Described by the Australian Competition and Consumer Commission (ACCC) as "a world-first enforcement action", the decision, though only a "partial" success, is the Commissions first result against a digital platform since it published its Final Report of its Digital Platforms Inquiry in July 2019. It is also the ACCC's second case in which it has succeeded in establishing misleading and deceptive conduct about use of consumer data.
The Federal Court has found that Google LLC and Google Australia Pty Ltd (together, Google), misled "some" users of Android devices about how Google collects user's personal location data, by not making it clear to users that Google was continuing to collect location data through a user's Google account even if their "Location History" setting was turned off.
The decision in the Google case also has potentially broader implications for businesses that collect and use consumer's personal data and more broadly, because, on the Court's approach, all that needs to be established in order to make out a contravention under the Australian Consumer Law (ACL) is that only some reasonable members of the relevant audience are likely to be, or may have been, misled.
We can expect continued scrutiny of data practices, and more cases of this kind in the future. Indeed, the ACCC has commenced further similar proceedings against Google for alleged contraventions of the ACL, relating to a 2016 change in Google's collection and use of user's personal data, for which the ACCC says Google failed to gain user's explicit informed consent.
The ACCC's recent enforcement activity and the ACCC's compliance and enforcement priorities for 2021 serve as a timely reminders for businesses to review their data practices and representations to consumers about data collection, and not simply rely on disclosures that might be made in the detailed terms of a privacy policy or terms of use. In addition, if you are a business supplying goods or services to consumers in NSW, you may also need to consider whether you comply with the new disclosure obligations under the NSW Fair Trading Act, which require upfront disclosure to consumers of prejudicial terms and conditions (including terms that allow a supplier to share identifiable consumer data with third parties). See our earlier insights article for more information.
How did Google mislead consumers?
On 16 April 2021, the Court delivered its judgment in the proceedings commenced by the ACCC in late 2019, finding that that Google breached sections 18, 29(1)(g) and 34 of the ACL by misleading users about personal location data collected through Android mobile devices between January 2017 and December 2018. You can read the decision here: Australian Competition and Consumer Commission v Google LLC (No 2) [2021] FCA 367.
The Court found that Google's conduct breached the ACL through:
- misleading on-screen representations to users that their location data would not be collected if their "Location History" setting was turned off (which was the default setting); and
- not properly disclosing to users that a second setting called "Web & App Activity" (which was turned on by default) also had to be turned off if users didn't want Google to collect their location data.
The ACCC was only partially successful. The Court found that Google's conduct misled or was likely to mislead some, but not all, reasonable users who set-up and used a Google account. However, the Court rejected the ACCC's allegations that:
- reasonable users would have thought that the only way to stop Google using location data when using Google services (such as Google Maps or YouTube) was not to use those services; and
- Google would only obtain or use personal data about the user’s location obtained while using Google services for the benefit of the individual user (such as to provide personalised ads or trip recommendations), and not for Google's benefit (such as obtaining data from one user to personalise ads for another user).
Who needs to have been misled?
The Court's findings on the test for determining whether Google misled its users may have broader implications on the way courts assess misleading and deceptive conduct cases in the future. It is well established that courts must assess whether a representation is likely to mislead or deceive a particular class or group of consumers by reference to the ordinary or reasonable members of that class. However, the ACCC and Google disagreed as to how this test should be applied.
The Court was asked to decide whether the correct approach was to assess the alleged conduct by reference to:
- a single, reasonable member of the defined class of consumers, who would only have one response to each of the relevant statements or representations (Google's position); or
- a range of ordinary and reasonable members within the relevant class, who may have a variety of responses to the relevant statements or representations (ACCC's position).
The Court did not agree that there was a need to isolate a single hypothetical user, and instead considered how the various representations conveyed by Google would have been interpreted by a variety of reasonable users from within the relevant class.
The Court's decision suggests that if any reasonable person within the relevant class may have found the alleged conduct misleading, then a contravention will be established – a potentially a lower threshold for courts to find a representation to be misleading.
Consumers are not likely to read privacy policies or terms in detail (if at all)
The judgment in the Google case appears to recognise a general proposition that most consumers will not read, or will not carefully read, the contents of a Privacy Policy.
Google argued that prominent references to its written privacy policy formed an essential part of the context of its representations to users such that a reasonable user should be understood as having read the privacy policy carefully. The Court did not agree. Although it was acknowledged that some users would have read Google's privacy policy, the Court found that most users would have only "scanned through the Privacy and Terms screen or read it relatively quickly".
The decision emphasises that what is relevant is the "overall impression" given by a representation, notwithstanding that a close reading of the terms might reveal the accurate position.
Review your data collection practices and privacy policies now
All businesses that collect and use customers' personal data need to make sure they have reviewed their privacy policies, customer disclosures and data collection practices to ensure that:
- all critical information about how consumers' data is being collected and handled is clear, concise and upfront. The Google decision highlights that consumers are unlikely to have read through or understood the terms of any privacy policies in any detail, and that Courts will not be persuaded by a defence to misleading and deceptive conduct which relies on consumers being able to access the correct information through a discrete hyperlink or a separate detailed policy. This means that it is essential that any summaries or pop-up screens provide a clear summary for consumers to rely on (including any headings or graphics);
- users are clearly notified of any changes made to the way that their data is being collected and used; and
- the overall impression created by any representations about data practices is not likely to mislead any reasonable members of the relevant audience.
The Google decision also serves as a reminder that what you don't tell consumers is equally as important as what you do. In circumstances where a lack of information may affect the way consumers engage with your good or service, you may be opening yourself up to a risk of breaching Australia's consumer laws.
If you would like help reviewing your data collection practices and policies, or you are interested in knowing what this decision means for your business, please get in touch.
Related Insights