Google LLC has been on the receiving end of the third highest penalty for a breach of the Australian Consumer Law (ACL), joining a line of record-breaking penalties sought by the ACCC in recent years, over its data collection practices. On 12 August 2022, the Federal Court of Australia ordered it to pay $60 million in fines for misleading Australian Android users as to how and when it would collect and use their personal data (Australian Competition and Consumer Commission v Google LLC (No 4) [2022] FCA 942).
This is also the first penalty against a digital platform since the Australian Competition and Consumer Commission’s (ACCC) Digital Platforms Inquiry and ACCC Chair, Gina Cass-Gotlieb, says that it "sends a strong message" to digital platforms and other businesses. The Court emphasised that personal location data is sensitive and important to at least some users, and that many consumers are justifiably and properly concerned about privacy and the storage and use of personal information. The ACCC stressed that users’ ability to make informed choices about the collection, storage and use of their data is a serious matter.
The collection of location data and Google’s representations
In April 2021, the Court found that Google and Google Australia Pty Limited misled "some" users of Android devices about how Google collects users’ personal location data, by not making it clear to users that Google was continuing to collect location data through a user's Google account even if their "Location History" setting was turned off.
In summary, the case against Google centred around three contraventions. The Court found that various screens presented to and viewed by an estimated 1.3 million Android users during the set-up and use of their Google accounts had the effect of:
- conveying the misleading representation that the “Location History” setting was the setting which controlled whether Google would obtain personal data about the user’s location;
- misleading users that Google would not be able to obtain, retain or use personal data about their location, if their "Location History" setting was turned off (which was the default setting); and
- not properly disclosing that a second setting called "Web & App Activity" (which was turned on by default) also had to be turned off if users didn't want Google to collect, or otherwise retain and use, their location data.
The parties jointly submitted that penalties totalling $60 million for those three courses of conduct were appropriate and "struck the right balance between deterrence and oppressive severity", having regard to the well-established penalty factors.
The Court's job was to decide whether the penalty fell within an appropriate range. After considering the:
- duration of the contravening conduct (over 20 months);
- the number of potentially affected consumers (over 1.3 million);
- the size and financial position of Google (Google revenues connected with Australia between USD$2.1 billion and USD$3 billion per year);
- the lack of involvement of senior management;
- Google's corporate culture conducive to compliance, including taking remedial action early and accepting various compliance measures; and
- Google's co-operation with the authorities,
the Court concluded that the agreed penalty was appropriate.
Global parent company on the hook
Google, a company incorporated in the United States, was found to be liable for engaging in the conduct and making the representations that the Court found were likely to mislead. Google Australia, its subsidiary, was also found to be liable by adopting and endorsing the representations made by its global parent. The Court determined that Google should be responsible for the full extent of the penalty. This was because Google Australia was not responsible for preparing the screens containing the misleading representations, nor did it directly make those representations itself. Google Australia's responsibility was limited to the fact that the ordinary and reasonable user would have understood that Google Australia had adopted and endorsed Google’s conduct and representations through its sale of Pixel devices (on which the Android operating system is installed) in Australia.
The Court noted that “the corporate vehicle through which Google chose to implement its conduct” was not significant and considered that the penalty imposed on Google was a sufficient deterrent. It was therefore satisfied that Google Australia did not need to pay any penalty, but must enter into certain agreed compliance measures.
Misrepresentations made along the user journey are just as serious
The decision against Google also demonstrates that a misleading representation does not need to be a headline statement to attract a significant penalty. In the Google case, the misleading representations were made to just “some” consumers who clicked on certain hyperlinks and navigated through a number of further screens.
Misleading representations that are expressly or impliedly made at any point along the user journey appear to be treated just as seriously.
Importance of remedial action
The ACCC did not allege that Google deliberately contravened the ACL and the parties were agreed that senior managers of Google were not involved in the contravening conduct. Google had also taken remedial action to address the contravening conduct, so that by December 2018, users were no longer shown the misleading screens. These are relevant mitigating factors.
However, the Court found:
“Google is a company with significant levels of interaction with consumers, such that consumer laws should be front of mind. Further and importantly, many consumers are justifiably and properly concerned about privacy and the storage and use of personal information, including information about their location from time to time. This should be, and presumably is, front of mind to commercial entities which profit from the use of such information. It is not acceptable that consumers be exposed to being misled on these sorts of issues, even by conduct which is not deliberate.”