Skip to main content

Google accused of GDPR privacy violations by seven countries

Google accused of GDPR privacy violations by seven countries


Google faces its first challenge under Europe’s strict new data protection rules

Share this story

Illustration by Alex Castro / The Verge

Consumer groups across seven European countries have filed GDPR complaints against Google’s location tracking (via Reuters). The European Consumer Organisation (BEUC), of which each of the groups are a member, claims that Google’s “deceptive practices” around location tracking don’t give users a real choice about whether to enable it, and that Google doesn’t properly inform them about what this tracking entails. If upheld, the complaints could mean a hefty fine for the search giant.

The complaints, which each group has issued to their national data protection authorities in keeping with GDPR rules, come in the wake of the discovery that Google is able to track user’s location even when the “Location History” option is turned off. A second setting, “Web and App Activity,” which is enabled by default, must be turned off to fully prevent GPS tracking.

“Deceptive practices” to get your location data

The BEUC claims that Google uses “deceptive practices” to get users to enable both these options, and does not fully inform users of what doing so entails. As such, consent is not freely given.

Responding to the complaints, Google said that Location History is turned off by default, and that it makes clear that disabling it does not prevent all location tracking. It said that it intends to read the report to see if it contains any information for it to take on board.

Google is not the only tech giant to be facing a major GDPR complaint. Earlier this year, the Irish data privacy commissioner said it would be investigating Facebook over a security breach that affected 29 million accounts. As a new piece of legislation enacted in May, GDPR violations are still relatively untested in courts so it’s unclear exactly how strong of a case these seven consumer groups have. If successful, GDPR states that Google might be liable to pay a fine of up to four percent of its global revenues, which would be over $4 billion based on its 2017 filings.