Google breached Australian consumer law by misleading privacy-conscious Australians into thinking it wasn't collecting personal data about their location, the Federal Court has found.
Friday's ruling has been described as a world first by the chairman of the Australian Competition and Consumer Commission, which sued the search and advertising giant.
"We think today's result sends a very clear message to the digital platforms that they have to be upfront with consumers about what is actually happening with their data, how it is being used and how consumers can protect their data," ACCC chair Rod Sims told reporters.
"These are fundamental issues for Australians going forward in this future digital economy."
Google says it has improved its privacy controls and there was no allegation it had breached the Australian privacy act.
"The court rejected many of the ACCC's broad claims," a spokesman said.
"We disagree with the remaining findings and are currently reviewing our options, including a possible appeal."
Google had argued it made it clear to users setting up a Google account in 2017 and 2018 that the company would still collect and use location data when Location History was "off", Web & App Activity was "on" and one of its apps was used.
Users asked to agree or disagree to "Privacy and Terms" about the use and storage of their data were offered a third option for "More Options".
That option allowed them to toggle on and off location history, web and app activity and other data collection.
But Federal Court Justice Thomas Thawley said the warnings shown with the toggles weren't as clear as Google would have it.
Some users would have reached the correct conclusion but others, even after going beyond default warnings, would have concluded the tech giant wasn't using their location data when location history was off.
"True it is that, after a careful examination of the content of both screens, the conclusions Google urged might be reached," the judge said.
"That is not the issue. The screens were read by users setting up the device.
"Such users, even ones with heightened privacy concerns, would not re-read screens with the kind of careful attention that has been necessary in considering the various arguments put by the parties."
Some reasonable users with location history off would have realised their location data was being obtained while operating Google Maps.
But they wouldn't have realised Google was also storing that data and using it later, the judge said.
The tech giant was also found in breach of consumer laws concerning conduct liable to mislead the public and making misleading representations about a service's performance characteristics.
Google faces a maximum fine of $1.1 million per breach.
But what constituted a breach and how many breaches occurred is yet to be determined.
"(The fine) can be large, it certainly will be in the many millions, but quite how big it is something we have to think about and convince the court of," Mr Sims said.
The court last year heard senior Google employees held an urgent meeting in 2018 - dubbed internally as the "Oh S***" meeting - after Associated Press published an article explaining Google's collection of location data through the web and app activity option.
The article also led rank-and-file employees to raise concerns they'd not been aware of the connection, and a 500-per-cent increase in users disabling both location history and web and app activity.
But Justice Thawley placed no reliance on the evidence, saying it wasn't clear the settings referenced in the article and the internal documents were the same as those in the Australian case.
Australian Associated Press