Google faces potential class action, FTC penalties for ‘surreptitious’ location tracking

A California resident named Napoleon Patacsil has filed a lawsuit against Google in federal court (Patacsil v. Google, Inc.) seeking class action status. The suit alleges personal injuries in the form of various California privacy violations stemming from “surreptitious monitoring” of user location.

The suit was filed after an AP article identified the fact that Google location capture still occurs on mobile devices even when Location History is turned off. Following the report, Google changed help language to clarify that location is still used, even though Location History is disabled.

The new language reads:

This [Location History] setting does not affect other location services on your device, like Google Location Services and Find My Device. Some location data may be saved as part of your activity on other services, like Search and Maps. When you turn off Location History for your Google Account, it’s off for all devices associated with that Google Account.

The litigation was first reported by Reuters.

There are a number of privacy-related claims in the lawsuit, one of which is that Google’s conduct violates California penal code section 637.7, which prohibits the use of “an electronic tracking device to determine the location or movement of a person.” There are two exceptions: for user consent and for valid uses by law enforcement (e.g., with a search warrant).

Litigation firm Lieff Cabraser Heimann & Bernstein is apparently representing plaintiff Patacsil. Should the suit achieve class action status, it could make the case very expensive for Google. However, Google’s liability is not certain, nor are damages.

Unless provided by statute, the damages aspect of the case is challenging for the plaintiff to prove. Google could and likely would argue that location services make phones perform better and that he and any potential class members can’t show they were harmed by Google Search or Maps’ use of location.

In parallel with the litigation, the Electronic Privacy Information Center (EPIC) sent a letter to the Federal Trade Commission claiming that the facts in the AP article constitute a violation of a consent decree (.pdf) the company agreed to in 2011. EPIC told the FTC:

[Location tracking] clearly violates Google’s 2011 settlement with the FTC. Google is not permitted to track users after they have made clear in their privacy settings that they do not want to be tracked. This privacy violation affects all Android users and iPhone users who use Google Maps or search. EPIC urges the Commission to enforce its Order and hold Google accountable.

The consent decree was tied to Google’s ill-fated Buzz social network (remember that?). The claim in that case was that Google used “deceptive tactics and violated its own privacy promises to consumers.” This is what EPIC is saying Google has done in the present case.

In my quick analysis of Google’s potential exposure over location tracking, I had forgotten the 2011 consent decree. In many ways, that is a bigger threat than the civil litigation and could bring significant financial penalties in excess of $41,000 for single violations.