The United States District Court for the Northern District of California found Google’s privacy policy may not be specific enough to notify users that the Android mobile operating system collects data about their use of third-party apps. The ruling highlights the need for companies to be clear and explicit about what information they collect from users and how that data is used. It also highlights the need to put that information in one place.
The class action lawsuit focuses on Google’s use of an internal software tool called Android Lockbox that allowed it to view anonymized market research data about how often users open rival apps and how long they are used. Google attempted to dismiss the lawsuit by arguing that users had consented to the collection and that its privacy policy disclosed both the fact that it collects data from third-party apps and the specific purpose of that collection.
The district court allowed class action claims of deceit, unfair competition, and breach of contract to move forward past a motion to dismiss. The court held that Google’s privacy policy may not have made it clear to consumers that Google collected information about user’s app activity unassociated with Google.
The opinion identifies potential ambiguities in provisions of Google’s privacy policy, which were separated by as much as 14 pages. For example, the court determined that Google’s description of information it collects about a user’s activity on the services as including “… activity on third-party sites and apps that use our services” could be viewed by a reasonable person as only covering Google-owned apps. The court also found that another portion of the privacy policy that stated, “We collect information about the apps, browsers, and devices you use to access Google services, which helps us provide features like automatic product updates and dimming your screen if your battery runs low,” could be interpreted to mean Google only collected that data to improve the user’s experience with their mobile device.
“These statements may not be understood by a reasonable user to disclose collection of her usage information on an independent third-party app,” Magistrate Judge Susan van Keulen wrote. “Disclosure and acceptance of statements for a different purpose is not sufficient to establish explicit consent to the collection of information regarding use of third-party-apps for the purposes of using that information to Defendant’s competitive advantage.”
For companies in the U.S. that rely on consent to collect and exploit user information, the court’s decision reiterates the need to write clear and specific privacy policies, especially when it comes to the collection of user data from third parties. The decision also cautions against privacy policies that could confuse users into believing that their data is collected only for the benefit of the user.
