Fast track to surveillance

Tech giant Google unfairly steers consumers towards its surveillance system when they sign up to a Google account, instead of giving them privacy by design and by default as required by the General Data Protection Regulation (GDPR).

As a result, consumer groups under BEUC’s coordination have taken action to ensure that Google complies with the law, including by filing complaints with national data protection authorities.

The Google account is the red thread which connects how users’ data is used across all Google services. Consumers can choose to create a Google account voluntarily or be obliged to create one when they use certain Google products and services. For example, they must create an account when they buy a smartphone that uses Google’s Android system, which almost 7 in 10 phones worldwide (69%)¹ depend on,  if they want to download apps from the Google Play store.

During this signup process, which involves consumers taking important decisions about how Google will process their personal data, the tech giant uses a combination of deceptive design, unclear language, misleading choices and missing information:

• With only one step (“express personalisation”), the consumer activates all the account settings that feed Google’s surveillance activities. Google does not provide consumers with the option to turn all settings ‘off’ in one step.

• If consumers want to try to protect their privacy, it requires “manual personalisation”: five steps with ten clicks and grappling with information that is unclear, incomplete, and misleading.

• Regardless of the path the consumer chooses, Google’s data processing is un-transparent and unfair, with consumers’ personal data being used for purposes which are vague and far-reaching. Google also frames the more privacy-friendly options as ones where consumers will miss out on advantages if they don’t consent to Google’s extensive tracking and profiling practices.

Contrary to Google’s claim that users are in control of the data that the company collects and how it is used, the account signup process is engineered to serve the company’s interests and runs against EU data protection law.

¹ Statista.com, ‘Mobile operating systems' market share worldwide from January 2012 to January 2022’ (accessed 9 June 2022).