A Google executive admitted during a Senate Judiciary Committee hearing on Tuesday that Google tracks users’ phones — even when their location history is turned off.
Sen. Josh Hawley (R-Mo.) questioned Google Senior Privacy Counsel Will DeVries about the company’s tracking policies during a hearing examining online consumer privacy. Some of DeVries’ answers will likely disturb consumers who thought there was a way to avoid being tracked by Google through their phones.
In his prepared remarks, DeVries told lawmakers that “the processing of personal information is necessary to simply operate the service the user requested.” He asserted that “requiring” individuals to control every aspect of data processing “can create a burdensome and complex experience that diverts attention from the most important controls without corresponding benefits,” and therefore a “specific consent or toggle” should not be required for every use of data.
“I’m concerned about the implicit bargain that consumers are being asked to ratify by which they supposedly get free services but actually have enormous amounts of personal data extracted from them without knowing exactly what’s going on,” Hawley said. He asked DeVries about his claims in his prepared remarks that Google provides “free” services and that the company “clearly explains” how personal data is used. “Is that really true?”
DeVries explained that it’s “complicated” — a word that he used several times as he tried to evade Hawley’s questions about why Google tracks its users’ locations.
An Associated Press report in August 2018 found that “many Google services on Android devices and iPhones store your location data even if you’ve used a privacy setting that says it will prevent Google from doing so.”
“Storing your minute-by-minute travels carries privacy risks and has been used by police to determine the location of suspects — such as a warrant that police in Raleigh, North Carolina, served on Google last year to find devices near a murder scene,” the AP explained.
Google, at the time, was evasive about whether or not users were being tracked when Location Services is turned off.
“There are a number of different ways that Google may use location to improve people’s experience, including: Location History, Web and App Activity, and through device-level Location Services,” a Google spokesperson told the AP. “We provide clear descriptions of these tools, and robust controls so people can turn them on or off, and delete their histories at any time.”
Hawley pointed out on Tuesday that a user’s location is sent to Google hundreds of times a day, even when the phone is not in use. In fact, Hawley said, a user’s location is tracked “every four minutes, or 14 times an hour, roughly 340 times during a 24-hour period,” even when the phone is not in use.
DeVries confessed that “location information is absolutely core to making a mobile phone work the way that you want it to work.” He said that Google has an “optional service” called Location History that is opt-in and “can collect location over time when people turn that on.”
“But Google collects geolocation data even if Location History is turned off, correct?” Hawley pressed.
“Yes, senator, it can in order to operate other services—”
Hawley interrupted: “Let’s just get that on the record. Google collects geolocation history and information even if Location History is turned off.” He asked DeVries if he thought the average teenager was aware that Google tracks his location by scanning area Wi-Fi networks.
DeVries defended the practice, saying the data is used to provide “value” to the user, citing the need for Google Maps to determine where a user is.
Sen. Lindsey Graham (R-S.C.) then jumped into the fray. “The phone is off,” off he reminded DeVries.
The Google exec explained that the location data is necessary to perform a phone’s “basic functions.”
“So the consumer cannot meaningfully opt out,” Hawley shot back, reiterating the fact that the phone is still communicating and sending information to Google even when the phone is not in use and Location Services are turned off. “And you’re monetizing it and using it to direct ads at him, correct?”
DeVries denied that Google is using geolocation data to direct ads at users, repeating his assertion that the information retrieved provides “value” back to the consumer.
“It’s not of monetary value to you?” an incredulous Hawley asked.
“There is some ways that location can be used for ads, so, for instance, your IP addresss—”
Hawley again interrupted: “I thought you just said it wasn’t used for ads.”
“I understand that it’s complicated,” DeVries said.
Hawley said that it’s not all that complicated. “I think when somebody turns off their user information, their location history, they expect the location tracking to be off. But it’s not, in fact. They don’t have a way, apparently, to turn it off.”
“Senator, you can turn off location tracking. There are aspects of location that are necessary to make services work, where if we turn those off your phone wouldnt work the way you expect,” DeVries said, reiterating that it was “complicated.”
“It’s not complicated,” Hawley insisted. “What’s complicated is that you don’t allow consumers to stop your tracking of them. You tell them that you do. You would anticipate that they do — that the consumer would have a reasonable expectation based on what you’ve told them, that they’re not being tracked — but in fact, you’re still tracking them. You’re still gathering the information and you’re still using it.”
