California Attorney General Settles with Google For $93 Million Over Location Tracking-Related Allegations | Practical Law

California Attorney General Settles with Google For $93 Million Over Location Tracking-Related Allegations | Practical Law

Google LLC has agreed to pay $93 million and improve its location data transparency and user controls in a settlement with California, building on prior similar agreements with other states.

California Attorney General Settles with Google For $93 Million Over Location Tracking-Related Allegations

by Practical Law Data Privacy & Cybersecurity
Published on 15 Sep 2023 • California
Google LLC has agreed to pay $93 million and improve its location data transparency and user controls in a settlement with California, building on prior similar agreements with other states.
On September 14, 2023, California Attorney General (CAG) Rob Bonta announced a settlement with tech giant Google LLC for $93 million over alleged misleading location tracking practices. The CAG's complaint alleges that Google:
  • Deceived users into enabling their location history setting.
  • Misled users into believing they had control over Google's collection and use of their location data.
  • Deceived users about their ability to opt out of geotargeted ads.
The CAG's agreement builds off the settlement the company reached with 40 US state attorneys general in November 2022 for $391.5 million (see Legal Update, Forty State Attorneys General Settle with Google for $391.5 Million Over Misleading Location Tracking Allegations). Google must pay a $93 million fine to California and follow injunctive terms that overlap with and extend the multistate agreement, including:
  • Providing more transparency and user disclosures regarding its location tracking practices and data uses, with detailed information about the location data it collects and how the company uses it on a "Location Technologies" webpage.
  • Disclosing to users that it may use their location-related information for targeting personalized ads.
  • Obtaining express affirmative consent before sharing a user's precise location information with a third-party advertiser.
  • Deleting location information derived from a device or IP address within 30 days of collection.
  • Deleting location history data for inactive users after following specified user notice protocols.
  • Obtaining review from Google's internal Privacy Working Group for certain activities that may have material privacy impacts, such as changes to:
    • its location-related settings and ads personalization disclosures, including documented approval; and
    • how it collects, stores, or uses location-related information.
Google has 180 days to comply with the settlement's terms after the stipulated judgment is finalized, unless otherwise specified.
The settlement's detailed user disclosure and interaction process descriptions offer best practice and compliance examples for companies that collect and use geolocation information, especially for advertising or other purposes.