A significant court win against Google, concerning misleading online privacy statements about location tracking, sends a strong message to businesses - be careful not to mislead customers or risk facing huge fines.

The case was brought by the Australian Competition and Consumer Commission (ACCC) alleging Google misled some Android users on how to disable personal location tracking on their phones. (See Australian Competition and Consumer Commission v Google LLC (No 2) [2021] FCA 367.)

Important victory for consumers

In what the ACCC hailed as a world first, the Federal Court found Google had misled customers about privacy and the use of location tracking data that it collected through Android mobile devices.

The ACCC chair, Mr Rod Sims, said in a statement: "This is an important victory for consumers, especially anyone concerned about their privacy online, as the Court's decision sends a strong message to Google and others that big businesses must not mislead their customers."

Mr Sims said the decision was an important step to make sure digital platforms are upfront with consumers about what is happening with their data, and what they can do to protect it. (See Google misled consumers about the collection and use of location data, ACCC, April 2021.)

Android users misled to believe they could switch Google's location tracking off

Under section 18 of the Competition and Consumer Act 2010 - Schedule 2, and section 52 of the Trade Practices Act 1974, a person must not, in trade or commerce, engage in conduct that is misleading or deceptive or is likely to mislead or deceive.

The court found Google misled Android customers into believing that if they switched off the "location history" setting, their location could not be traced.

However, another setting, "web and app activity" was left on by default and that enabled Google to collect, store and use personally identifiable location tracking data.

Google could face millions of dollars in fines

The ACCC is seeking financial penalties against Google and these will be determined at a later date. The case concerned Google policy in 2017 and 2018. The global corporation has since changed the way the settings are presented to consumers.

Fines could be in the millions of dollars, as the law allows penalties for each person who fell victim to misleading conduct.

A warning for businesses that conceal their data collection practices, this judgment also serves as a caution for the way consumers' personal information is shared.

Need for transparency around data collection practices

Most people are unaware of the extent to which their personal data is collected without their permission and passed on to other digital marketing businesses. This is not necessarily due to negligence or lack of care by the consumer, but to businesses obscuring their data collection practices.

This can result in more than just annoying junk mail. Identity theft is a very real problem and the personal data of individuals can also be used to target them with scams and manipulation.

The government is currently reviewing the federal Privacy Act 1988 and it could lead to fairer and more open privacy practices in the future. (See Review of the Privacy Act 1988, Attorney General's Department.)

Do your data collection policies adhere to consumer laws?

Businesses would be wise to seek expert legal advice regarding the fine print of their data collection policy, or risk facing substantial penalties.

While managers may think it looks like bureaucratic waffle and resist spending time on it, this Google case demonstrates that data collection policies must adhere to consumer laws on misleading and deceptive conduct.

They must also abide by any upcoming changes to privacy regulations.

Geoff Baldwin
Business disputes and litigation
Stacks Champion

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.