An estimated 1.3 million users were affected

Google has been fined $42 million (AUD 60 million) by Australia's Federal Court for misleading consumers about the collection and use of their personal location data.

The issue relates to personal location data collected on Android phones between January 2017 and December 2018 following a complaint from the country’s competition regulator, the Australian Competition and Consumer Commission (ACCC).

Authorities said that Google breached the Australian Consumer Law (ACL) by telling some Android users that ‘location history’ was the only Google account setting that affected whether it collected, kept and used personal data about their location.

In reality, another Google account setting titled ‘Web & App Activity’ also enabled Google to collect, store and use personal data when enabled. That setting was turned on by default.

The court also ordered Google to ensure its policies include a commitment to compliance and to train certain staff about Australian Consumer Law, as well as to pay a contribution to the ACCC’s costs.

“This significant penalty imposed by the Court today sends a strong message to digital platforms and other businesses, large and small, that they must not mislead consumers about how their data is being collected and used,” said ACCC Chair Gina Cass-Gottlieb.

“Personal location data is sensitive and important to some consumers, and some of the users who saw the representations may have made different choices about the collection, storage and use of their location data if the misleading representations had not been made by Google.”

It is the first public enforcement outcome arising out of the ACCC’s Digital Platforms Inquiry, according to Cass-Gottlieb.

A larger fine narrowly avoided

The ACCC began proceedings against Google Australia in 2019. The competition authority estimates that some 1.3 million Google accounts may have had control over their personal data misrepresented.

Despite Google taking steps to address the issue in December 2018, which included removing the misleading function, proceedings were underway. In April 2021, the country’s Federal Court found that Google and its Australian subsidiary had breached the ACL.

Both Google and the ACCC jointly submitted to the court that the AUD 60 million penalty be issued to Google and that no separate penalty against the Australian subsidiary should be administered as it was not responsible for the preparation of the misleading screens.

Until September 2018, the maximum penalty for breaches of the ACL was $1.1 million per breach. However, after September, the maximum penalty is the higher of $10 million, three times the value of any benefit obtained or − if the value cannot be determined − 10% of revenue. The majority of Google’s conduct occurred before the maximum was increased.