PRESS RELEASE - 30.06.2022

• Google is using deceptive design, unclear language and misleading choices when consumers sign up to a Google account to encourage more extensive and invasive data processing.
• Contrary to its claims, the tech giant is thwarting consumers who want to better protect their privacy.
• Consumer groups are taking action on suspected breaches of the GDPR.

Tech giant Google is unfairly steering consumers towards its surveillance system when they sign up to a Google account, instead of giving them privacy by design and by default as required by the General Data Protection Regulation (GDPR).

As a result, ten consumer groups, under the coordination of the European Consumer Organisation (BEUC), are taking action to ensure that Google complies with the law.¹

Ursula Pachl, Deputy Director General of the European Consumer Organisation (BEUC), said:
“Contrary to what Google claims about protecting consumers’ privacy, tens of millions of Europeans have been placed on a fast track to surveillance when they signed up to a Google account. It takes one simple step to let Google monitor and exploit everything you do. If you want to benefit from privacy-friendly settings, you must navigate through a longer process and a mix of unclear and misleading options. In short, when you create a Google account, you are subjected to surveillance by design and by default. Instead, privacy protection should be the default and easiest choice for consumers.”

A consumer can choose to create a Google account voluntarily or be obliged to create one when they use certain Google products and services. For example, they must create an account when they buy a smartphone that uses Google’s Android system, which almost 7 in 10 phones worldwide (69%) depend on,²  if they want to download apps from the Google Play store.

Signup is the critical point at which Google makes users indicate their ‘choices’ about how their Google account will operate. With only one step (“Express personalisation”), the consumer activates all the account settings that feed Google’s surveillance activities. Google does not provide consumers with the option to turn all settings ‘off’ in one click.

If consumers want to activate the more privacy-friendly options, this requires “Manual personalisation”: five steps with ten clicks and grappling with information that is unclear, incomplete, and misleading. Regardless of the path the consumer chooses, Google’s data processing is un-transparent and unfair, with consumers’ personal data being used for purposes which are vague and far reaching.

It is now crucial that the relevant authorities start investigations and take swift action. Many of these problems are not entirely new as BEUC and its members launched a series of coordinated complaints in November 2018 about Google’s processing of consumers’ location data. Unfortunately, these complaints remain unresolved.

Ursula Pachl added:
“Google is a repeat offender. It is more than three years since we filed complaints against Google’s location-tracking practices and the Irish Data Protection Commissioner in charge has still not issued a decision on the case. Meanwhile Google’s practices have not changed in essence. The tech giant still carries out continuous tracking and profiling of consumers and its practices set the tone for the rest of the market. We need swift action from the authorities because having one of the biggest players ignoring the GDPR is unacceptable. This case is of strategic importance for which cooperation among data protection authorities across the EU must be prioritised and supported by the European Data Protection Board.”

Further information
As the red thread that connects everything Google users do, the Google account signup process has important repercussions for consumers’ privacy. It unifies and personalises the experience of Google users across all the company’s services. The account also helps set Google’s surveillance as the bedrock for the digital market, as many companies depend on Google for their day-to-day operations and services.

The language Google use at every step of the registration process is unclear, incomplete, and misleading. Important information, particularly about what the data processing that three main account settings entail (Ad personalization, YouTube and web & app activity), or about the options that the user can choose from, is not presented up front, is vague or is missing. Google also frames the more privacy-friendly options as missing out on advantages. This prevents the consumer from taking an informed decision when they make their choices and results in unfair, non-transparent and unlawful processing of their personal data.

Google is one of the world’s most profitable companies, with tens of millions of European consumers relying on its products and services on a daily basis. It is a colossus in the world of surveillance capitalism – 81% of its revenue comes from its advertising operations,³  which in turn depend on the data it hoovers up on people to personalise adverts for them. From advertising, the company is forecast to earn €221bn ($244bn) in 2022, which is almost double the amount its closest competitor, Facebook, is expected to make from digital advertising (€123.6bn, or $136bn).⁴

ENDS

Notes to editors

• A frequently asked questions document is available here.
• A summary of the action is available here.
• A copy of the model complaint is available here.
• You can find all our action’s documentation and follow the complaint’s progress here.

¹ dTest (Czech Republic), Forbrukerrådet (Norway), EKPIZO and KEPKA (Greece), UFC-Que Choisir (France) and ZPS (Slovenia) have filed GDPR complaints with their data protection authorities. Verbraucherzentrale Bundesverband – vzbv (Germany) has sent a warning letter to Google, a first step before potentially filing a civil lawsuit. Consumentenbond (Netherlands), Forbrugerrådet Tænk (Denmark) and Sveriges Konsumenter (Sweden) have written to their national authorities to alert them about Google’s practices. US consumer groups from the Transatlantic Consumer Dialogue (TACD) network are also sending a letter today to the Federal Trade Commission (FTC) denouncing Google’s practices.
² Statista.com, ‘Mobile operating systems' market share worldwide from January 2012 to January 2022’ (accessed 9 June 2022).
³ Statista.com, ‘Biggest revenue source of leading online and tech companies in most recently reported quarter ending March 2022’ (May 2022, accessed 10 June 2022).
⁴  Statista.com, ‘Digital advertising revenues of major internet companies worldwide in 2022 and 2026’ (May 2022, accessed 10 June 2022).