Every Step You Take

On 27 November 2018, seven European consumer organisations announced that they had filed complaints against Google with their national data protection authorities for the way the company tracked its users’ locations. The complaints are based on research published by Forbrukerrådet, the Norwegian consumer organisation, a member of BEUC which illustrates how Google is using deceptive design, misleading information and repeated pushing to manipulate Android users into allowing constant tracking of their movements.

Location data can reveal a lot about people, including religious beliefs (going to places of worship), political leanings (going to demonstrations), health conditions (regular hospital visits) and sexual orientation (visiting certain bars). The report shows that Google collects users’ location data notably through the features ‘location history’ and ’web & app activity’, which are integrated into all Google user accounts. The company uses various tricks and practices to ensure users have these features enabled and does not give them straightforward information about what this effectively entails.

These unfair practices leave consumers in the dark about the use of their personal data. Additionally they do not give consumers a real choice other than providing their location data, which is then used by the company for a wide range of purposes including targeted advertising.

These practices are not compliant with the GDPR, as Google lacks a valid legal ground for processing the data in question. In particular, the report shows that users’ consent provided under these circumstances is not freely given. Also, the company cannot invoke a ‘legitimate interest’ to collect and process location data, due to the significant and intrusive impact that this tracking has on the rights and freedoms of the individual.

BEUC expects the data protection authorities to fully investigate the complaints and adopt the necessary measures to force Google to comply with the law. The end result should be that Google users can finally protect their privacy and make informed choices about the use of their data. The imposition of an appropriate fine to sanction the company’s wrongdoing is also an important element of the enforcement procedure.