Arizona Lawsuit Documents Detail Google’s Efforts to Collect User Location Data and Obfuscate the Settings to Control It

Tyler Sonnemaker, reporting for Insider:

Newly unredacted documents in a lawsuit against Google reveal that the company’s own executives and engineers knew just how difficult the company had made it for smartphone users to keep their location data private.

Google continued collecting location data even when users turned off various location-sharing settings, made popular privacy settings harder to find, and even pressured LG and other phone makers into hiding settings precisely because users liked them, according to the documents.

Jack Menzel, a former vice president overseeing Google Maps, admitted during a deposition that the only way Google wouldn’t be able to figure out a user’s home and work locations is if that person intentionally threw Google off the trail by setting their home and work addresses as some other random locations. […]

When Google tested versions of its Android operating system that made privacy settings easier to find, users took advantage of them, which Google viewed as a “problem”, according to the documents. To solve that problem, Google then sought to bury those settings deeper within the settings menu.

Arizona attorney general Mark Brnovich’s complaint (PDF), albeit partially redacted, is a cogent and damning read. It seems undeniable that Google deliberately obfuscated location privacy settings, and knew that they were confusing. From pages 12–13:

Google’s own employees have clearly identified the problem:

  • “Real people just think in terms of ‘location is on’, ‘location is off’ because that’s exactly what you have on the front screen of your phone.” Ex. 206 (GOOG-GLAZ-00055452) at 452.
  • “The current UI feels like it is designed to make things possible, yet difficult enough that people won’t figure it out.” Ex. 207 (GOOG-GLAZ-00077898) at 899.
  • “Some people (including even Googlers) don’t know that there is a global switch and a per-device switch.” Ex. 208 (GOOG-GLAZ-00055552) at 553.
  • “Today, collection of device usage and diagnostic data is smeared across 5 settings resulting in conditions that are difficult for Googlers, let alone users, to understand.” Ex. 210 (GOOG-GLAZ-00057940) at 940.

I enjoy the implicit assumption in their internal communications that Google employees are so smart that if “even” they’re confused, it must be too complicated. From page 15 (citations omitted for readability):

On August 13, 2018, the AP published an exclusive report titled “Google tracks your movements, like it or not” that publicly exposed this deception. The article explained how Google “records your movements even when you explicitly tell it not to.”

Until the AP article was published, Google represented on its public help page regarding Location History that “You can turn off Location History at any time. With Location History off, the places you go are no longer stored.”

But that was not true. Even with Location History off, Google still collected and stored location data via (at least) its Web & App Activity setting. Thus, for example, a user who had Location History off and looked up the weather where he lived or searched the web with Google’s Search app would still unknowingly send Google his location.

The day the AP story was published, Google turned into crisis mode and held a self-styled “Oh Shit” meeting in reaction to the story.

“Oh shit” indeed.

★ Sunday, 30 May 2021