Google Ordered to Disclose Data Processing Services to Users: Court Upholds Consumer Advocates' Claim
Tech giant faces data protection setback: Court rules against Google in privacy dispute - Data Protection Law Court Ruling Favoring Google's Opponent
Google is now required to inform its new users about the specific 70+ services that process their data during the registration process. After hearing a complaint from the Federation of German Consumer Organizations (vzbv), the civil chamber of the Berlin Regional Court decided in favor of stricter data privacy rules.
Consumer advocates had argued that neither Google's "Express Personalization" nor "Manual Personalization" options complied with the requirements of the European General Data Protection Regulation (GDPR).
The court's ruling against Google Ireland Ltd was issued on March 25, 2025, but it wasn't made public until Friday (Case No. 15 O 472/22). Despite the decision, Google has filed an appeal against it, making the outcome uncertain.
Google processes data for a variety of purposes:
The vzbv expressed concerns that users are not informed about the purpose of their data collection during the registration process, leaving them unable to make informed decisions. The court agreed, stating that Google's current approach results in a lack of transparency regarding the individual services, apps, websites, or partners for which the user's data will be used.
In a statement, Google argued that the ruling pertains to an outdated account creation process that has since been updated. Google asserts that their continued commitment remains in enabling users to control their data usage with clear choices based on extensive research, testing, and guidelines from European data protection authorities.
During the proceedings, Google argued that listing every service would lead to excessive text and potentially harm transparency. However, the court overruled this argument, stating that information about the scope of consent is essential and legally mandated.
The Berlin Regional Court faulted Google's approach, criticizing that users could only accept all data uses or abandon the process during "Express Personalization." A more granular rejection option was not available. Even during "Manual Personalization," users could not opt-out of using the location Germany.
Recent Data Privacy Developments:
- Texas Settlement: Google agreed to pay $1.4 billion to Texas over accusations of collecting user data without consent. These allegations include tracking geolocation, incognito searches, and biometric data through products like Google Photos and Google Assistant[3].
- General Data Protection Requirements: In Europe, companies such as Google must comply with strict data protection practices under the GDPR. This includes monitoring the deletion or return of personal data held by processors upon termination of processing agreements[2].
- Antitrust Rulings: Google faces antitrust challenges, including a recent U.S. ruling for monopolistic practices in the digital advertising market. While this hasn't directly updated data privacy requirements, potential changes to Google's business structure may impact their data handling practices[4][5].
For the most current information regarding the Berlin Regional Court's ruling, it's best to consult legal documents or news releases directly from the court or affected parties.
- The court's decision mandates Google to disclose details about the over 70 services that process user data during the registration process, aligning with the strict data privacy rules.
- In the light of the ruling, concerns have been raised about the transparency of data collection during Google's registration process, particularly regarding the purpose of data usage by individual services.
- As a part of recent data privacy developments, Google has been involved in a settlement with Texas over accusations of collecting user data without consent, a practice that is contrary to the GDPR's strict data protection requirements.
