Google court docs show that users who opt out of tracking are still monitored

Newly released documents in the Arizona Attorney General’s lawsuit against tech behemoth Google reveal more details about the company’s response to reporting on its privacy policies and how Google users’ IP addresses are used to obtain exact location information.

Attorney General Mark Brnovich’s case, filed in 2020, is part of a larger investigation that has been going on since at least 2018, after an Associated Press article revealed certain Google applications store location data without asking, and that deleting the data is a time-intensive process. AP found that Google Maps, for example, creates a snapshot of where users are whenever they open the application, even when location history is turned off.

The ongoing case has been fraught with battles over redactions and sealing of documents.

Last year both Google and the attorney general agreed to a special discovery master, or SDM, an outside person who would oversee the discovery process and settle any disputes. During the discovery process under the SDM, the state has had 30 hours of witness depositions and over 200,000 pages of documents have been produced, according to the court ruling.

The initial lawsuit filed by the attorney general included 270 exhibits, of which only a small portion have been made public. Some of those documents shed light on certain issues such as Google’s own engineers being confused by their privacy settings and how Google’s apps shared location information with other applications.

The newly released documents are expert witness testimonies from both the state and Google which were under protective order and for “attorney’s eyes only.” The documents contain excerpts from testimony by Google employees as well as internal emails discussing the location history and Web Application and Activity settings at the heart of the controversy in the AP article.

The documents also detail a Google tool called “IPGeo” which, according to a 2009 presentation obtained by the attorney general, is designed to “predict users’ locations from their IP addresses by improving ways of exploiting available data, and to provide this knowledge to all Google products.”

The attorney general’s office also found a confidentiality notice attached to the presentation about the tool.

“You have no idea how incredibly confidential this one is,” the notice said. “My my, is this confidential. I kid you not. Imagine an article titled ‘Google knows where you live, because it spies on you’ in the NYT. You’ve been warned.”

One of the state’s experts, Jennifer King, a privacy and data policy fellow at Stanford University, said that the tool is used specifically by Google and tracks its users regardless of their settings. It also turns those who choose to opt-in to location reporting into “reporters” of those who chose to opt out.

Google’s own employees also began to question how the company was characterizing location history settings while using this tool, according to internal emails.

Former software engineer Blake Lemoine made headlines earlier this year when he said he believed that Google’s AI LaMDA may be sentient. He was later fired by the company but he also expressed concerns about how the company portrayed location information to “father of the internet” and Google Chief Internet Evangelist Vint Cerf.

“[L]ocation information derived from IP addresses is an inescapable part of the internet so we don’t need users’ permission to use it,” Lemoine said in his email to Cerf. “I believe that the level of accuracy of our IP Geo system is far beyond anything achievable based solely on the location information inherent in IP Addresses. I believe that we are deceiving users by telling them they can turn off location and then spending millions of dollars to infer their location through other means … I feel like we’re lying to our users by giving them a permission setting that we find a way around.”

Cerf responded saying that Lemoine “makes a good point that we appear to be tracking even when users have turned off what they think and what we imply are tracking mechanisms” and that he was shocked that the company had “created a timeline of date, hour, location, and route for 18 months” of his movements which he only discovered when someone told him to look at the Google Maps Timeline.

After the AP article dropped in 2018, Google employees also voiced their fear over the backlash, with one stating that some in the company were starting to “freak out that this could be our Cambridge Analytica moment,” referring to how 87 million people’s private data was harvested from Facebook by the British firm.

In documents obtained by the attorney general’s office and discussed by expert witness Colin Gray, an associate professor at Purdue University, one Google employee expressed her confusion and fear over the company’s device location settings.

“So there is no way to give a third party app your location and not Google? This doesn’t sound like something we would want on the front page of the NYT,” said Jen Chai, a product manager for Android.

Gray is an expert in what are called “dark patterns,” user interfaces that trick, coerce or manipulate a person into agreeing to their terms. The phrase has gained increased attention lately as the Federal Trade Commission has been investigating Amazon and its use of ambiguous language during sign up and cancellation. Internal documents obtained by Business Insider showed that employees knew they were deliberately confusing consumers.

“First, Google employs dark patterns through the use of confusing terminology that requires the user to intuit that location data is not only contained within Location History,” Gray said in his report. “Second, the use of opt-in by default for (Web and App Activity) automatically tracks users’ location data, possibly without their knowledge.”

Gray also added that even if “every setting on an Android device were disabled Google would still collect a user’s location data through IPGeo” and another tool whose name was redacted from the documents. Both of those  tools operate  independent of settings.

Google shot back at the state and its experts citing that its privacy options have always been open and transparent, adding that Gray’s methodology lacked scientific rigor.

“I observe no confusing, indistinct, misleading, manipulative, or deceptive elements in the way these screens were organized,” said Donna Hoffman, a professor of marketing at the George Washington School of Business. “On the contrary, the screens offer users control over the choices they may wish to make as they navigate through numerous settings options.”

Hoffman contended that the “Location History toggle is an opt-in account-level feature service, not a location master setting for the device” and that information for users looking for more in-depth understanding of how their data could be used can find it in Google’s privacy policy, adding that including information on specific tools would harm proprietary information.

“That level of disclosure may threaten the security of Google (and possibly other firms’) intellectual property, and is certainly beyond the level of detail required by smartphone users to be aware of, and make informed decisions regarding location related settings on their smartphones,” Hoffman said.

Hoffman also contended that when consumers encounter an app that provides a high level of value they are “increasingly willing to discount privacy.” Hoffman also gave more detail on a meeting, referred to as an “oh sh–” meeting, that took place after the AP story dropped.

“As for the so-called ‘Oh sh–’ meeting that Dr. Gray apparently attaches so much significance to, my understanding is that was a regularly scheduled weekly meeting about press events and other communications-related items that continue to date,” Hoffman said. “Such meetings are consistent with Google’s customer-centric culture of innovation and constructive use of feedback.”

“Your name came up today during our Monday morning ‘Oh Sh–’ meeting in relation to this story,” said an email that went out to the entire Google communications team. “Both comms and policy are looking for an update on where we are in terms of fixing ‘location history’ fixes and having one single place to turn off instead of 3.”

The company also had a series of reports that tracked how the AP story was seen and shared across social media and noted that “100%” of the coverage was negative.

“Privacy controls have long been built into our services and our teams work continuously to discuss and improve them,” José Castañeda, Google spokesperson said in an emailed statement to the Arizona Mirror about the most recent document release. “In the case of location information, we’ve heard feedback, and have worked hard to improve our privacy controls. As our experts showed, the Attorney General continues to mischaracterize our services and products.”

On Thursday, Judge Timothy Thomason ruled in favor of the state to allow Gray to be an expert witness after Google attempted to preclude his testimony and any references to “dark patterns.”

In the ruling the court found that “some of Google’s arguments turned out to be disingenuous” after the state reached out to a scholar Google quoted to question the use of dark patterns who replied that Google “is misinterpreting his paper” and endorsed the validity of dark patterns.

A trial in the case is set to begin Oct. 24.