In plain words
Think of it like this: when you tell a friend you do not want them to follow you, you expect them to stop. But in Google's case, even when users told Google to stop tracking their location by turning off Location History, Google still collected some of that data.¹
What's broken
What's broken is that Google's system did not fully respect users' choices about location tracking. An attacker is not directly involved in this issue, but rather it's about Google's handling of user data. The company has been fined €403 million for this.
How it actually works
Here's how it actually works: when you use Google services, your device sends location information back to Google. Normally, you can control this by turning on or off Location History. However, due to the way Google's systems are set up, even with Location History off, some location data could still be collected through other means, like when you search for something or use certain Google apps. This is because those services can still use your location to provide you with more relevant results or information. The issue is that users were not clearly informed about this, and thus could not make fully informed decisions about their privacy.
Proof of concept
It's not clear from the source if there's a public proof-of-concept for this specific issue. A proof-of-concept would demonstrate that the flaw is real and can be exploited, but in this case, the focus is on Google's data handling practices rather than a specific vulnerability that can be exploited by attackers.
Is it real
This issue is not about a vulnerability being actively exploited in the wild by attackers. Instead, it's about Google's internal practices and how they handle user data. The limiting factor here is more about transparency and user control over their data rather than a feature being off by default.
What to do
To address this, Google needs to improve how it informs users about data collection and ensure that user choices are respected across all its services. Users can also take steps by regularly reviewing their privacy settings and being cautious about which services they allow to access their location data.
Terms
- ¹ location data
- , A type of data that shows where a device or person has been, often used by apps and services to provide more personalized experiences.