Google has agreed to pay $135 million to settle a class-action lawsuit. This focused on the transfer of location data on Android devices between 2017 and 2026, even when that feature was disabled. For users, the upside is a commitment to greater transparency and reinforced informed consent. The downside is the data exposure that has already occurred and the persistent vulnerability in older devices without updates.
The technical problem of consent and fragmentation 🤔
The technical core of the case revolves around the permissions architecture and Google Play services. Although the user disabled location in system settings, some services and applications could continue to collect data through other methods, such as IP address or sensor data. The agreed-upon solution involves redesigning consent flows to be more explicit. However, the problem of Android fragmentation persists, as many devices with older versions do not receive security patches, leaving them exposed.
Your Android tracks you, but doesn't update you 😅
It's curious how the system can remember where you were five years ago with pinpoint accuracy, but is incapable of remembering that your phone needs a critical security update. While Google adjusts its consent screens so we accept them more knowingly, millions of devices navigate with security holes the size of a truck. In the end, your future privacy will be better protected, but your 2018 phone remains an open book for anyone with a bit of skill. A full-blown technological irony.