WASHINGTON — Google agreed to a record $391.5 million privacy settlement with a 40-state coalition of attorneys general on Monday for charges that it misled users into thinking they had turned off location tracking in their account settings even as the company continued collecting that information.
Under the settlement, Google will also make its location tracking disclosures clearer starting in 2023.
The attorneys general said that the agreement was the biggest internet privacy settlement by U.S. states. It capped a four-year investigation into the internet search giant’s practices from 2014-2020, which the attorneys general said violated the states’ consumer protection laws.
Google said it had already corrected some of the practices mentioned in the settlement. “Consistent with improvements we’ve made in recent years, we have settled this investigation which was based on outdated product policies that we changed years ago,” said José Castañeda, a spokesman for the company.
States have taken an increasingly central role in reining in the power and business models of Silicon Valley corporations, amid a vacuum of action from federal lawmakers.
More than four years after Europe rolled out data privacy rules for its citizens, Congress and regulators have failed to agree to a federal data protection law in the United States. Lawmakers have squabbled over details of privacy proposals, and tech giants have deployed armies of lobbyists to water down or destroy legislation.
In lieu of federal law, states including California, Colorado and Virginia have enacted their own privacy rules, creating a patchwork of regulations that artificially begin and end at state boundaries. State attorneys general have also policed tech giants through lawsuits and have settled or have active litigation against Google, Meta, Apple and Amazon over claims of antitrust violations, harmful speech, privacy breaches and illegal labor practices.
While there is broad bipartisan support for some sort of federal privacy legislation, Republicans and Democrats have disagreed for nearly a decade about how far rules should go to curb business models like Google’s that rely on data collection to sell targeted ads. Information about a user’s whereabouts and location history can be particularly valuable to retailers hoping to serve up real-time promotions and more personalized ads. Privacy groups have protested sensitive geolocation tracking, which can reveal the identity of users, though companies say such data is anonymized.
In the location privacy settlement, the state attorneys general claimed that Google gave the false impression that when users turned off location tracking services, the company no longer collected geolocation data about them. But through Google’s broad array of other services like search, maps and apps that connect to Wi-Fi and cellular phone towers, the company continued amassing and storing an intricate history of users’ movements, according to the states.
Until May 2018, Google even tracked the location of users who had logged out of Google apps, an action that could lead a consumer to believe location tracking had been disabled, the attorneys general said.
“For years, Google prioritized profit over the privacy of people who use Google products and services,” said Ellen Rosenblum, the Oregon attorney general, who led the case along with Nebraska. “Consumers thought they had turned ‘off’ their location tracking features on Google, but the company continued to secretly record their movements and use that information for advertisers.”
In addition to paying the monetary sum, which will go to state coffers, Google has promised to make clearer how it collects location data, including what kinds of data it can still accumulate when location tracking is disabled for one setting but not for others. The company must also notify users about how to disable location tracking, delete the data collected by the settings and set data retention limits. Users will be notified by pop-up boxes and more detailed information on Google’s informational page about location technologies.
The states’ investigation began after a 2018 Associated Press article on Google’s misleading location tracking practices. The attorneys general looked at Google’s practices from 2014 to 2020, which they said violated state consumer protection laws that forbid companies from misleading and deceiving consumers.
Last month, Google separately settled a similar location tracking lawsuit with Arizona for $85 million. Google faces additional lawsuits brought by Washington, D.C., Indiana and Texas for deceptive location tracking.
Other states leading the investigation in Monday’s settlement include Arkansas, Florida, Illinois, Louisiana, New Jersey, North Carolina, Pennsylvania and Tennessee.