BEUC NEWS - 26.11.2020

Two years ago, on 27 November 2018, seven consumer organisations of the BEUC network, in a coordinated action, filed GDPR complaints against Google. The complaints came on the back of a report from Norwegian consumer group Forbrukerrådet, which showed how Google collects users’ location data notably through the features ‘location history’ and ’web & app activity’ and uses various tricks (‘dark patterns’) to ensure users have these features enabled on their phones. The company also does not give consumers straightforward information about what this effectively entails.

Why it matters

Location data can reveal a lot about people’s personal lives since our movements reveal a lot about us – for example our religious views (went to a place of worship), political stances (attended a protest march), and health related issues (visited a cancer treatment centre). This can be used for many purposes such as targeting advertising or personalised offers and services. Geolocation data can often be combined with other data such as internet browsing history, preferences, social media activities and online shopping history to create very comprehensive consumer profiles.

What has happened

Our members lodged their complaints in November 2018 with their respective national data protection authorities (DPAs). It took nine months, until July 2019, before the Irish Data Protection Commission (DPC) was appointed lead authority for the complaints. It took another six months, until February 2020, for the DPC to announce the opening of an ‘own volition inquiry’ into the matters raised in our members’ complaints. This decision led to concerns regarding the impact of the own volition inquiry on the investigation of the complaints and the exercise of the complainants’ rights.
In addition to the risk of further delays in reaching a decision on the complaints, the approach taken by the DPC raised questions on the implications of having two distinct yet seemingly interlinked ongoing procedures, one of which our members are a part of (the investigation on the complaints) and one of which in principle they are not (the own volition inquiry).

Not an insular case

Similar cases against Google’s location tracking practices are also ongoing in the US (see here) and Australia (see here). Furthermore, in June last year, BEUC’s French member UFC-Que Choisir filed a collective redress action against Google in France, also in relation to the company’s location tracking practices. Meanwhile, Google continues to collect the location data of billions of people and is still yet to be held accountable by a single authority.

What’s next

Two years after the complaints were launched, a decision is still far off and it is unclear when such a decision could be expected. According to the Irish DPC, the outcome of its own volition inquiry – whenever that may come – will inform its decision on the complaints. An eventual decision by the DPC should also go under the scrutiny of the other data protection authorities which received our members’ complaints under the GDPR’s cooperation and consistency procedure.

This case not only raises questions about the effective enforcement of the GDPR but also the need to address the wider issue of commercial surveillance and the need to build a fair digital environment where consumers can use digital products and services without sacrificing their rights and exposing themselves to undue influence and discrimination.

For more information check our report, ‘’The Long and Winding Road - Two years of the GDPR: A cross-border enforcement case from a consumer perspective’’.