Oregon Attorney General Ellen Rosenblum
Oregon state Attorney General Ellen Rosenblum announced the largest ever AG-led consumer privacy lawsuit. Google agreed to a $391.5 million settlement over tracking users location even when they had turned a tracking setting off. Rosenblum and Nebraska Attorney General Doug Peterson led the effort, which ultimately 40 states signed onto. Oregon’s share is $14,800,563. As part of the agreement, Google will be changing its tracking and disclosure practices. We get more details from Assistant Attorney General Kristen Hilton who headed the settlement team.
The following transcript was created by a computer and edited by a volunteer:
Dave Miller: This is Think Out Loud on OPB. I’m Dave Miller. We start today with what’s being called the largest ever internet privacy settlement in the US. It stems from a case led by the attorneys general of Oregon and Nebraska on behalf of 38 other states. They got Google to agree to pay nearly $400 million. The issue at the heart of the settlement is location data. The states alleged that Google misled its users. Those users turned location tracking off, but the company was still collecting that data. Kristen Hilton worked on this case as a Senior Assistant Attorney General for Oregon and she joins us now with the details. Welcome to Think Out Loud.
Kristen Hilton: Thanks so much for having me, Dave.
Miller: Let’s start with the basic facts of this case. What are you alleging that Google did?
Hilton: This investigation started with a 2018 article that the Associated Press published that really boiled down to the fact that Google wasn’t being honest with its users. Many Google services on Android devices and on iPhones were storing location data from users. Even if the person had used a privacy setting that said it would prevent Google from doing that.
And it was really this one particular setting called ‘location history’ that Google told people with location history off the places you go are no longer stored. And that wasn’t a true statement. It turned out that there was another setting that was essentially collecting the same type of location data from people. And this other setting which was called ‘web and app activity’ was automatically turned on for everyone that had a Google account, which was particularly impactful for Android users because you need to have a Google account in order to use the Android phone.
Miller: But what about saying if somebody had a Gmail app on their iPhone, so not fully in the Google world but using Google, would it be the same case?
Hilton: Yep. Google product that was also impacting Google products and services. So if you have Gmail, you are a Google account holder, which means that these two settings would also come into play.
Miller: And how much data are we talking about?
Hilton: Large amounts of data. I mean this was going on from at least 2014. And when we started our investigation, which was in late 2018/2019, that’s five years worth of consumer data. And as you can imagine, the company didn’t really want to give us a lot of details about the level of information that it had collected on everybody. But I think it’s fair to say we’re talking about large volumes of data.
Miller: Do you have an estimate for how many Oregonians would have been affected by this?
Hilton: No, we don’t have that information, but it’s anyone who used an Android phone or has an Android phone and as we were talking earlier, anyone who had Gmail.
Miller: So my assumption is we’re talking about many, many people in Oregon and tens of millions, at least, nationwide, if not into the hundreds of millions?
Hilton: Absolutely.
Miller: What does Google do with this location data? Why is location data such a prize?
Hilton: Google uses the location data to help its advertising business. A lot of people think of Google as an internet company. They use Gmail or they use web browsers, but Google really makes most of its money as an advertising company. So they take location data and they use it to understand different user preferences or user habits and create profiles about people, using this location data. And that is then valuable to them being able to sell advertisements to other companies so that the companies that purchase advertising from Google can essentially get more bang for their buck and really target the particular types of people who may live in a certain area - or let’s say visit certain types of locations. And so it becomes valuable to the company that way.
Miller: You noted that the way you and other states first heard about this was because of reporting, because of an article that first ran in the Associated Press. How common is that? How common is it for some kind of journalistic enterprise to lead to states doing investigations?
Hilton: It’s very common actually. We really appreciate the media and especially investigative journalism that draws attention to issues that we just frankly weren’t aware of. It’s not only good for consumers to have awareness, but it’s very valuable for attorneys general.
Miller: What was the biggest challenge for Oregon and Nebraska? And then the other states that were also signed onto this in terms of pursuing this case?
Hilton: One of the biggest challenges we faced, and would really like users to take away from this settlement, is the laws that we’re enforcing are pretty old. They were around before Google was even a company, before we were all walking around with mobile devices in our pockets. The current laws can be really limiting with what we’re able to say are violations. We really need stronger consumer privacy laws in this country. We think that this settlement highlights the importance of that.
Miller: Well, I’m curious about that. We can talk about the ways you’d like to see those laws change at the state level or the federal level. But were you alleging that Google broke a privacy law in Oregon or is it that they told consumers something that wasn’t true, which seems to me totally different from a privacy specific law?
