Privacy, Data Security, Compliance Management

Google pays $39.9M to end Washington’s location tracking, privacy lawsuit

Google Maps

In an agreement to resolve allegations over Google's misleading location tracking practices, the tech giant has agreed to pay the state of Washington $39.9 million and to implement court-ordered reforms to increase transparency about its location tracking settings.

Washington Attorney General Bob Ferguson first filed a lawsuit against Google that claimed it “deceptively led consumers to believe that they have control” over how the platform collects and uses their location data. The lawsuit claimed consumers were unable to effectively prevent Google from not only collecting and storing their data, but profiting from it as well.

In addition to a multi-state investigation into Google’s geolocation practices, Ferguson filed a lawsuit in King County Superior Court on behalf of Washington residents in January 2022.

Both the lawsuit and investigation were initiated after reports showed Google possibly misled consumers with its “Web and App Activity” settings. In 2018, AP data showed Google was using deceptive and unfair practices to obtain users’ "consent" to be tracked, which made it “nearly impossible for users to stop Google from collecting their location data.”

Among its claims, Google was accused of collecting location data even when users disabled location history, misleading descriptions in location settings, tracking Android devices even when location access was turned off, and “repeatedly nudging users to consent to location tracking,” among other allegations.

What’s more, the lawsuit asserted that the tech company “profits significantly” from selling consumer data for advertising purposes, and location data is allegedly the key to Google’s advertising business.

For example, when users enable the “Location History” setting, Google allegedly saves the location data of the users to provide more personalized recommendations.

“For years, Google’s help page stated, ‘With Location History off, the places you go are no longer stored.’ That statement was false,” according to the lawsuit. “For example, the company collects location data under a separate setting — ‘Web & App Activity’— that is defaulted ‘on’ for all Google Accounts.”

Google sought to have the lawsuit dismissed in May 2022, which was blocked by a King County Superior Court judge.

The settlement will resolve the state’s allegations. Ferguson said funds from the fine will be used for continued enforcement of the state’s Consumer Protection Act, as well as future actions aimed to protect the data privacy of its residents. Washington’s Consumer Protection Division is largely funded through recoveries made through these types of enforcement actions.

“Google denied Washington consumers the ability to choose whether the company could track their sensitive location data, deceived them about their privacy options and profited from that conduct,” Ferguson said in a statement.

In addition to the monetary fine, Google is required to be more transparent with consumers about its tracking and use of consumer data. The new data privacy requirements include providing additional information to users when location-related accounts settings are enabled, including the sources, purpose, and retention of location data.

Google is also required to make sure users can view location tracking details and establish an enhanced “Location Technologies” webpage, which will provide insights into the types of location data  collected by Google and how it is used by the company.

The tech giant is currently facing an inquiry by the Department of Justice and a bipartisan group of state attorneys general in an antitrust lawsuit, which is seeking to break up “Google’s monopolization of display advertising.” They claim Google’s online display advertising market has “funneled” more business through its services and impacted the profits of competing companies.

Google is also facing multiple class-action lawsuits filed in the wake of the pixel-tracking reports and dozens of breach notices that claim the use of Google and Meta pixel-tracking tools allowed for the scraping of health data.

Jessica Davis

The voice of healthcare cybersecurity and policy for SC Media, CyberRisk Alliance, driving industry-specific coverage of what matters most to healthcare and continuing to build relationships with industry stakeholders.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.