Google set to rein in apps' access to data, even as it faces regulatory pressure over location-data collection

Google told app developers today that by late 2021, a unique device-identifying code that Android apps use to target ads to individuals will be off-limits if a user opts out of personalized advertising, following Apple’s lead in giving users more privacy control over the personal data apps can access.

Google’s move, which will take effect with the full release of its Android 12 mobile operating system, appears to be a slightly less aggressive version of what Apple did with its iOS operating system when it required apps that share data with third parties to obtain the user’s opt-in consent to access its advertising device identifier.

But just as Apple received regulatory scrutiny and was hit by antitrust litigation in Europe over the “AppTransparencyTracking” changes it launched in April, Google’s move is likely to be scrutinized by competition and privacy regulators.

Google is already defending enforcement actions from regulators in the US state of Arizona and in Australia over the veracity and transparency of its disclosures about the location data it collects for ad-targeting purposes from Android phones and tablets. The company began warning app developers last month that with the full release of Android 12 this fall, they're likely to lose access to some of the precise location data now available to target ads.

“In Android 12, we will give users more control over their location data. Users will have a clear choice regarding the precision of location provided to the app by selecting approximate location,” Google told Android app developers in a May 18 blog post. “We encourage you to review your use case for location and request ACCESS_COARSE_LOCATION [location source code] if your features don’t need the user’s precise location. You should also be prepared for users to reduce location precision.”

The difference between precise and “coarse” location is at the crux of newly unsealed allegations in litigation filed against Google a year ago by Arizona Attorney General Mark Brnovich. In a suit that could go to trial next year in Maricopa County Superior Court, Arizona alleged in language made public in recent days that when Android users toggled location tracking “off,” Google merely switched to collecting location data that was less accurate.

“Google operates on the principle that ‘off means coarse’ — in other words, Google reduces the precision with which it collects and uses a user’s information when a device’s location setting is off but does not stop the collection and exploitation of that information altogether,” Brnovich said in a recently unredacted section of the complaint. “Indeed, it is impossible for users of Google products and services to prevent Google from exploiting information about their location for financial gain.”

Physical location is just one of many data points used to target advertising, at a particular time and place, to consumers who are most likely to react to it, often by making a purchase. The Google advertising ID “is a unique, user-resettable ID for advertising, provided by Google Play services. It gives users better controls and provides developers with a simple, standard system to continue to monetize their apps,” Google said today, telling developers about the coming Android 12 change.

An app that requests the ad ID from an Android 12 user who has opted out of personalized ads will instead get a string of zeros back from Google rather than the long alpha-numeric code that is the device’s unique advertising ID, a change Google believes will bolster security and better align with the expectations of users who opt out of personalized advertising. Google said the blocking of the ad ID has been in its development plan for some time and that the change is a technical evolution of the personalized-ads opt-out option in the current Android 11 OS.

The new claims unsealed in the Arizona case were the result of recent rulings by a court-appointed special master, retired judge Barry C. Schneider.

“We had hours of argument in front of the special master who made line by line decisions about what to keep redacted or not, and what got released was the material that the master said should not be redacted,” Ryan Anderson, a spokesman for Brnovich, told MLex today.

Google’s “deception” of Android users over location data, the attorney general said in other newly public language, also happened through the Google ads personalization setting highlighted in today’s announcement by the company.

“Google serves personalized ads to its users based in part on information Google has about a user’s location. Google purports, however, to allow users to opt out of ads personalization by turning off a setting of that name (‘GAP’),” Brnovich said. “But contrary to what a reasonable user would expect, turning ads personalization off does not stop Google from presenting ads based on a user’s location. Rather, Google will instead simply present ads based on more general location information.”

Google didn't immediately respond to a request for comment on the newly unredacted allegations.

Google is already under pressure in the Arizona case to disclose the financial value, in terms of advertising revenue, of the location data it collects through Android devices. In Australia, meanwhile, a judge with the country’s Federal Court will decide later this year how much Google should pay for misleading Android users over the location data it collected and kept.

Aggressive privacy moves by powerful platform owners like Google and Apple also can boomerang into antitrust problems. Google, for example, is being scrutinized by the UK’s Competition and Markets Authority over its decision to phase-out third-party cookies in its Chrome browser, the most-used desktop browser.

Even as it launched its iOS privacy changes in April, Apple was hit with an antitrust complaint by a group of nine media and advertising associations at Germany’s competition authority in April. Apple has not yet released data on what share of iOS users, when shown a prompt that requires them to choose between being tracked and blocking third party tracking, have chosen the more private setting.

But Google has told app developers that users clearly want more control over their location data. As it has made app location controls more “fine-grained” in more recent versions of Android, allowing users to deny location data to individual apps when they aren’t in use or all the time, Google has found users are choosing to share less location data about 80 percent of the time for apps running visibly in the foreground of the device.

“We’re seeing users respond positively to these controls and are choosing them more often,” Google told developers in the May 18 blog.