Hilton: That’s correct, Dave. The allegations were that Google violated our consumer protection law in Oregon, which is the Unlawful Trade Practices Act. The allegations that we focused on were really about the deception and Google being untruthful with consumers, such that consumers were not able to really make meaningful choices about their data. So that is something different than the privacy laws that have been passed in a few other states and that we’re looking to introduce in Oregon.
Miller: Did Google admit wrongdoing as part of this settlement?
Hilton: They did not. In fact, it’s a particular provision in the settlement that says Google does not admit to any wrongdoing whatsoever.
Miller: And that’s not uncommon for these settlements. It seems like that’s one of the things that companies like about these settlements, in addition to the surety of them having a hand in saying how much they’re going to pay. How do you feel about the fact that you’ve worked on this case for a couple of years and the company that, you’re very clear, misled their customers? And yet, as a part of this deal, they’re not saying they did that?
Hilton: I think that that’s pretty par for the course, as you said, with these types of settlements. Even in cases where we file lawsuits and spend many years in court, unless you get an ultimate ruling from a judge or from a jury finding wrongdoing, even settlements in those cases are nobody’s admitting any fault. But we are confident in what we found and reached a settlement where Google has to make meaningful changes to their business practices going forward. And as you noted, they’re going to be paying a significant amount of money for this. So regardless of what the company says about what they did in this situation, we consider Google a wrongdoer.
Miller: Is it your understanding, or your allegation, that Google intentionally set up the system this way, that they intentionally misled users by saying you can turn location tracking off? We won’t track you, but we actually will track you and we just won’t tell you? Or was it more of an inadvertent programming system that gave them a trove of data?
Hilton: As I mentioned before, this conduct was going on for several years. And Google is a very sophisticated company. And our allegation is that Google made programming decisions, they made decisions about how they were going to label certain things or not label certain settings. I don’t think we make a specific allegation in the settlement that everything Google did was intentional, but I would say that it certainly leaned more towards that end as opposed to some sort of programming error.
Miller: A spokesman for the company said,’Consistent with improvements we’ve made in recent years, we have settled this investigation which was based on outdated product policies that we changed years ago.’ Which is relatively dismissive language, saying we settled this, and also, anyway, what you’re talking about is old news. We’ve already taken care of this. At least that’s what I read in those two sentences. Do you agree? I mean has Google already implemented the changes at issue here?
Hilton: Google did change some of the worst practices that were discussed in that 2018 article. But those changes didn’t go far enough. And they still didn’t meet the requirements of our law. So I think even in the statement that Google put out in the blog post, they refer to some of the additional changes that are going to be made in 2023.
Miller: What are those changes, in layman’s terms?
Hilton: Yes. One of the major changes is that they are making their control settings more user friendly. So if a user wants to turn off some of these settings that collect location data, they’re able to turn those settings off and also delete the data that had been collected up to that point at the same time, which we think is a meaningful change.
There’s also a new information hub, a location technologies page that is going to have a lot of information for users about how Google is collecting location data and what they do with it. And one of the biggest changes is that anyone who gets an Android phone, and has to sign up for a new Google account going forward, is going to see detailed information about that which was a previously hidden setting, that was also collecting location information. So they’ll have that opportunity right up at the beginning to say no, I don’t want this setting on.
Miller: Why was this challenge brought by 40 states and 40 individual states coming together, as opposed to the federal government?
Hilton: That’s a great question. The attorneys general are really meaningful enforcers in the privacy space. We have been doing privacy related investigations for several years. A lot of our work has focused on data breach cases, but privacy is an issue that the states care a lot about. And frankly [there’s] strength in numbers. We’re more likely to get better outcomes for consumers when we band together, especially when there’s this many states involved and it’s a true bipartisan effort.
Miller: Could you have argued that what Google did went against existing federal laws that don’t even necessarily have to do with privacy specifically?
Hilton: That wasn’t something that we considered. We really focused on our state laws.
Miller: How does a state like Oregon decide to take the lead on a particular suit as opposed to being one of the dozens of other states that might sign on to it. In this case, Oregon and Nebraska led the way. How did you make that decision?
Hilton: Attorney General Rosenblum is passionate about consumer privacy. We’ve been at the forefront of data privacy and security issues since she took office in 2020. From advocating for a student privacy bill to pushing important amendments to Oregon’s data law, this is just a primary focus for our office. And we really want to be a leader in the privacy space.
Miller: Does that mean that you, as an office, have built up expertise in this? I guess I’m still wondering how it is that it makes practical sense to take the lead. I imagine that means that lawyers there in the Attorney General’s office can’t take the lead on some other case and instead will sign on and have, say, Rhode Island, take the lead or California or whoever. How does it work in terms of figuring out the overall strategy of where you will use the state’s lawyerly resources?
