Loading story…
An Associated Press investigation found that Google stored time-stamped location information from Android and iPhone users after they paused Location History. Princeton researchers verified that activity in Google Maps, Android weather updates, and certain Google searches could create location records through the separately controlled, default-enabled Web & App Activity setting. Google said it offered distinct controls, but critics argued that users reasonably expected disabling Location History to stop account-level location tracking.
The practices prompted enforcement actions, including an $85 million Arizona settlement and a $9.5 million District of Columbia settlement over allegations of deceptive location-tracking interfaces and dark patterns. Google’s current documentation distinguishes Timeline—formerly Location History—from Web & App Activity and Search Services History: disabling Timeline does not stop other settings from retaining location-related information derived from a device’s approximate area or IP address.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Google allowed advertisers to measure whether online advertising led users to visit physical stores using location-history data.
District of Columbia Attorney General Karl Racine announced that Google must pay $9.5 million over alleged dark patterns and deceptive location-tracking practices.
Arizona Attorney General Mark Brnovich announced an $85 million settlement with Google concerning the state's allegations over its practices.
The Associated Press found that Google services continued storing location markers from Android and iPhone users after Location History was paused, and Princeton researchers confirmed the behavior. Maps use, Android weather updates, and Google searches could create records through the separately enabled Web & App Activity setting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
oag.dc.gov
Open sourceazag.gov
Open sourceapnews.com
Open sourceapnews.com
Open sourcerise.cs.berkeley.edu
Open sourcesupport.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ireland’s Data Protection Commission (DPC) has imposed a **€403 million** ($463 million) fine on Google for GDPR violations in its processing and retention of users’ location data. The investigation examined the company’s Web & App Activity, Location History, and Android Location Accuracy features between May 25, 2018, and February 4, 2020, finding shortcomings involving lawfulness, fairness, transparency, accountability, and retention practices. The DPC ordered Google to make its location-data processing compliant within six months. Google said the ruling concerns historical practices that it has since changed, citing stronger user controls, automatic deletion settings, and device-based storage of Google Maps Timeline data.
Sep 24, 2026
Google agreed to a preliminary **$135 million** class action settlement in *Taylor v. Google LLC* over allegations that Android devices transmitted cellular data to Google without users’ consent, including while phones were idle and apps were closed. The proposed settlement covers roughly **100 million U.S. Android users** who used an Android device with a cellular data plan from **Nov. 12, 2017** until final approval, though Google denied wrongdoing and said it settled to avoid further litigation. Eligible users can file claims for payments that may reach **up to $100**, with final amounts depending on participation levels and deductions for fees and costs. As part of the agreement, Google will revise Google Play terms to better disclose passive data transfers, obtain user consent during device setup, and stop collecting data entirely when the **"allow background data usage"** setting is turned off. A final approval hearing is scheduled for **June 23**, and payments would be issued only after court approval and any appeals are resolved.
Jun 29, 2026
The Electronic Frontier Foundation warned that some Android apps have been quietly transmitting users’ precise location data to third-party advertising SDKs after users granted location access to the app itself. EFF said many developers may not realize embedded SDKs inherit the app’s permissions by default, allowing monetization components to collect and send sensitive location data unless developers explicitly disable that behavior. The organization said it identified several affected Android apps with a combined **about 60 million downloads**, while cautioning that the exposed SDKs represent only a small slice of a broader ad-tech ecosystem that reaches billions of users. The data can flow to advertisers and data brokers and may be resold onward, including to governments or intelligence agencies, increasing surveillance, privacy, and breach risks; EFF argued that app-level consent does not amount to meaningful consent for third-party SDK collection and urged developers to turn off unnecessary location sharing.
Aug 7, 2026