Unsealed Google lawsuit docs show its own engineers were confused by privacy settings

In internal emails unsealed Friday in an ongoing consumer fraud lawsuit, Google employees admitted that some parts of their applications’ location privacy settings were confusing and could be misleading. 

In May, Attorney General Mark Brnovich filed a heavily redacted lawsuit alleging that Google’s data-collection processes had violated the state’s Consumer Fraud Act. 

The Attorney General’s Office began investigating Google after an Associated Press article in 2018 revealed certain ways the company tracks users movements and the difficulties of removing those tracking permissions. 

“I agree with the article,” an unnamed Google employee wrote in an internal email released Friday along with other exhibits that are part of the state’s case. “Location off should mean location off; not except for this case or that case.” 

Alongside the release of the heavily redacted exhibits is a new version of the state’s previous complaint with sections that had previously been redacted now visible. 

View note

For example, a previously redacted paragraph in the complaint now reveals that the Attorney General’s Office found that Google employees had admitted that the company’s location history and web app activity disclosure policies were “misleading.” 

“Privacy controls have long been built into our services and our teams work continuously to discuss and improve them,” Google spokesman Jose Castaneda said in a statement to Arizona Mirror. “In the case of location information, we’ve heard feedback, and have worked hard to improve our privacy controls. In fact, even these cherry picked published extracts state clearly that the team’s goal was to ‘Reduce confusion around Location History Settings’.”

The documents show that employees were working behind the scenes after the AP story dropped to try to change the user interface to make it easier for Google users to opt-out of location sharing. However, one unnamed employee expressed their dismay about thinking they had their location tracking turned off, only to find it was not. 

“Speaking as a user, WTF? More specifically I **thought** I had location tracking turned off on my phone,” the unnamed software engineer said in the released chat logs. “So our messaging around this is enough to confuse a privacy focused (Google software engineer). That’s not good.” 

Documents released also show that Google’s privacy policy was crafted in a way to allow applications that had location tracking turned off from using the location tracking information from another Google application that had location tracking on. 

“My understanding is that nothing is current (sic) stopping one Google product (A) from using location logged by another Google product (B) if [REDACTED] approves the A<-B use,” the unnamed employee says. “In fact, our landmark privacy policy came into existence pretty much for the very reason of enabling cross-product data use.” 

View note

Google also had an “Oh Sh–” meeting when the AP story was published, and company executives closely watched the reactions of politicians and pundits. 

“Your name came up today during our Monday morning ‘Oh Sh–’ meeting in relation to this story,” said an email that went out to the entire Google communications team. “Both comms and policy are looking for an update on where we are in terms of fixing ‘location history’ fixes and having one single place to turn off instead of 3.” 

The company also had a series of reports that tracked how the AP story was seen and shared across social media and noted that “100%” of the coverage was negative. 

“We’re seeing a growing narrative driven by third party commentary (policy influencers), that alludes to FTC/congressional action (CNET, Vanity Fair, Wired). This will likely become a bigger focus as the week goes on,” the report said. 

The AG did seek some documents in relation to congressional action that was taken. 

In 2018, Google officials testified before the House Judiciary Committee. The AG sought the notes and documents prepared for that hearing, but the company said those documents were protected by attorney-client privilege. 

Google said it has requested that the court redact portions of the documents that were released in order to protect proprietary and confidential information from competitors like Oracle. 

The company contends that it has cooperated with the AG and provided “tens of thousands” of documents related to the AG’s nearly two year investigation as well. 

This isn’t the only fight against the behemoth tech company the AG’s office is involved in, either. 

Last year, Brnovich joined an antitrust investigation of Google with 48 other states, and now the U.S. Department of Justice is allegedly drafting a federal antitrust lawsuit to go after the company that could begin sometime this summer. 

Brnovich is asking for a jury trial against Google. 

There are a total of 270 exhibits filed in the case; so far, 33 have been made public.