Hilton: Well, a lot of that strategy comes from our attorney general. So I won’t speak to how she lays out her priorities. But I know that privacy is one of those priorities. I was brought into the Department of Justice almost three years ago. I have a certification in privacy laws and so it was just part of, as I mentioned, the attorney general’s overall passion and focus on the consumer privacy area to have me as a dedicated resource leading these types of cases. But I have amazing colleagues who do all manner of other areas of consumer law.
Miller: As I noted, Google has said that they will pay close to $400 million to 40 states all told. Do you know yet how much money Oregon is going to get from that?
Hilton: Yes, Oregon will be receiving a little over $14.8 million.
Miller: And what can that money be used for?
Hilton: That money goes to our consumer protection fund. Basically that fund is what pays for all of our investigation and enforcement work. And we also use it to fund consumer business education, pay for consumer hotlines and other consumer-focused work. One of the things that’s particularly important is that Oregon really makes wrongdoers pay for breaking the law. And the money from this settlement, as I said, goes to fund ongoing consumer work. Our work is paid for by our settlements. The money is not coming from taxpayers.
Miller: How does it get worked out which states are going to get what amounts of money?
Hilton: Oh, it’s based on many factors, Dave. One of the primary factors is looking at how many people are potentially impacted in each case or the population of a case. It also considers the amount of work that a state puts into the investigation.
Miller: How does what Google did, for half a decade or so, differ from what other companies are doing right now? And I’m thinking about Facebook and Amazon and Apple, the other really big companies, many of which have the same basic model of monetizing the digital trails that we leave behind?
Hilton: Yeah. I think that one of the big issues for Google was just how deceptive Google was being with their conduct, that they were saying one thing to people but really doing something else. And certainly the monetization of data and what’s sometimes called the surveillance economy is a concern to our office and, again, something that we hope we will be addressing with comprehensive privacy legislation.
Miller: Tons of companies have their entire business models based on collecting data about their users and then selling that data. But you’re saying that what Google did in lying about the amount of data they were collecting, that’s what’s unusual in this case. Or that’s what you hope is unusual?
Hilton: We hope that’s unusual. But I hope that after seeing this settlement, companies realize that we are paying close attention to the promises that they are making to their users and their consumers. And if they are not being truthful in the promises that they’re making then, you know, we may be coming after them next.
Miller: Especially if reporters doing enterprising work can find that they’re not being truthful.
You’ve mentioned a couple times that this is why you’d like to see comprehensive legislation at the state level. And this is something that a group of Oregonians have been meeting, for a couple of years now, to work on suggestions to lawmakers. Can you give us a sense for what you’d like to see in terms of privacy related legislation?
Hilton: The group of individuals that you referenced, is a privacy task force that Attorney General Rosenblum convened a few years ago. And it’s made up of consumer advocates and industry interests as well. And we would really like to see legislation that includes some limits on how much data companies can collect about people that includes limits on how they can use that information and really gives more powers to consumers to say ‘no, I don’t want you selling my data and I don’t want you using my data for advertising.’
Miller: What would it mean to have state level laws for these international tech companies, as opposed to federal laws?
Hilton: There have already been five states that have passed consumer privacy legislation, including California. And one of the complaints that businesses, especially national and international companies make, is that it’s difficult for them to comply with a patchwork of laws and they would prefer federal legislation. Speaking for myself, I should say, and not necessarily my office, but I am supportive of federal legislation if it can give strong consumer privacy rights to people. But in the absence of federal law being passed, the states are really the next best defense for individuals.
Miller: Before I let you go, I just want to turn to another announcement from the Attorney General’s office that came in today, not a case that, I understand, you worked on. It’s a $3 billion settlement with Walmart for their role in the opioid crisis. The idea behind settlements with drug makers like Purdue is that they knew that these painkillers were addictive but marketed them very strongly as if they weren’t. What’s the culpability of a retailer like Walmart?
Hilton: This settlement with Walmart is really about the fact that it was failing to appropriately oversee the dispensing of opioids at its stores. This is the first settlement with the state Attorneys General involving opioids and a national pharmacy chain. And we do expect more pharmacy settlements in the future.
Miller: Kristen Hilton, thanks very much for joining us.
Hilton: Thanks so much, Dave.
Miller: Kristen Hilton is a Senior Assistant Attorney General for the State of Oregon. She joined us to talk about the record breaking internet privacy settlement with Google. Oregon, along with Nebraska, led this suit that has the involvement of 38 other states. The company has agreed to pay Oregon and those 39 other states nearly $400 million.
Contact “Think Out Loud®”
If you’d like to comment on any of the topics in this show, or suggest a topic of your own, please get in touch with us on Facebook or Twitter, send an email to thinkoutloud@opb.org, or you can leave a voicemail for us at 503-293-1983. The call-in phone number during the noon hour is 888-665-5865.