Fast track to surveillance

Tech giant Google unfairly steers consumers towards its surveillance system when they sign up to a Google account, instead of giving them privacy by design and by default as required by the General Data Protection Regulation (GDPR).

As a result, consumer groups under BEUC’s coordination have taken action to ensure that Google complies with the law, including by filing complaints with national data protection authorities.

The Google account is the red thread which connects how users’ data is used across all Google services. Consumers can choose to create a Google account voluntarily or be obliged to create one when they use certain Google products and services. For example, they must create an account when they buy a smartphone that uses Google’s Android system, which almost 7 in 10 phones worldwide (69%)¹ depend on, if they want to download apps from the Google Play store.

During this signup process, which involves consumers taking important decisions about how Google will process their personal data, the tech giant uses a combination of deceptive design, unclear language, misleading choices and missing information:

With only one step (“express personalisation”), the consumer activates all the account settings that feed Google’s surveillance activities. Google does not provide consumers with the option to turn all settings ‘off’ in one step.
If consumers want to try to protect their privacy, it requires “manual personalisation”: five steps with ten clicks and grappling with information that is unclear, incomplete, and misleading.
Regardless of the path the consumer chooses, Google’s data processing is un-transparent and unfair, with consumers’ personal data being used for purposes which are vague and far-reaching. Google also frames the more privacy-friendly options as ones where consumers will miss out on advantages if they don’t consent to Google’s extensive tracking and profiling practices.

Contrary to Google’s claim that users are in control of the data that the company collects and how it is used, the account signup process is engineered to serve the company’s interests and runs against EU data protection law.

¹ Statista.com, ‘Mobile operating systems' market share worldwide from January 2012 to January 2022’ (accessed 9 June 2022).

Data protection authorities must investigate Google’s practices and ensure Google’s processing of account holders’ personal data fully respects EU data protection law. For a start, choosing privacy protection must be the default and easiest choice when setting up a Google account.

At least tens of millions, if not hundreds of millions, of Europeans use Google services and many of these consumers probably also have a Google account. Nearly everybody is in one way or another exposed to Google’s unfair practices. Data protection and privacy are fundamental rights in the EU. Forcing Google to fully respect these rights and act lawfully would be a major and long overdue step in fighting the surveillance economy.

We expect to see a procedure launched under the GDPR’s Cooperation mechanism (Article 60 GDPR). We hope that this mechanism will work better than for previous complaints we launched in 2018 regarding Google’s location tracking practices. We consider this to be a case of strategic importance for which cooperation between data protection authorities should be prioritised and supported by the European Data Protection Board, in line with the recent commitments announced in the ‘Vienna declaration.’

Press release | European consumer groups take action against Google for pushing users towards its surveillance system | 30.06.2022

Summary | Fast Track To Surveillance - How Google makes privacy the hard choice | 29.06.2023

FAQ | Fast Track To Surveillance | 29.06.2023

Model complaint Google 2022 | 29.06.2023

Letters: European consumer groups take action against Google for breaches of GDPR:

to Andrea Jelinek, European Data Protection Board | 30.06.2023
to Wojciech Wiewiórowski, EDPS | 30.06.2023
to Commissioner Didier Reynders | 30.06.2023

Click on the images to download the pictures.

Google’s ‘deceptive’ account sign-up process targeted with GDPR complaints
TechCrunch (30 June 2022)
“BEUC argues the design choices the tech giant deploys around account creation make it far easier for users to agree to Google’s processing of their information to target them with “personalized” ads than to deny consent to its profiling of them for behavioral advertising.”

Google targeted in fresh EU consumer groups' privacy complaints
Reuters (30 June 2022)
"The language Google uses at every step of the registration process is unclear, incomplete, and misleading, BEUC said.”

European consumer group condemns Google’s ‘surveillance capitalism’
Irish Times (30 June 2022)
“It takes one simple step to let Google monitor and exploit everything you do, said the BEUC deputy director general Ursula Pachl.”

Google’s ‘Fast-Track to Surveillance’ Sparks European Backlash
Bloomberg (30 June 2022)
“Google came under attack from European consumer groups who accuse the US giant of putting users on “a fast-track to surveillance” when they sign up to an account.”

Google sign-up 'fast track to surveillance', consumer groups say
BBC (30 June 2022)
… Google is facing action from a coalition of ten European consumer organisations over the company's account sign-up process…

EU consumer groups accuse Google of privacy violations
Deutsche Welle (30 June 2022)
…The core of the issue, according to BEUC, is that users are pushed into creating a Google account to access the Alphabet Inc.-owned company's range of services…

Données personnelles: plaintes contre Google de consommateurs européens
Le Figaro (30 June 2024)
"…one step is enough to allow Google to place the user under surveillance and exploit everything you do.”