Person holding Android phone looking at Google screen

World-First Enforcement in ACCC v Google: Here’s What You Need To Know

Published at 05:25 on 22 May 2021

The ACCC has successfully argued that Google engaged in misleading and deceptive conduct in a world-first enforcement proceeding. While we’re yet to see what the penalty will be, there are several key takeaways Australian organisations should be aware of following the decision. 

Key Takeaways from ACCC v Google: 

  • The ACCC is taking an increasingly hands-on approach to protecting consumer data privacy via its powers related to misleading and deceptive conduct.  
  • The ACCC is taking the stance that organisations should provide details about privacy settings in a way that’s accessible, transparent, user-friendly, and does not assume users will read all the information.
  • Courts will consider the presentation of the information, as well as the language used, when deciding whether a company has engaged in misleading and deceptive conduct. 
  • Our two cents: Given the direction of privacy enforcement, organisations should implement privacy as the default setting to reduce compliance risk today and into the future. 

The Facts of The Case: ACCC v Google 

On April 16, 2021, the Federal Court of Australia (the Court) handed down its judgement in Australian Competition and Consumer Commission v Google LLC (No 2) [2021] FCA 367 (called herein ACCC v Google). The Court considered 3 claims made by the ACCC, all of which related to how Google presented its collection, storage, and usage of users’ personal location data in its customer-facing privacy documents.  

 

Image of the location history settings for Android users subject to the ACCC v Google court case

 

The 3 claims in ACCC v Google related to the following settings:  

Situation 1: 

Between 1 January 2017 and 30 December 2018, Android users who set up new Google accounts were led to believe that the ‘Location History’ setting was the only setting that affected whether Google collected, kept, or used personally identifiable data about a user’s location. Google also collected, stored, and used personal identifiable location data as a result of the setting titled ‘Web & App Activity’. The ‘Web & App Activity’ setting was set to collect location data as the default setting.  

Situation 2: 

Where Android users later switched their ‘Location History’ settings to off (during the same 2-year period), Google did not inform them that turning the setting off would not have that effect unless the ‘Web & Act Activity’ setting was also changed.  

Situation 3:  

Between 9 March 2017 and 29 November 2018, Android users who accessed the ‘Web & App Activity’ setting were not informed by Google that the settings affected the collection of their personal location data.  

Behavioural Economics & The ACCC’s Arguments 

Following a global trend, the ACCC has relied on expert evidence from behavioural economists in recent misleading and deceptive conduct hearings. This field of study considers the influence of psychological, cognitive, emotional, cultural, and social factors on human decision making. The ACCC presents the evidence of behavioural economists to explain why a representation is likely to mislead or deceive members of a target audience.  

In ACCC v Google, the experts provided an analysis of how people tend to take shortcuts when making decisions, particularly where they have limited time and access to information – as you would when considering privacy documents. They ultimately concluded that different users interact with the information provided differently, depending on how privacy conscious the user is.  

How was Google’s conduct misleading and deceptive? 

The Court found that the way Google presented the location history settings to Android users throughout 2017 and 2018 would have led some reasonable users to believe they had switched off location tracking, when that wasn’t the case.  

Specifically, the Court held that Google had breached the following sections of the Australian Consumer Law (ACL):  

  • Section 18(1), which prohibits engaging in conduct that is misleading or deceptive or likely to mislead or deceive; 
  • Section 29(1)(g), which prohibits false or misleading representations; and 
  • Section 34, which prohibits engaging in conduct that is liable to mislead the public as to the nature, the characteristics, the suitability for their purpose, or the quantity of any services.  

What’s Next? 

We must wait and see whether Google appeals the decision or, if it accepts the outcome, what the penalty will be. But there’s one thing we can be certain of: the ACCC, buoyed by this outcome, will almost certainly continue to pursue enforcement actions in the data privacy realm. 

“Companies that collect information must explain their settings clearly and transparently so consumers are not misled. Consumers should not be kept in the dark when it comes to the collection of their personal location data.” – The ACCC asserted in its media release.  

We’re also looking forward to seeing the outcome of the ACCC’s second misleading conduct claim against Google, which will likely be heard by the court towards the end of this year.  

You can read the full judgement from the Federal Court of Australia here.  

  • We collect and handle all personal information in accordance with our Privacy Policy.

  • This field is for validation purposes and should be left unchanged.

At Privacy 108, we are passionate about privacy and data protection. We work with organisations to ensure they collect, use and secure all information in a way that is both compliant and meets community expectations. Privacy 108 is a law firm. Our team of lawyers can provide specialist legal advice on privacy and security issues.