The Attorneys General of Indiana, Texas, and Washington DC on Monday each filed lawsuits against Google alleging that the search giant uses deceptive user interface designs known as “dark patterns” to obtain customer location data without adequate consent.
“We’re leading a bipartisan group of AGs from Texas, Indiana, [and] Washington, each suing in state court to hold Google accountable,” said Karl Racine, Attorney General of Washington DC, in a statement via Twitter. “We’re seeking to stop Google’s illegal use of ‘dark patterns’ [and] claw back profits made from location data.”
Dark patterns is a term for describing user interface design that is intended to produce a specific response, such as making the button to consent to data sharing more visually appealing than the button to reject it. They can be realized by incorporating manipulative digital design elements into webpages and app interfaces to steer behavior through the use of colors, button placement, screen layout, text labeling, and so on. They can be thought of as the visual and interactive equivalent of “push polling,” which is the careful wording of survey questions to elicit a preferred response.
Long a source of concern among digital rights advocates, governments have recently started trying to curtail the use of dark patterns. California last year amended the California Consumer Privacy Act (CCPA) to ban the use of dark patterns that deter people from opting out from having their personal data sold.
The US Federal Trade Commission last year adopted a new enforcement policy to discourage the use of dark patterns. Europe’s Digital Services Act (DSA), expected to take effect next year, gained a dark pattern ban last week. Last month, a bipartisan group of US lawmakers re-introduced the Deceptive Experiences to Online Users Reduction (DETOUR) Act, a bill that tried to ban large online platforms from using dark patterns in 2020 but was never voted upon.
These latest three lawsuits against Google contend that because location data is critical to Google’s advertising business, the company has a financial incentive to discourage users from withholding access to location data.
“Google has employed and continues to employ a number of deceptive and unfair practices to obtain users’ ‘consent’ to be tracked and to make it nearly impossible for users to stop Google from collecting their location data,” the lawsuit filed against Google in Washington DC states [PDF].
“These practices include privacy-intrusive default location settings, hard-to-find location settings, misleading descriptions of location settings, repeated nudging to enable location settings, and incomplete disclosures of Google’s location data collection and processing.”
The Texas lawsuit [PDF], filed by Republican Texas Attorney General Ken Paxton, who is also involved in a multistate antitrust complaint against Google’s ad business, suggests Google’s location data controls in its apps and webpages are illusory.
“In fact, Google’s claims to give users ‘control’ and to respect their ‘choice’ largely serve to obscure the reality that, regardless of the settings users select, Google is likely still hard at work collecting, storing, and monetizing the very location data users seek to keep private.”
The Indiana lawsuit [PDF], filed by Republican Attorney General Todd Rokita, cites examples of alleged dark patterns, such as “privacy-intrusive default location settings, hard-to-find location settings, misleading descriptions of location settings, repeated nudging to enable location settings, and incomplete disclosures of Google’s location data collection and processing.”
All three complaints rely upon a 2018 Associated Press report that found Google tracks the locations of Android and iPhone users whether they grant location tracking permission or refuse it. Each covers practices dating back to 2014 and includes multiple redacted passages.
Short-term solution to a legal issue
Jonathan Mayer, assistant professor of computer science and public affairs at Princeton University, welcomed the legal challenge over the use of dark patterns but also expressed concern that existing laws may not be well suited to deal with them.
“I’m glad AGs are taking on dark patterns,” he said via Twitter. “But this litigation also highlights the challenge of squeezing dark patterns into current consumer protection law. It’s difficult to articulate problems of choice architecture manipulation through ‘deception’ and ‘unfairness’ authorities.”
Google, which on Friday accused AG Paxton of grandstanding and filed a motion to have the Texas-led antitrust complaint against its ad business dismissed, also pushed back against this latest trio of lawsuits.
“The Attorneys General are bringing a case based on inaccurate claims and outdated assertions about our settings,” said Google spokesperson José Castañeda told The Register. “We have always built privacy features into our products and provided robust controls for location data. We will vigorously defend ourselves and set the record straight.”
Google’s statement included summaries of various improvements made to the location data settings of Google applications in recent years, with the stipulation that these passages be paraphrased rather than quoted directly. The implication is the AGs’ claims have at least in part been addressed through recent product updates.
If Google has in fact undone some or all of the alleged dark patterns, the courts hearing these cases still need to sort out whether Google benefited from unlawfully coerced location data during some past period of time and whether the AGs are entitled to claw back location-based ad profits during this period. ®
