Android Tracking Switch Privacy Lawsuit
Peter Hoskins & Lily Jamali (via Nick Heer):
A US federal court has told Google to pay $425m (£316.3m) for breaching users’ privacy by collecting data from millions of users even after they had turned off a tracking feature in their Google accounts.
The verdict comes after a group of users brought the case claiming Google accessed users’ mobile devices to collect, save and use their data, in violation of privacy assurances in its Web & App Activity setting.
They had been seeking more than $31bn in damages.
[…]
Google says that when users turn off Web & App Activity in their account, businesses using Google Analytics may still collect data about their use of sites and apps but that this information does not identify individual users and respects their privacy choices.
AP:
That means the total damages awarded in the five-year-old case works out to about $4 per device.
Plaintiffs in this lawsuit sued Google alleging that when someone turned off or “paused” Google’s Web & App Activity setting and/or supplemental Web & App Activity setting, Google lacked permission to collect, save, and use the data concerning their activity on non-Google apps that have incorporated certain Google software code into the apps (such as Uber, Venmo, TikTok, Instagram, Facebook, WhatsApp, etc.). Plaintiffs allege that regardless of whether Class Members had these settings paused or turned off, Google collected app activity data using certain code embedded within many non-Google apps. This embedded code includes the Firebase Software Development Kit and the Google Mobile Ads Software Development Kit, which are written and distributed by Google and placed on apps by third party developers who own the apps. Plaintiffs allege Google used this code to unlawfully access their devices and collect, save, and use data from their activity on non-Google apps for Google’s own benefit.
This seems kind of like the Incognito lawsuit. Technically, it doesn’t really make sense that flipping a switch on an Android phone would turn off Google Analytics across the Web and third-party apps. But some customers expected this, I guess because it’s all Google tech and because the wording in the settings screen was not clear:
Google’s employees recognize, internally and without disclosing this publicly, that WAA is “not clear to users” (GOOG-RDGZ-00021182), “nebulous” (GOOG-RDGZ-00014578), “not well understood” (GOOG-RDGZ-00020706), “completely broken” (GOOG-RDGZ- 00130745 at -46) and “confuses users” (GOOG-RDGZ-00015004), where people “don’t know what WAA means” (GOOG-RDGZ-00021184) and Google’s promise of control is “just not true” (GOOG-RDGZ-00020680). Google employees accordingly describe WAA as a “terrible control” (GOOG-RDGZ-00130416) and a “loser” (GOOG-RDGZ-00144760), and lament how “Web & App Activity is the worst name ever” (GOOG-RDGZ-00089546).
It sounds to me like the switch did work in the sense that it did what it could reasonably do at the system level, but this was poorly explained and didn’t do as much as users wanted. In comparison, the Apple lawsuits are about how turning off a system-wide “share analytics” switch did not prevent system apps from sending personally identifiable data to Apple. This seems more directly bad, although Google is surely collecting more data overall.
Previously:
- Google Search Remedies
- App Store Search Queries Appear to Violate Data Minimization Practices
- Keeping Your Data From Apple Is Harder Than Expected
- Google Settles Incognito Lawsuit
- Measuring the Data iOS and Android Send to Apple and Google
- Lawsuits Over Apple Analytics Switch
- Google Chrome Incognito Lawsuit
- Google Drops Ban on Personally Identifiable Web Tracking
