In December 2023, Google announced an update to its location data policy to provide users with more control over their sensitive location information. While this seems like a promising step in the right direction, we should be mindful of Google’s long history of failing to uphold its privacy obligations and vigilant in monitoring Google’s follow-through on its commitments.
Google’s Unfulfilled Promises to Protect Users’ Location Data
In July 2022, shortly after the U.S. Supreme Court invalidated the constitutional right to an abortion in Dobbs v. Jackson’s Women’s Health Organization, Google publicly promised to take new steps to protect users’ location data. In particular, Google said that it would delete location records that revealed whether a user had visited certain types of medical facilities soon after each visit. These facilities include counseling centers, addiction treatment facilities, domestic violence shelters, fertility centers, weight loss clinics, surgery clinics, and abortion clinics. Google promised that the change would go into effect in “the coming weeks” after the announcement.
But in November 2022, research by Accountable Tech showed that Google had failed to follow through on its policy change. In May 2023, follow-up reporting confirmed that failure. And nearly a year and a half after its initial promise to protect users’ location data, further research and reporting confirmed that Google had retained location data revealing visits to abortion clinics in about 50% of experiments conducted by Accountable Tech. The disconnect between Google’s public promises and its actual handling of users’ location data prompted EPIC and Accountable Tech to file a complaint with the Federal Trade Commission in January 2024. The groups urged the Commission to investigate Google, impose civil penalties, order the company to disgorge wrongfully retained location data, and enjoin Google’s unlawful location data practices.
Despite the failure to fulfill its 2022 location data promises, Google announced another update to its location data practices in December 2023. Once the changes take effect, the announcement promises that a user’s Location History timeline will be stored on the user’s device and that the default auto-delete control period for location data will shrink to three months from the previous period of 18 months. Google also promises to give users the option to delete activity related to specific places from Maps. As with the July 2022 announcement, Google provided no date certain for when the updates will take effect.
Location Data Reveals Highly Sensitive Details About Us
Location data can reveal a lot about us. Records of a person’s physical movements through the world can divulge sensitive information: a health condition inferred from a person’s visits to a dialysis clinic, someone’s religious affiliation inferred from their attendance at a mosque, or an individual’s sexuality inferred from his attendance at a gay speed dating event. Some location information may seem innocuous in isolation, but when these data points are collected over time, they can form a detailed profile of a person. Apps, phone providers, mobile ad companies, and…