Endpoint Security , Governance & Risk Management , Next-Generation Technologies & Secure Development

Google Hit With Lawsuit Over Location Tracking

Tech Giant Clarifies: Pausing 'Location History' Alone Won't Stop All Tracking
Google Hit With Lawsuit Over Location Tracking

A lawsuit accuses Google of "the surreptitious location tracking of millions of mobile phone users via its Android mobile operating system and mobile apps."

See Also: Strengthening Defenses with ISO/IEC 27001 Standards: The Frontier of Canadian Cybersecurity

The plaintiff in the lawsuit, filed in U.S. District Court in the Northern District of California on Friday, is Napoleon Patacsil of San Diego. He says he's owned an iPhone since 2016 and set his "location history" to "off" in an effort to prevent Google and other third parties from tracking his location, according to the complaint, which was filed by Michael Sobol, a partner at Lieff Cabraser Heimann & Bernstein.

"Nevertheless, Google continued to track his location information," claims the lawsuit, which accuses Google of violating the U.S. Children's Internet Protection Act as well as the Penal Code of California, and more broadly users' "reasonable expectations of privacy." The complaint seeks class action status and a trial by jury.

"Despite users' attempts to protect their location privacy, Google collects and stores users' location data, thereby invading users' reasonable expectations of privacy, counter to Google's own representations about how users can configure Google's products to prevent such egregious privacy violations," the lawsuit states.

The lawsuit seeks both "damages and punitive damages in an amount to be determined at trial," calling for the latter "because Google's actions - which were malicious, oppressive and willful - were calculated to injure plaintiff and class members and made in conscious disregard of [their] rights. Punitive damages are warranted to deter Google from engaging in future misconduct."

Google declined to comment.

Associated Press Report Sparks Lawsuit

The lawsuit was sparked by an Aug. 13 Associated Press report that some Google apps tracked and time-stamped users' locations even if a user deactivated the "location history" setting..

Google's location history support page stated: "You can turn off location history at any time. With location history off, the places you go are no longer stored."

But the AP found that some Google apps, even after location history was turned off, continued to "automatically store time-stamped location data without asking."

The AP said it had confirmed its findings with a researcher in the lab of Jonathan Mayer, the former chief technologist for the Federal Communications Commission's enforcement bureau, who's now a computer scientist at Princeton University.

Google initially dismissed the assertions. "We provide clear descriptions of these tools and robust controls so people can turn them on or off, and delete their histories at any time," a spokesman told AP.

Google Revises Location History Description

On Friday, however, Google changed tack, and said that some of its services do continue to track users, even if the location tracking setting has been disabled.

Google's location history support page now reads: "Some location data may be saved as part of your activity on other services, like Search and Maps."

Some privacy watchers expect the FCC to take a closer look at how Google was tracking users' locations. The FCC didn't immediately respond to a request for comment about whether it plans to launch an investigation.

But Princeton's Mayer says he doesn't think Google was acting maliciously, but rather that it had described what it was doing - or not doing - very poorly.

"I think location history is poorly named, explained and designed, and I'm glad Google is rethinking it," Mayer said via Twitter.

Researcher Discovered Tracking

Screenshot stored by via K. Shankari of Google's request that she rate Kohl's, despite her having deactivated Location History and not used Google Maps

The AP says it was alerted to the location history problems via K. Shankari, a graduate researcher at UC Berkeley who studies volunteers' travel patterns to help community designers and urban planners to design better transportation options.

Shankari said she began looking into Google's location tracking after being prompted by Google Maps on her Android smartphone to rate her visit to a Kohl's department store, even though she'd deactivated location history and could find no reference to such tracking in any of Google's privacy policies. "I clearly wasn't using Google Maps to navigate the racks at Kohl's, and I hadn't even used it to get there. So how did Google Maps know where I was?" Shankari wrote in a May blog post.

In May, Google initiated an updated privacy policy in response to the EU's General Data Protection Regulation going into effect. "I was curious to see whether they had made any changes in location tracking, and they had. And the changes seem to answer some of my questions and raise a host of others," Shankari said.

Shankari told AP that Google's changes were a "good step forward," but added "they can make it better." In particular, she says a setting called "web & app activity" can be deactivated, which will stop Google apps from recording and time-stamping a user's location data.

About the Author

Mathew J. Schwartz

Mathew J. Schwartz

Executive Editor, DataBreachToday & Europe, ISMG

Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.

Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing bankinfosecurity.com, you agree to our use of cookies.