Google is once again in eye of the storm over tracking users via location data. Close on the heels of a shocking reveal by the American Civil Liberties Union (ACLU) that the Department of Homeland Security (DHS) has been buying location data of millions of cellphone users from third party players, an investigation by Tech Transparency Project (TTP), an initiative by the Campaign for Accountability, shows how the search engine giant’s technology allows for unwanted surveillance that can expose a user’s location.
The TTP investigation, which comes following the US Supreme Court ruling that overturned Roe v. Wade, thus essentially taking away the constitutional right to an abortion, exposes the risks Google exposes its users to, including abortion seekers, victims of domestic abuse or stalking, and others who want to protect their privacy.
ALSO READ: DHS Found Buying Location Data of Millions From ‘Data Brokers’
Explaining about its investigation in a post titled “Google Has a Stalking Problem”, TTP wrote that though Google has banned some ‘stalkerware’ apps, “but the company makes it alarmingly easy to use its tools and apps to track the location of other users, creating new risks in the post-Roe era”.
Google had announced on July 1, following the Supreme Court decision overturning Roe v. Wade, that it if its systems identified that someone had visited certain medical facilities – such as counseling centers, domestic violence shelters, abortion clinics, fertility centers, addiction treatment facilities, weight loss clinics, cosmetic surgery clinics, and others – such entries would be deleted from its Location History soon after their visit.
Google’s announcement, while welcomed, was met with a lot of ridicule and cynicism given the tech giant’s long history of making a business by violating data privacy norms.
What the investigation revealed
Though Google announced that the move will take place soon, in the next few weeks, the TTP investigation found that an abortion clinic’s exact location remained in Google’s location history for more than two weeks. The TTP investigation was simple — carrying a smartphone to an abortion clinic. The exact route taken and time spent at Planned Parenthood clinic, an abortion clinic based in Washington, D.C., was also available on the user’s Google Maps app.
The other simple investigation by TTP found that if an Android user could get access to another user’s device and log into their own Google Play Store account, the location history of the latter would then be visible to the former, without the latter having any idea that they could be tracked.
As part of its investigation, TTP followed up on the expose by one Pieter Arntz, a researcher. September 2021, Arntz had described in his Malwarebytes blog how he had logged into his Google Play Store account from his wife’s phone. Arntz said he was simply looking to install an app, and at the time happened to have his Google Maps Timeline feature enabled. After downloading the app, he forgot to log out of the Google Play Store, but revealed that shortly afterwards he started receiving location updates from his wife’s phone even though her own phone’s location history was switched off.
Arntz then contacted Google urging them to sort about this privacy/security issue.
However, TTP’s recent experiment found that even after 10 months, the issue very much exists and Google has failed to close this dangerous loophole.
ALSO READ: Location Data Protection – A Tale of Two Countries
As part of another investigation based on a Reddit post by a man who said he could track the location of his then-girlfriend after logging in to his Gmail account on her phone. TTP used the the same two Android phones and Google accounts, TTP found that one of the users could subsequently view the other’s locations and routes on their own phone if they had earlier logged into their Play Store Account on the latter’s phone.
“It is easy to contemplate a scenario in which a spouse, parent, or employer might log in to the Play Store on someone else’s phone. Anyone who provides technical help to someone else, buys them an app, or manages something on their device might have a reason to log in to Google Play. Someone with ill intent could easily log in to the Play Store under the guise of looking at a photo or website on another person’s phone,” TTP said.
Arntz had also pointed out that what makes users particularly vulnerable is Google does not send notification to a user when another account logs into the Play Store on their device.
Google’s track record of privacy violations
Google has a long track record user data privacy violation, and has many times faced criticism, penalties and even litigations, over collection and storage of user location data. A 2018 investigation by Associated Presshad found that even when a user has their location history disabled, Andriod phones continue to track their location, which is stored for months on.
Further, Google has many times been accused of collaborating with law enforcement agencies by sharing user data, even though the company claims it follows the strictest of procedures before complying with such request.
“Government agencies from around the world ask Google to disclose user information. We carefully review each request to make sure it satisfies applicable laws. If a request asks for too much information, we try to narrow it, and in some cases we object to producing any information at all. We share the number and types of requests we receive in our Transparency Report,” Google states on its website.
However, as recently as 2021, an accidentally unsealed court document showed that the federal investigators were secretly ordering Google to provide data on anyone typing in certain search terms. “There are fears such keyword warrants threaten to implicate innocent Web users in serious crimes and are more common than previously thought,” Forbes wrote in its report.
With data privacy again taking centerstage, particularly in a post-Roe era, Google sure has to pull up its socks.
