Google knows where you've been — and with a warrant, the police can know, too. A New York Times investigation detailing how law enforcement seeks location records from the tech titan shows that the country's lack of privacy laws affects not only what companies know about us, but also what the government does, too.
Google compiles information on consumers' whereabouts in various ways. Its "Location History" service is one of the most comprehensive. The feature is enabled when users respond to prompts in the company's maps and photos apps, among others, but once it is switched on Google can gather data on signed-in devices even when those apps are not open. Though it's possible to toggle off the tracking, it is not easy — and the manner of collection means consumers are likely unaware of the extent to which Google is following them, and why.
Large-scale location monitoring is useful to Google because it allows the company to target advertisements based on where consumers regularly travel, as well as to assess the ads' effectiveness. It is useful to law enforcement because it can allow investigators to view the movement of all devices within a specific area over a specific period of time to track down suspects or witnesses in cases that otherwise might go cold.
Google lets officials into its Sensorvault database only with a warrant. At first, the company attaches anonymous ID numbers to devices; names and email addresses enter the equation later, once detectives have picked out the devices they deem relevant to the case. But jurisdictions may differ on what constitutes probable cause for both types of request, each of which will likely sweep in innocent bystanders as well as reasonable suspects. It also appears that some judges are approving these escalating levels of access in a single warrant, trusting investigators to limit themselves when they ask for more extensive data.
The Google case raises two questions: what data a company should be able to collect, and to what extent the government should be able to access that data once it is collected. But these are impossible to separate. Courts have yet to determine what constitutional protections this type of location data deserves, and legislators haven't stepped in. So it has been up to Google to devise a system for complying with requests — just as, in the absence of federal regulation on data privacy, it has largely been up to Google to determine the bounds of collection that let it create a such a vast repository of information in the first place.
The judiciary will have to continue playing catch-up to increasingly intrusive methods of surveillance unless legislators take the lead on limiting companies' ability to surveil. The assumption today is that Google and its peers will almost always know where everyday Americans have been, even when those Americans are not aware of it. Congress needs to ensure that customers get more of a say in the matter.
This editorial first appeared in The Washington Post.