“By the way, this is just the phone. We’re not even talking yet about [Google] Search or internet tracking,” Hawley said.
He continued: “Americans have not signed up for this. They think that the products you’re offering them are free. They’re not free. They think they can opt out of the tracking that you’re performing. They can’t meaningfully opt out.” Hawley said it’s like the Eagles song “Hotel California”: “You can check out any time you like, but you can never leave.”
It may very well be true that Google has designed its Android phones and various services in a way that requires them to track people constantly, but as Hawley rightly pointed out, most users are not aware of that fact and don’t understand that when they check consent boxes they’re agreeing to be tracked any time they’re carrying a smartphone.
“That’s kind of what it’s like dealing with your company — and that’s a problem for the American consumer… the idea that your company and others like it are sweeping up information to build a user profile on them that will track every step, every movement, and monetize that and they can’t do anything about it and I can’t do anything about it, that’s a big problem that this Congress needs to address.”
Hawley sent a scathing letter to FTC Chairman Michael Simons on Monday saying that the tech companies — and the FTC — have failed consumers.
“For too long our nation has put off accounting for the price we paid in return for the benefits of the online platforms that now dominate American culture and industry,” he wrote, adding that “Any robust definition of consumer welfare must acknowledge that these companies have harmed consumers by conditioning participation in the modern public square on giving away enormous — and growing — amounts of personal information by leveraging scale to cripple emerging competitors in their infancy.” The FTC’s approach, he said, has been “toothless.”
On Tuesday, Hawley and Sen. Ed Markey (D-Mass.) introduced legislation aimed at reining in tech companies that are tracking children online. The bill would update the Children’s Online Privacy Protection Act (COPPA) to prohibit companies from tracking the location of children under the age of 13 without parental consent and require that consent be obtained from users ages 13 to 15.
“Big tech companies know too much about our kids, and even as parents, we know too little about what they are doing with our kids’ personal data. It’s time to hold them accountable,” Hawley said in a press release. “Congress needs to get serious about keeping our children’s information safe, and it begins with safeguarding their digital footprint online.”
“The Children’s Online Privacy Protection Act remains the constitution for kids’ privacy online, but today we introduce an accompanying bill of rights,” said Markey, original House author of COPPA. “In 2019, children and adolescents’ every move is monitored online, and even the youngest are bombarded with advertising when they go online to do their homework, talk to friends, and play games. In the 21st century, we need to pass bipartisan and bicameral COPPA 2.0 legislation that puts children’s well-being at the top of Congress’s priority list. If we can agree on anything, it should be that children deserve strong and effective protections online.”
The legislation would protect children and minor by:
- Prohibiting internet companies from collecting personal and location information from anyone under 13 without parental consent and from anyone 13 to 15 years old without the user’s consent;
- Banning targeted advertising directed at children;
- Establishing a “Digital Marketing Bill of Rights for Teens” that limits the collection of personal information of teens;
- Revising COPPA’s “Actual knowledge” standard to a “constructive knowledge” standard for the definition of covered operators;
- Creating an “Eraser Button” for parents and children by requiring companies to permit users to eliminate publicly available personal information content when technologically feasible.
- Establishing a Youth Marketing and Privacy Division at the Federal Trade Commission (FTC);
- Requiring online companies to explain the types of personal information collected, how that information is used and disclosed, and the policies for collection of personal information; and
- Prohibiting the sale of internet connected devices to children and minors unless they meet robust cyber security standards;
- Requiring manufacturers of connected devices to children and minors to prominently display on their packaging a privacy dashboard detailing how sensitive information is collected, transmitted, retained, used, and protected.
PJM’s Phil Baker explained in December 2018 how to turn off as many tracking features as possible on your phone, but ultimately, users need to understand that Google has the ability to track you anytime you’re carrying your phone. As Congress and Big Tech continue to duke it out over privacy issues — which may ultimately lead to new laws designed to protect consumers’ private data — it’s imperative to understand that your smartphone is a sophisticated geotracking advice. For now, that is the price you pay for the “free” services Google provides.
Follow me on Twitter @pbolyard
Join the conversation as a VIP Member