12 August 2020
3 min read
#Technology, Media & Telecommunications, #Competition & Consumer Law, #Data & Privacy
Published by:
The Australian Competition and Consumer Commission (ACCC) has taken aim (again) at Google LLC, bringing proceedings in the Federal Court last month that allege the digital giant misled consumers in respect of its privacy notices.
If the ACCC is successful, the outcome would likely herald big changes for how consumer consents (including for the collection of personal information) are obtained, given that consumers have almost grown used to generalised statements and hidden meanings.
In 2016, Google wanted to start combining the personal information it held in Google accounts (such as Gmail, YouTube and others) with information about that individual’s activities on non-Google sites. It would then use this information to display targeted ads, generating vast amounts of advertising revenue. This practice required a change in Google’s privacy policy, which until then had explicitly stated it would not combine the two sets of personal information unless Google had the consumer’s opt-in consent.
At that time, and still to this day, Google’s privacy policy states that “[w]e will not reduce your rights under this Privacy Policy without your explicit consent” which, to some extent meant that Google committed to providing a greater level of consent than is required under (at least Australian) law.
In order to implement this change, Google users were prompted to click ‘agree’ to a pop-up notification which read much like a service improvement message, and included the following wording:
We’ve introduced some optional features for your account, giving you more control over the data Google collects and how it’s used, while allowing Google to show you more relevant ads.
Users were given the option to click either “I agree”, or, “more information”. Apparently, over 80 per cent of people clicked “I agree” on the first page of the notification. The ACCC will argue that so many agreed because the wording of the opt-in message suggested that consumers were agreeing to something more innocuous and that the pop-up message would therefore be readily dismissed in our thirst to consume that YouTube video or get our search results.
The ACCC alleges that Google did not, in fact, obtain consumers’ explicit consent for this change to the privacy policy, and so the statement that Google would not reduce consumers’ rights without their explicit consent was therefore misleading.
The ACCC will argue that the notification failed to adequately inform users that Google had made the June 2016 Privacy Update to the Privacy Policy, and that it was seeking consent to be able to combine the personal information it held with the information users viewed on third party sites in order to serve advertising to them.
The proceedings should make all businesses think about how they express information in their privacy policies and privacy consent notices, including updates made to them. For example, often you will see statements such as “we will never share your personal information with third parties” when such activities are usually part and parcel of running a business. What businesses often mean instead is that they will not ‘sell’ users’ personal information to third parties. The outcome will also be important in determining what constitutes informed consent and how far organisations need to go to obtain this consent.
Interestingly, in its final report for the Digital Platforms Inquiry (published in July 2019), the ACCC announced it was investigating five incidents of alleged conduct of certain digital platforms under the Competition and Consumer Act 2010. These proceedings are the second of two it foreshadowed against Google – the first was regarding Google’s collection of location data, which we discussed here. There were also two investigations being conducted into Facebook concerning user data shared with third parties and whether its terms of use and privacy policies contained unfair terms. Details of the findings of the investigations are yet to be announced. Regardless of whether the ACCC launches any legal proceedings out of the Facebook investigations, it has certainly indicated over these past few years that it is prepared to take on some formidable opponents.
Author: Emily Booth
Disclaimer
The information in this publication is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this newsletter is accurate at the date it is received or that it will continue to be accurate in the future.
Published by:
