PRESS RELEASE - 27.11.2018

Today, seven consumer organisations from across Europe have announced that they will file complaints against Google with their national data protection authorities1. Based on new research published today by BEUC’s Norwegian member Forbrukerrådet, the consumer groups, all part of the BEUC network, are referring Google to their respective national authorities for breaching the General Data Protection Regulation (GDPR) in relation to how the company tracks its users’ location.

Location data can reveal a lot about people, including religious beliefs (going to places of worship), political leanings (going to demonstrations), health conditions (regular hospital visits) and sexual orientation (visiting certain bars). The report shows that Google collects users’ location data notably through the features ‘location history’ and ’web & app activity’, which are integrated into all Google user accounts2. The company uses various tricks and practices to ensure users have these features enabled and does not give them straightforward information about what this effectively entails.

These unfair practices2 leave consumers in the dark about the use of their personal data. Additionally they do not give consumers a real choice other than providing their location data, which is then used by the company for a wide range of purposes including targeted advertising.

These practices are not compliant with the GDPR, as Google lacks a valid legal ground for processing the data in question. In particular, the report shows that users’ consent provided under these circumstances is not freely given. Also, the company cannot invoke a ‘legitimate interest’ to collect and process location data, due to the significant and intrusive impact that this tracking has on the rights and freedoms of the individual.3

Monique Goyens, Director General of The European Consumer Organisation, commented:

“Google’s data hunger is notorious but the scale with which it deceives its users to track and monetise their every move is breathtaking. Google is not respecting fundamental GDPR principles, such as the obligation to use data in a lawful, fair and transparent manner.

“Thanks to the GDPR, users should be in control of their personal data. Google’s deceptive practices are in breach of the spirit and the letter of this regulation. We need strong, coherent, enforcement of the rules. We can’t have companies pretending to comply but de facto circumventing the law.

“It can undoubtedly be useful to share your location data, for instance to find a restaurant when travelling. But the places we go to also reveal a lot about ourselves and our private life.

“The situation is more than alarming. Smartphones are being used for spying on our every move. This is not the digital society that European consumers want to live in.

“With today’s action to submit complaints with data protection authorities across Europe, we want to stop consumer exploitation and force those digital giants to finally accept their responsibility.”

ENDS

Notes:

1 Forbrukerrådet (Norway), Consumentenbond (The Netherlands), Ekpizo (Greece), dTest (Czech Republic), Zveza Potrošnikov Slovenije (Slovenia), Federacja Konsumentów (Poland) and Sveriges Konsumenter (Sweden) will file complaints with their data protection authorities. Forbrugerrådet Tænk (Denmark) will report these practices to the Danish data protection body. vzbv from Germany is considering an action for an injunction against Google because of these practices. The Transatlantic Consumer Dialogue will bring it to the attention of the Federal Trade Commission.

2 Android, Google’s operating system, powers an estimated 2 billion devices worldwide making it the most-used globally. It is used by a big majority of smartphone manufacturers, such as Samsung, Huawei and Sony. Android, however, comes with numerous strings attached, including that all users of such devices de facto need to have a Google account

3 Practices used by Google to nudge users into sharing location data:

Deceptive click-flow: the click-flow when setting up an Android device pushes users into enabling ‘Location History’ without being aware of what it entails.

Hidden default settings: when setting up a Google account, the ‘Web & App Activity’ settings are hidden behind extra clicks and enabled by default.

Misleading and unbalanced information: users are not given sufficient information when presented with choices, and are misled about what data is collected and how it is used.

Repeated nudging: users are repeatedly asked to turn on ‘Location History’ when using different Google services even if they decided against this feature when setting up their phone.

Bundling of services and lack of granular choices: if the user wants features such as Google Assistant and photos sorted by location, Google turns on invasive location tracking.

4 For more information please consult our FAQ and research.