Google to pay $391mn in its biggest privacy settlement

Google has agreed a $391.5mn settlement with 40 US states over its collection of users’ location data, the most the internet giant has ever paid out over a privacy complaint.

The settlement followed allegations from the states that Google had continued to collect location data through a number of its mobile apps, even after users had opted to stop having their whereabouts recorded.

The states’ investigation, which was led by Oregon and Nebraska, trained a spotlight on to one of the most valuable types of data that the search giant collects in order to target its advertising. According to the allegations, Google offered separate settings to control location data, with the result that even after users turned off their “location history”, a separate setting called Web and App Activity collected the data by default. The allegations covered the period from 2014-2020.

A Google spokesperson said: “Consistent with improvements we’ve made in recent years, we have settled this investigation, which was based on outdated product policies that we changed years ago.”

In a blog post, the company also laid out a number of recent changes it said had given users more control over the location data. Other changes due soon included a simplified privacy “hub” and easier tools to delete location data, it said.

According to privacy experts, however, few users look at the information Google and other internet companies offer about their personal data, or take advantage of tools to limit the amount of information that is collected about them, making their effect limited. By contrast, Apple made a sweeping impact on the online advertising industry with a privacy change last year, sending prompts to users that made it easy to block the collection of personal data by mobile apps.

The previous highest penalties Google has faced on privacy matters included a $170mn fine levied by the US Federal Trade Commission in 2019 over a failure to adhere to online protections for children. It also paid French regulators €150mn earlier this year — equivalent at the time to nearly $170mn — over a complaint that it made it easier for users to accept cookies that track their online behaviour than to reject them.

Those fines pale in comparison to the record $5bn penalty that the FTC levied against Facebook three years ago over the Cambridge Analytica scandal, however.

Google still faces further complaints from other US states over the location data issue, potentially taking the total cost above $500mn if future fines or settlements are levied.