ACCC wants transparency from Google about data practices and disclosure for location data obtained from users

Anthony J Cordato

The ACCC wants transparency in data practices by digital platforms to enable users to make informed choices on what personal information they provide is to remain private.

In its 2018-2019 Annual Report, the ACCC (the Australian Competition & Consumer Commission) states, as a priority:

competition and consumer issues concerning the use of digital platforms, algorithms and consumer data, with a focus on emerging markets, transparency of data practices, the adequacy of disclosure to consumers and matters identified by the ACCC’s Digital Platforms Inquiry

In the ACCC Digital Platforms Inquiry Final Report (published on 26 July 2019), Chapter 7 deals with Digital platforms and consumers. These are some extracts:

Location data is highly valued in the serving of targeted advertising, or other marketing related purposes. It is particularly valuable to advertisers as it can provide a greater indication of a consumer’s preferences.
The prevalence and specificity of location data also presents particular issues in terms of tracking of individual consumers as, combining various points of location data, businesses are able to build up a map of a consumer’s activity that is capable in some instances of identifying a unique consumer.
Key Finding: Despite consumers being particularly concerned by location tracking, online tracking for targeted advertising purposes, and third-party data-sharing, these data practices are generally permitted under digital platforms’ privacy policies.
Key Finding: Several features of consumers’ current relationship with digital platforms prevent consumers from making informed choices. They include bargaining power imbalances, information asymmetries between digital platforms and consumers and inherent difficulties for consumers to accurately assess the current and future costs of providing their user data.

So it comes as no surprise that the ACCC has commenced legal proceedings against Google in the Federal Court of Australia for inadequate disclosure to users of Android Devices (mobile phones and tablets) that it would use personal data obtained and retained about their location for purposes other than the user’s use of personal services.

The ACCC alleges that this contravenes the Australian Consumer Law.

The ACCC is seeking penalties, declarations and orders requiring the publication of corrective notices and the establishment of a compliance program from Google. See ACCC Media Release: Google allegedly misled consumers on collection and use of location data

The legal case against Google

The ACCC’s case is based on two representations made by Google, the collection of data representation and the use of data representation. The representations are made to users when using the Android Operating System to set-up their Google Accounts.

The Collection of data representation

On set-up, a ‘Privacy and Terms’ screen appears on which Google discloses that it may collect and use personal information including searches and location (such as when using Google Maps). At the end of the screen a heading appears ‘You’re in control’ which notifies the user that by clicking the ‘More Options’ link, the user can adjust the controls.

The link is to the ‘Setup Location Statements’ screen, on which a heading appears ‘Location History’ which gives the user the choice between ‘Save my Location History in my Google Account’ or ‘Don’t save my Location History in my Google Account’. The default setting is ‘Don’t save my Location History …’.

The ACCC alleges that Google has misled consumers because it did not, at the same time, notify or alert the consumer that Google would continue to collect personal data about the user’s location because this was authorised by the “Web & App Activity” setting, for which the default setting was “on”.

“We [the ACCC] allege that Google misled consumers by staying silent about the fact that another setting [the Web & App Activity] also had to be switched off” [for location privacy] ACCC chair Mr Sims said.

The Use of data representation

The ACCC alleges that ‘Google did not disclose that the data may be used by Google for a number of other purposes unrelated to the consumer’s use of Google Services’. These purposes include:

to personalise advertisements for other users;
to infer demographic information;
to measure the performance of advertisements;
to promote, offer to supply or supply advertising services to third parties; or
to produce anonymised, aggregated statistics (such as store visit conversions statistics) and sharing those statistics with advertisers.

“We consider that because of Google’s failure to disclose this use of data, consumers were and still deprived of the opportunity to make an informed choice about whether to share their personal location date with Google,” Mr Sims said.

