[German]A recent lawsuit filed by the Arizona Attorney General against technology company Google shows that the company continues to track users who have declined location tracking anyway. Thus, IP addresses of Google users served to obtain accurate location information and then used for Google services. On October 24, 2022, Arizona's lawsuit against Google is scheduled to be heard – and I think the EU will be watching closely as well, since Google is in the sights of EU antitrust watchdogs for various competition complaints and there are also GDPR complaints from consumer protection organizations.
Advertising
I came across a corresponding article from azmirror.com the other day. Attorney General Mark Brnovich has already opened a case in 2020, which is part of a larger investigation that has been ongoing since at least 2018. As part of this investigation, as of September 7, 2022, some documents related to the case have been released on this website by Mark Brnovich (the server is very difficult to access).
The newly released documents are testimonies of experts from both the state and Google that were under a protective order and intended for the eyes of attorneys only. The Attorney General has now released these documents (some redacted) to the public. They shed new light on how Google tracked users even though they had disabled tracking.
The trigger for investigation
The whole thing was triggered by an Associated Press (AP) article. There, it was revealed that certain Google applications were storing location data without being asked, and that deleting the data was a time-consuming process. AP found that Google Maps, for example, takes a snapshot of where users are as soon as they open the app, even when location history is disabled. I had covered that within my German blog post Google trackt Standort auch bei deaktivierter Funktion.
Findings from the proceedings
In a report intended only for attorneys in the case involved, one expert wrote that even after Phase 3 was implemented, there was nothing a user could do to prevent Google from using location information obtained through the user's IP address to serve ads. This is despite all the other settings Google provides with regard to opting out of tracking. Google collects, stores and uses the user's location data determined from the IP address.
While expert Seth Nielson points out that Google may need to use an IP address to comply with certain legal obligations. It is also possible that the location-based IP address may be required to detect spam and fraud. Be that as it may, once Google has met these legal obligations, there are no legal or technical reasons why this information must be used for the purposes of Google's advertising business.
Advertising
The documents also describe a Google service or tool called "IPGeo," which, according to a 2009 presentation (on file with the attorney general's office), aims to "predict users' locations based on their IP addresses." This allows for improved use of available data. In the process, this data is to be available to all Google products. In other words, this service can be used to calculate a user's location, even if those users did not activate the Google location service or even purposefully deactivated it to avoid being tracked.
Jennifer King, a privacy and data policy expert at Stanford University, testified in the trial that the tool is specifically used by Google to track its users regardless of their location data tracking settings. In addition, this tool turns those users who have enabled location tracking analysis into "reporters" of those users who have opted out of location data tracking.
"Users who report their location are essentially being appropriated by Google to determine the location of nearby users who have not reported their location," King said. "Moreover, despite the various settings, there is no opt-out," and there is nothing users can do to prevent Google from determining location."
In documents discussed to the attorney general's office by expert witness Colin Gray, an associate professor at Purdue University, a Google employee expressed confusion and fear about the company's device location settings. According to internal emails, Google employees also began to question how the company uses location history settings when using this tool. Gray is an expert on so-called "dark patterns," and writes:
First, Google is using Dark Patterns, simply by using confusing terminology. This requires the user to guess that location data is not just contained in location history. Second, the default use of opt-in for (web and app activities) automatically tracks users' location data, possibly without their knowledge.
Gray adds in the court documents that even if "all settings were disabled on an Android device, Google would still collect a user's location data through IPGeo" and another tool whose name was redacted in the documents. These two tools work independently of the settings. The expert points out that in June 2022, the European Consumer Organization ("BEUC") published a report titled Fast track to surveillance – How Google makes privacy the hard choice, which refers to dark patterns in Google's account setup process. BEUC, along with other consumer protection groups, has filed a model lawsuit against Google for GDPR violations and has also filed complaints against Google before various regulators in Europe.
These documents are pure dynamite, as corresponding proceedings against Google are also underway in the EU. In addition, the Digital Services Act (DSA) is in the starting blocks in Europe (see European Union: Agreement on digital law against hate and incitement (Digital Services Act, DSA)). This legislative initiative prohibits in particular user monitoring by means of dark patterns. Google spokesman José Castañeda wrote in an email to the Arizona Mirror:
Privacy controls have long been built into our services, and our teams are continually working to discuss and improve them. In the case of location information, we have listened to feedback and worked hard to improve our privacy controls. As our experts have shown, the Attorney General continues to misrepresent our services and products.
Let me say it straight: They've been caught with their fingers in the honey pot by Google with their pants down. Last week Thursday, Judge Timothy Thomason ruled in the U.S. trial to admit Gray as an expert witness after Google sought to exclude his testimony and any references to "Dark Pattern" at trial. In the ruling, the court noted "that some of Google's arguments turned out to be disingenuous" after the state of Arizona approached the expert. The trial in the case is scheduled to begin on October 24, 2022.
Advertising
