Google breached Australian consumer law by misleading privacy-conscious Australians into thinking it wasn’t collecting personal data about their location, the Federal Court has found.
Friday’s ruling has been described as a world first by the chairman of the Australian Competition and Consumer Commission, which sued the search and advertising giant.
“We think today’s result sends a very clear message to the digital platforms that they have to be upfront with consumers about what is actually happening with their data, how it is being used and how consumers can protect their data,” ACCC chair Rod Sims said.
“These are fundamental issues for Australians going forward in this future digital economy.”
Google says it has improved its privacy controls and there was no allegation it had breached the Australian privacy act.
“The court rejected many of the ACCC’s broad claims,” a spokesman said.
“We disagree with the remaining findings and are currently reviewing our options, including a possible appeal.”
Google had argued it made it clear to users setting up a Google account that the company would still collect and use location data when location history was “off”, Web & App Activity was “on” and one of its apps was used.
Users asked to agree or disagree to “Privacy and Terms” about the use and storage of their data were offered a third option for “More Options”.
That option allowed them to toggle on and off location history, web and app activity and other data collection.
But Federal Court Justice Thomas Thawley said the warnings shown with the toggles weren’t as clear as Google would have it.
Some users would have reached the correct conclusion but others, even after going beyond default warnings, would have concluded the tech giant wasn’t using their location data when location history was off.
“True it is that, after a careful examination of the content of both screens, the conclusions Google urged might be reached,” the judge said.
“That is not the issue. The screens were read by users setting up the device.
“Such users, even ones with heightened privacy concerns, would not re-read screens with the kind of careful attention that has been necessary in considering the various arguments put by the parties.”
Justice Thawley said many reasonable, privacy-conscious users would have concluded Google still obtained location data when location history was off and a user was using an app such as Maps.
But those users would have reasonably thought the location data was being obtained on a “once-off” basis and not being retained or subsequently used, he found.
Google’s conduct was found to have misled or likely misled some reasonable users.
The number of such users does not matter for the purposes of establishing the breaches, the judge said.
The tech giant was also found in breach of two other consumer laws, concerning conduct liable to mislead the public and making misleading representations about a service’s performance characteristics.
The parties will return to court at a later date to determine what fine Google should pay.