Google is being investigated by an Australian regulator for allegedly spying on Android phone users and having them pay for the privilege, according to a report by The Guardian.
The watchdog, the Australian Competition and Consumer Commission (ACCC), is looking into claims by tech company Oracle that Android devices send to Google information on searches, what is being viewed, and location data, even if location services are turned off. Oracle also claims that the country’s millions of Android users unwittingly pay their phone providers to send the data to Google. Meanwhile, Google told Quartz that it has permission from users for all of this and that customers don’t have to foot the bill.
Oracle went to the ACCC as part of a broader inquiry into digital platforms that is looking at the impact search engines like Google and social networks such as Facebook are having on publishers, advertisers, and consumers in Australia. The inquiry launched before it was revealed that Facebook allowed Cambridge Analytica to harvest the data of 50 million Facebook users without their permission, and ignited a global debate over data privacy. Facebook’s data practices are under investigation elsewhere in the world.
In Australia, Oracle revealed that Google can track Android devices without location services turned on, Sim cards, or apps installed, through mapped IP addresses, wifi access points, and mobile towers that show where devices are connecting or attempting connect. Android phones also reportedly have barometric devices that can use air pressure to locate a person within a building.
Google said in a statement that location history is “entirely opt-in” and is used to power Google products and services, like delivering traffic predictions for your commute or locating a missing phone. It added that the data sent and received from Android devices can be sent over wifi or cellular network, and that the types and quantity of data collected depends on their settings and the products or services they use.
It explains some of this in its privacy policy. ”When you use Google services, we may collect and process information about your actual location… including IP address, GPS, and other sensors that may, for example, provide Google with information on nearby devices, wifi access points, and cell towers,” it says. But the policy does not spell out what Google collects on Android users, specifically. (The Android device privacy guide does have details on managing the data collected.)
A new policy, which kicks in on May 25 in response to the European Union’s General Data Protection Regulation, adds that Android devices send data back to Google:
If you’re using an Android device with Google apps, your device periodically contacts Google servers to provide information about your device and connection to our services. This information includes things like your device type, carrier name, crash reports, and which apps you’ve installed.
The ACCC’s press office was closed on Monday morning EST and could not be reached by the time of publication. Oracle also did not immediately return Quartz’s requests for comment.