The legal grounds for relief are:

s 18 ACL – misleading or deceptive conduct or conduct likely to mislead or deceive
s 29 ACL – representations that the Android Operating System, Google Services or Pixel phones had performance characteristics, uses or benefits they did not haves
s 33 or s 34 ACL – conduct that is liable to mislead the public as to the nature, characteristics and the suitability for purpose of the Android Operating System, Google Services or Pixel phones

The ACCC alleges Google caused harm to consumers in these ways:

the misleading information provided by Google meant that users were not able to make an informed choice about the personal data in relation to their location that they wished Google to obtain and use:
if consumers had been able to make an informed choice they may have taken steps to stop Google obtaining and retaining the personal data in relation to their location;
the private information of many users – the personal data in relation to their location – has been obtained, retained and used by Google (including for its own purposes) without those users’ knowledge.

Comments

The ACCC is not using the Privacy Law to pursue Google, but the Australian Consumer Law for misleading and deceptive conduct and misrepresentations.

An important reason why the ACCC has chosen proceed under the Australian Consumer Law is that the standard of proof is lower – ‘conduct likely to mislead’ (not actually mislead), coupled with a reverse onus of proof because the representations are with respect to future matters (s 4 ACL).

Another reason is that the ACCC does not consider that the Privacy Law is strong enough. In the ACCC’s Digital Platforms Inquiry Final Report, Recommendation 16 is to strengthen protections in the Privacy Act:

Update ‘personal information’ definition: Update the definition of ‘personal information’ in the Privacy Act to clarify that it captures technical data such as IP addresses, device identifiers, location data, and any other online identifiers that may be used identify an individual.
Strengthen notification requirements: Require all collection of personal information to be accompanied by a notice from the APP entity collecting the personal information (whether directly from the consumer or indirectly as a third party), unless the consumer already has this information or there is an overriding legal or public interest reason.

The ACCC is not alone in pursuing Google. Google’s location tracking practices and representations are currently facing class-action lawsuits for potential violation of the US State of California’s privacy laws.

The fact that the ACCC has brought this case is a signal to digital platforms that the ACCC expects digital platforms to clearly indicate in their Privacy Terms that they are collecting and may use the user’s personal data, and how a user may ‘opt-out’.

Marketing Commentary by Michael Field from EvettField Partners

Why would Google go to such lengths to hide the fact that it is collecting and using your location data?

The answer is simple – follow the money!

Google / Alphabet has substantial market power in supplying general search services and search advertising.

Google generated advertising revenue of US$116.3 billion worldwide in 2018 through its Google Ads platform, which enables advertisers to display ads, product listings and service offerings across Google’s extensive ad network (properties, partner sites, and apps) to web users.

Google provides advertisers with consumer data about their target market customers so they can influence them, connect with them or sell to them. The information that has the most value is location data, search history, purchasing power, purchasing behaviours and intention.

Consumers understand that Google search and advertising services are provided as a ‘free service’. A consumer may be willing to exchange personal information with a digital platform in exchange for a reasonable benefit from this ‘free service’.

For example, conducting an online search for ‘cheap fast food in Glebe’ will result in both free and paid advertising listings to be displayed on a search engine. The consumer may be willing to have that online search information shared with a digital platform and then on-sold to businesses that offer food, food delivery or meal preparation services in Glebe. However, the consumer may lose confidence in the platform if they know that all of their online search information, including search history and location data is being collected and sold for commercial benefit.

Since the US Congressional hearings when Facebook’s Mark Zuckerberg gave testimony on the Cambridge Analytica scandal, there has been a steadily growing mistrust of digital platforms, and how they collect, store and use personal data. When consumers lose trust in a platform, they will look for alternatives. New search engines such as DuckDuckGo prioritise protecting searchers' privacy and do not deliver ‘personalised search results’ which can only be achieved by collecting and storing personal data.

Google needs ‘come clean’ and tell users what personal information / location data it is collecting, why it is collecting the data, how it intends to use it, and give users the choice to opt-out.