Google sued by Arizona for tracking users’ locations in spite of settings

Arizona has filed suit against Google over tracking users’ locations even after they’ve turned tracking off, claiming that the advertising-fueled tech titan has a “complex web of settings and purported ‘consents'” that enable it to furtively milk us for sweet, sweet ad dollars.
On Wednesday, State Attorney General Mark Brnovich said in a release that opting out of location tracking is a fool’s errand, given how sneaky Google is at playing bloodhound:

While Google users are led to believe they can opt-out of location tracking, the company exploits other avenues to invade personal privacy. It’s nearly impossible to stop Google from tracking your movements without your knowledge or consent.

The AG said that Google’s location tracking is unfair, deceptive, and also against the law: in this case, the Arizona Consumer Fraud Act.
The AG’s Office kicked off its consumer fraud investigation in August 2018, after the Associated Press ran an article titled “Google tracks your movements, like it or not”. The article was based on research from Princeton University that found that Google’s ability to track users’ location histories went far deeper than many of us realized.
This is the way location tracking works: Android users can turn it off with a slider button in the Location section under Settings … supposedly.
Once tracking is turned off, Google no longer stores a timeline and a precise record of a user’s movements when they take their Android device (or iPhone running Google services and apps) with them.
Checking this in Maps can be done by visiting Google’s Account Settings >My Account Activity > Other Account Activity > click ‘Visit Timeline’ under Location History. This should show a history of a user’s movements while using their device.

To test it all, Princeton postdoctoral researcher Gunes Acar carried an Android phone with Location History off and then shared the data with AP.
His research showed that he was tracked:

• On two train trips to New York;
• On visits to The High Line park, Chelsea Market, Hell’s Kitchen, Central Park and Harlem; and
• To his home address.

Acar found that turning off Location History doesn’t stop certain Google apps – maps, weather, searches, web and app activity, for example – from storing a timestamped location when you open them.
Arizona contends that Google has “lulled [users] into a false sense of security” by leading us to believe that we’ve actually had the ability to keep it from tracking our location history.

Google told users that ‘with Location History off, the places you go are no longer stored.’ But as the AP article revealed, this statement was blatantly false – even with Location History off, Google surreptitiously collects location information through other settings such as Web & App Activity and uses that information to sell ads.

The lawsuit describes how Google gets at users’ location data through numerous settings and products, but that two of the sneakiest ways it does so are through Location History and Web & App Activity.
Check out pp. 14-15 of the lawsuit for a table of settings that Arizona describes as …

… [a] complex web of settings and purported ‘consents’… that misleads users into handing over their location data to Google.

Arizona’s suit notes that up until early to mid-2018, Google’s disclosures regarding Web & App Activity misled users into believing that the setting had nothing to do with tracking user location. The company didn’t let users know that it was collecting their location data through Web and App Activity, which was on by default.
In August 2018, following the AP’s report, Google “clarified” the fact that it was tracking people’s locations even after they disabled the Location History setting. Not that it changed the practice, mind you – rather, it just fixed a page that incorrectly said that turning off the setting would stop the tracking.
What the Help page originally said:

… with Location History off, the places you go are no longer stored.

The “clarified” version:

This setting does not affect other location services on your device [and] … some location data may be saved as part of your activity on other services, like Search and Maps.

Arizona AG Brnovich told The Washington Post that Google has made it near impossible to completely disable tracking by forcing users to dig into granular Android system settings.
When consumers try to opt out of Google’s collection of location data, the company is continuing to find misleading ways to obtain information and use it for profit.
Arizona wants the court to force Google to pay back Arizona profits earned through ads that monetized the data, as well as potential fines of up to $10,000 per violation.
Google sent out a statement saying that it’s looking forward to “setting the record straight”:

The Attorney General and the contingency fee lawyers filing this lawsuit appear to have mischaracterized our services. We have always built privacy features into our products and provided robust controls for location data.

Latest Naked Security podcast