Missouri’s Google Probe May Signal More Aggressive Enforcement

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Christopher Brown

Missouri may be signaling a more aggressive privacy enforcement posture with its recent announcement of a broad investigation into how Alphabet Inc.'s Google uses consumer data.

Missouri Attorney General Josh Hawley (R) Nov. 13 announced that the state is investigating Google and released the civil investigative demand letter he sent to the Mountain View, Calif.-based tech giant. Missouri doesn’t have a reputation among practitioners as an aggressive enforcer of privacy and data-security laws, but Hawley’s announcement could signal a changed climate, Alfred J. Saikali, chairman of the data security and privacy practice at Shook, Hardy & Bacon LLP in Miami, Fla., told Bloomberg Law.

Among the issues being investigated is how Google collects and uses personal data, and the privacy promises it makes to consumers. The demand letter seeks documents and answers to questions on the company’s privacy policies, among other things, and gives Google until Jan. 22, 2018, to comply.

“If I’m a company with business in Missouri, I’m double checking my consumer-facing privacy promises today to make sure we’re complying with them,” Saikali said. Hawley’s investigation “does suggest that Missouri has become a place to watch where enforcement could become more active.”

State Enforcement

A spokeswoman for Hawley told Bloomberg Law that no other state has conducted a similar investigation into Google’s practices.

Other states could join Missouri in the investigation.

“It’s already a very serious matter for Google when one state attorney general starts an investigation, but other states could sign on, and there may even be talks going on behind the scenes about that right now,” Saikali said.

The multi-state task force set up by the National Association of Attorneys General is a mechanism by which a single-state investigation can easily be transformed into a formidable multi-state juggernaut, he said. “The task force meets regularly by phone, and they talk about matters they’re working on. It would not be safe to assume that this will stay a single-state matter.”

The Federal Trade Commission has taken enforcement actions against Google, but some say it hasn’t provided enough oversight.

The FTC has been a weak enforcer of privacy standards against Google, which has opened the door to enforcement by state attorneys general, Marc Rotenberg, the Electronic Privacy Information Center’s executive director, told Bloomberg Law.

Missouri’s demand letter references privacy enforcement agreements between the FTC and Google, and seeks information regarding the company’s compliance with the terms of those agreements.

Missouri Investigation

Hawley’s investigation will also explore allegations that Google misappropriates online content from competitors’ websites, and manipulates search results to favor its own websites over those of competitors.

But a statement from Hawley’s office said that Google’s collection and use of personal information is a central concern.

“When a company has access to as much consumer information as Google does, it’s my duty to ensure they are using it appropriately,” Hawley said in the Nov. 13 statement. “I will not let Missouri consumers and businesses be exploited by industry giants.”

Google’s trove of information includes online users’ location, device information, cookie data, online queries, and website history, and even extends to 70 percent of all credit-card transactions in the U.S., the statement said.

Google didn’t immediately respond to Bloomberg Law’s email request for comment.

To contact the reporter on this story: Christopher Brown in St. Louis at ChrisBrown@bna.com

To contact the editor responsible for this story: Donald Aplin at daplin@bna.com

For More Information

Missouri's civil investigative demand letter to Google is available at http://src.bna.com/udj.

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.

Request Bloomberg Law: Privacy & Data Security