Australian regulator sues Google over 'misleading' personal data collection

Australia's competition regulator has launched court proceedings against Google over "misleading" data collection practices dating back to 2016, when it allegedly failed to gain explicit consent from consumers to expand the information it collected on them.

The Australian Competition and Consumer Commission (ACCC) has brought the case to Australia's Federal Court. It specifically calls into question Google's move in 2016 to start combining personal information from consumers’ Google accounts with information about their activities on non-Google sites. Google could track this activity through its suite of advertising-technology tools. Its ad server, formerly known as DoubleClick, is the largest in the market, tracking activity on a huge proportion of publisher sites.

Previously, the internet giant only collected and used personally identifiable information about Google account users’ activities on Google-owned services and apps like Google Search and YouTube for advertising purposes.

Linking up data about users’ non-Google online activity with their names and other identifying information from their Google accounts enabled the tech company to offer more targeted advertising, improving the commercial performance of its advertising businesses.

The search giant began prompting users to provide consent to link the two subsets of data from June 28, 2016, according to the ACCC statement. Google account holders were prompted to click “I agree” to a popup notification that purported to explain how it planned to combine their data. The notification stated that "more information will be available in your Google Account making it easier for you to review and control" and that "Google will use this information to make ads across the web more relevant for you".

The ACCC alleges that the 'I agree' notification was misleading, because consumers could not have properly understood the changes Google was making nor how their data would be used. Therefore, the ACCC argues, Google failed to properly inform consumers about the change in data collection processes, and did not give them with an opportunity to provide informed consent. To be clear, the proceedings do not allege any violation of privacy laws.

Sims said the data collection practice "allowed Google to increase significantly the value of its advertising products" but was at the detriment of consumers.

"Google significantly increased the scope of information it collected about consumers on a personally identifiable basis. This included potentially very sensitive and private information about their activities on third party websites. It then used this information to serve up highly targeted advertisements without consumers’ express informed consent," Sims said.

"The ACCC considers that consumers effectively pay for Google’s services with their data, so this change introduced by Google increased the “price” of Google’s services, without consumers’ knowledge," he added.

The ACCC also alleges that Google misled consumers about a related change to its privacy policy made during the same period. The company changed the wording of its privacy policy from June 28, 2016 to reflect the broader data collection practices it had introduced. It formerly stated it "will not combine DoubleClick cookie information with personally identifiable information unless we have your opt-in consent". That was changed to "[d]epending on your account settings, your activity on other sites and apps may be associated with your personal information in order to improve Google’s services and the ads delivered by Google".

The privacy policy also states that Google "will not reduce your rights" without gaining "explicit consent", but the ACCC argues that Google did not in fact obtain consumers’ explicit consent for this change to the privacy policy.

"Google made a clear representation about how it would protect users’ privacy. The ACCC alleges that Google made changes without obtaining the explicit consent it had promised consumers it would obtain before altering how it protected their private information," Sims said.

The conduct is alleged to have impacted millions of Australians with Google accounts.

In a statement sent to Campaign, a Google spokesperson said the company "strongly disagrees with" the allegations and intends to defend its position.

"In June 2016, we updated our ads system and associated user controls to match the way people use Google products: across many different devices. The changes we made were optional and we asked users to consent via prominent and easy-to-understand notifications. If a user did not consent, their experience of our products and services remained unchanged. We have cooperated with the ACCC’s investigation into this matter. We strongly disagree with their allegations and intend to defend our position," the statement read.

The ACCC is pursuing Google over various elements of its business model. It conducted a broad inquiry into digital platforms including Google over 2018-2019 that looked at the effect the platforms have on competition in the media and advertising industry in Australia. After releasing the results, in April it was asked by the government to draw a mandatory framework for how digital platforms would provide a fairer value exchange to the news industry. This was followed in June by the ACCC's release of a model framework for how digital platforms including Google should counter the spread of misinformation. It has given the platforms until December to develop a single, industry-wide code.

The regulator has previously mounted a Federal Court case against Google over alleged "misleading and deceptive conduct" related to its sponsored search results. The court ruled in Google's favour in 2013, bringing the five-year battle to a close.