WASHINGTON, D.C. – Attorney General Karl A. Racine today sued Google, LLC for deceiving and manipulating consumers to gain access to their location data, including making it nearly impossible for users to stop their location from being tracked. Three other attorneys general also plan to file lawsuits in their own state courts in a bipartisan, coordinated effort to hold Google accountable for misleading and violating the privacy of its users. 

The Office of the Attorney General (OAG) alleges that since at least 2014, Google has systematically deceived consumers about how their locations are tracked and used and has misled consumers to believe that they can control what information Google collects about them. In reality, there is effectively no way for consumers to prevent Google from collecting, storing, and profiting from their location data. Google’s deceptive location tracking practices impact users of smartphones running on the company’s Android operating system, but they also extend to consumers who use Google products, including Google search and Google Maps, on non-Android devices. With the lawsuit, OAG is seeking to stop Google’s deceptive and unlawful practices, ensure that the company cannot undermine consumers’ ability to protect their privacy, and seek penalties for the violations. The attorneys general of Indiana, Texas, and Washington are also filing lawsuits against Google in their own state courts.

“Google falsely led consumers to believe that changing their account and device settings would allow customers to protect their privacy and control what personal data the company could access,” said AG Racine. “The truth is that contrary to Google’s representations it continues to systematically surveil customers and profit from customer data. Googles bold misrepresentations are a clear violation of consumers’ privacy. I’m proud to lead this bipartisan group of attorneys general that will hold Google accountable for its deception. Through this lawsuit, we will hold Google accountable, and in the process, educate consumers on how their personal data—particularly sensitive data about their physical location—is collected, stored, and monetized. This result of our collective action is that consumers, not Google, will determine how their data is or is not used.”

Google’s business model relies on constant surveillance of its users. Through its many products and services—including Google Search, Google Maps, Gmail, YouTube, the Chrome web browser, the Google Play Store, and the Android operating system—the company collects and analyzes personal and behavioral data from billions of users. Based on this information, Google builds detailed user profiles and sells highly targeted advertising. Location data is a key part of Google’s digital advertising business, which generated nearly $150 billion in revenue in 2020 alone. Location data is also among the most sensitive and valuable personal information Google collects. Even a limited amount of location data can expose a person’s identity and routines and can be used to infer personal details.

Google collects location information when consumers use its broad array of services, including Google Search, Google Photos, or Google Maps, on any device. This includes users of Google’s own Android operating system—which runs billions of cellphones worldwide—but it also affects consumers who use Google services on iPhones, tablets, and computers.

OAG opened an investigation into Google’s location tracking practices following a 2018 Associated Press story revealing that Google “records your movements even when you explicitly tell it not to.” OAG’s investigation found that Google violated state consumer protection laws, including the District’s Consumer Protection Procedures Act (CPPA), which prohibits unfair and deceptive trade practices. The District led the bipartisan coalition in assembling the states’ legal complaints, which allege that Google harmed consumers by:

• Making it impossible for users to opt out of having their location tracked: Google claims to offer consumers choices about what personal data the company collects through customizable controls. In fact, Google’s claims that it gives consumers “control” and respects their “choice” largely serve to obscure the reality that, regardless of the settings they select, consumers have no option but to allow Google to collect their location data. Even if a user adjusts settings in their account or their device that they believe will stop their location data from being saved or transmitted, Google can still collect and store their location through Google apps on the user’s device, Wi-Fi and Bluetooth scans from the user’s device, the user’s IP address, or through other methods.
   
• Deceiving users about their ability to protect their privacy through account settings: Since at least 2014 through the present, Google has made misleading promises that users with Google accounts can control the information that Google collects, stores, and uses about them by adjusting their Google Account settings. From 2014 to at least 2019, Google publicly claimed that users could simply turn off their “Location History” setting and that “[w]ith Location History off, the places you go are no longer stored.” That is false. Even when Location History is off, Google continues to collect and store users’ locations. Initially, Google failed to disclose that another setting, “Web & App Activity,” also allowed Google to collect data, including location data, when users interacted with Google products, and that setting was enabled automatically in accounts. Google has suggested that by “pausing” the Web & App Activity setting, users could prevent their searches and activity data, including their location, from being saved and associated with their account. However, even when users disable Web & App Activity and Location History, Google continues to store location data when a user interacts with some Google products.
   
• Misleading Android users about their ability to protect their privacy through their device settings: Google leads users of Android devices to believe that if they turn off “Location Services” in the settings menu of their device, apps will not be able to access the device’s locations. However, even when users turn off “Location Services” on their mobile device, Google bypasses the setting and continues to find ways to collect and store users’ locations. Google also gives users an opportunity to set “permissions” that determine what types of data each app on their mobile device can access. However, even when Android users specifically choose to deny Google apps the permission to access their devices’ location, Google finds ways to deduce the users’ location.
   
• Relying on “dark patterns” to undermine users’ informed choices: To gain access to user location data, Google manipulates its users through deceptive design choices that alter user decision-making in ways that harm the user and benefit Google. These practices are known as “dark patterns.” Google has made extensive use of dark patterns—such as repeated nudging, misleading pressure tactics, and evasive and deceptive descriptions of features and settings—to stop users from protecting their privacy and cause them to provide more and more data inadvertently or out of frustration. Some examples include repeatedly prompting users to enable location in certain apps and claiming products would not function properly if location was not enabled, when in fact location was not needed to use the app.

OAG is seeking an injunction to stop Google’s deceptive and unlawful practices. Additionally, OAG is seeking to force Google to disgorge profits it obtained from through its deceptive and unlawful location tracking and civil penalties, among other remedies.

A copy of the District of Columbia’s complaint against Google is available here.