Google agreed to pay $391.5 million to settle charges it misled millions of users regarding a setting that tracked location data without their knowledge, according to an agreement the company reached with a coalition of 40 state attorneys general announced Monday.

The monetary total represents the largest attorney general-led consumer privacy settlement in U.S. history, according to press releases from the Oregon and Nebraska attorneys general, who led the coalition.

The states launched a probe into Google’s location data collection and practices following an Associated Press report in 2018 that found the search engine giant continued to track people’s location data even after they opted out.

“Google uses the personal and behavioral data it collects to build detailed user profiles and target ads on behalf of its advertising customers,” said the Office of the New York Attorney General in a press release. “Location data is among the most sensitive and valuable personal information Google collects. Even a limited amount of location data can expose a person’s identity and routines and can be used to infer personal details.”

Google allegedly misled users regarding location tracking through two account settings: “Location History” and “Web & App Activity.”

“Location History” is a setting that tracks user locations and is defaulted as off, unless a user turns it on. As required, Google notified users of this setting when using its products, such as Google Maps, Google Search, Google Chrome, and other apps.

But the other setting that tracked location data, “Web & App Activity,” was defaulted as on without notifying consumers, according to the attorneys general.

Compliance considerations: As part of the settlement, as published by the New York AG, Google must be more transparent with consumers, including by:

  • Showing additional information to users whenever they turn a location-related account setting “on” or “off”;
  • Making key information about location tracking unavoidable for users (i.e., not hidden); and
  • Giving users detailed information about the types of location data it collects and how it’s used at an enhanced “Location Technologies” webpage.

Google will begin implementing these changes in 2023, according to the Oregon AG.

Google response: In a blog post Monday, Marlo McGriff, Google’s director of product, geo, and David Monsees, product lead, search, wrote the settlement “is another step along the path of giving more meaningful choices and minimizing data collection while providing more helpful services.”

The post noted the tech giant launched auto-delete controls, incognito mode in Google Maps, and new transparency tools since 2019.

“Consistent with improvements we’ve made in recent years, we have settled this investigation, which was based on outdated product policies that we changed years ago,” said Google spokesperson José Castañeda in an emailed statement.

The company neither admitted nor denied liability in reaching the agreement.

Jeff Dale is the Digital Editor of Compliance Week. He previously worked as a copy editor with the Boston Herald and Patriot Ledger in Quincy, Mass., and is a former city editor of The Hour Publishing Co. in Norwalk, Conn.

Topics