Attorney General Matthew J. Platkin announced today that New Jersey has entered into a settlement with Google resolving a multistate investigation into allegations that the online search engine platform violated consumers’ privacy by misleading consumers about its location data collection practices.
Under the settlement, Google will pay a total of $391.5 million to 40 states, the largest multi-state privacy settlement with state Attorneys General in U.S. history. New Jersey will receive approximately $17.79 million from the settlement.
Location data is a key part of Google’s digital advertising business, which uses the data to build detailed user profiles for targeted ads on behalf of its customers. But location data is among the most sensitive information Google collects. Google tracks consumers’ locations using sensors on a consumer’s device, including GPS, cell tower, Wi-Fi, and Bluetooth signals. Using those various signals, Google can often track a consumer’s location both outside and inside buildings. Accordingly, even a limited amount of location data can expose a person’s identity and routines and can be used to infer personal details.
“Digital platforms like Google cannot claim to provide privacy controls to users then turn around and disregard those controls to collect and sell data to advertisers against users’ express wishes—and at great profit.” said Attorney General Platkin. “When online platforms violate consumers’ right to privacy, they put their users at risk. This settlement holds Google accountable for its misleading conduct and requires the company to make meaningful changes to its business practices to ensure consumers’ privacy rights are respected and protected.”
“When an online company promises consumers privacy, we expect them to make good on that promise,” said Cari Fais, Acting Director of the Division of Consumer Affairs. “Google’s privacy controls did not stop Google from collecting data, regardless of what choices consumers made, a clear and egregious violation of their own business model and our consumer protection laws. This settlement sends a clear message that we will hold companies accountable when they fail to follow through on the assurances they make to consumers.”
The Attorneys General opened this investigation following a 2018 Associated Press article that revealed Google “records your movements even when you explicitly tell it not to.” The article focused on two Google account settings: Location History and Web & App Activity. Location History is “off” unless a user turns on the setting, but Web & App Activity, a separate account setting, is automatically “on” when users set up a Google account.
As detailed in the settlement, the Attorneys General allege that Google violated state consumer protection laws by misleading consumers about its location tracking practices in various ways since at least 2014. Specifically, Google caused users to be confused about the scope of the Location History setting, the fact that the Web & App Activity setting existed and also collected location information, and the extent to which consumers who use Google products and services could limit Google’s location tracking by adjusting their account and device settings.
Under the settlement, Google has agreed to a series of provisions designed to give consumers more transparency into Google’s location data collection practices, including:
Requiring Google to show additional information to users whenever they turn an account setting “on” or “off”;
Clearly and conspicuously disclosing key information about location tracking to users; and
Creating an enhanced “Location Technologies” webpage where users can get detailed information about the type(s) of location data Google collects and how it’s used.
The settlement also puts limits on Google’s use and storage of certain types of location information and requires Google’s account controls to be more user-friendly.
A coalition of states—New Jersey, Oregon, Nebraska, Arkansas, Florida, Illinois, Louisiana, North Carolina, Pennsylvania, and Tennessee—led negotiations on this matter. The final settlement was also joined by Alabama, Alaska, Colorado, Connecticut, Delaware, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Nevada, New Mexico, New York, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Utah, Vermont, Virginia, and Wisconsin.
Representing New Jersey in the investigation were Deputy Attorneys General Thomas Huynh and Gina Pittore from the Data Privacy and Cybersecurity Section within the Division of Law’s Affirmative Civil Enforcement Practice Group, under the supervision of Data Privacy & Cybersecurity Section Chief Kashif Chand, Division of Law Deputy Director Jason W. Rockwell, and Director Michael T.G. Long. Investigator Aziza Salikhova of the Office of Consumer Protection within the Division of Consumer Affairs conducted the investigation.