kelly Harpster and Assistant Attorney General Kristen Hilton, who co-led the successful negotiations. In addition, she expressed her appreciation to all the states that assisted in the complex negotiations, especially the Attorney General and staff of the co-lead state of Nebraska.