On Monday, January 24, 2022, Washington D.C. Attorney General, Karl A. Racine, filed suit against Google alleging the company violated the District’s Consumer Protection Procedures Act (“CPPA”) by (1) employing unfair trade practices and (2) misrepresenting and omitting information in order to obtain lucrative consumer geolocation tracking data. The Attorneys General in Indiana, Texas, and Washington are also filing state court lawsuits against Google, alleging that Google violated their own state’s consumer protection laws for the same alleged deceptive and unfair practices as those alleged by Attorney General Racine.

The complaint alleges that, since at least 2014, Google has deceived consumers regarding their ability to protect their privacy by using Google’s account settings. The complaint provides several examples of allegedly unlawful behavior, including that - even when consumers explicitly turned off Location History in their settings - Google still collected location data unless users also turned off a setting called “Web & App Activity,” which the company didn’t mention or draw consumer’s attention to until approximately 2018.

As a result, the suit seeks the following redress from the court:

• Permanently enjoining Google from violating the CPPA;
• Order requiring the disgorgement of monies, property, or data (including any algorithms developed using such data) from Google based on its unlawful conduct and/or ordering Google to pay damages and restitution;
• Award civil penalties in an amount to be proven at trial and as authorized per violation of the CPPA; and
• Award Attorney Fees.

What Does This Mean for Business?

1. While it is important to prepare for the California, Colorado, and Virginia consumer data privacy laws coming into effect in 2023, companies should not lose sight of the importance of honest and transparent practices in the course of data collection, the lack of which can become the basis of a state consumer protection lawsuit. Consumer protection laws exist, in some version, in all 50 states.
2. Unfair trade practice rules – at the state and federal level – are still important and violating those rules can have significant consequences, including the possibility of a court enjoining use of data or related algorithms and an assortment of fines and damages.
3. Companies should regularly ensure that their policies match their practices as closely as possible.
4. Following the spirit of recent state consumer data protection laws, make sure that the consumer has been fully informed of what data is being collected and how to turn off the collection of data that is not essential to a transaction or the business relation with the consumer.