Google has agreed to pay a historic settlement of $391.5 million to end a privacy investigation brought by 40 state attorneys general regarding the search giant’s allegedly misleading location-tracking features. The states argued that, since at least 2014, Google violated consumer protection laws by misleading consumers into thinking they had turned off location-tracking in their Google account settings, when, in reality, Google continued to collect such location information and sell it to advertisers.

The payout is the largest multistate privacy settlement in history.

In addition to the fine, Google agreed to a number of changes designed to make its location-tracking practices clearer. In a press release, Google said that the allegations concerned “outdated product policies that [were] changed years ago,” but agreed nevertheless to the following improvements to its privacy and transparency controls, to go into effect in 2023:

• A revamped “user information hub” to better explain how location data is used by Google’s products, along with a comprehensive information hub where users can make choices regarding key location-tracking settings.
• Simplified deletion of location data. Google will introduce new controls that allow users to easily turn off Location History and Web & App Activity settings and delete their location data in a single, streamlined flow.
• Updated account set-up notices. New Google users will receive a more detailed explanation of what “Web & App Activity” is, what information it includes, and how it affects their Google experience.

The multi-state investigation started in 2018, in response to an Associated Press article that claimed that Google continued to record its users’ movements even when they asked it not to. It reflects a growing – and bipartisan – movement to protect consumers’ online privacy in the face of internet companies’ sophisticated pursuit of data regarding consumers’ online and real-world lives – primarily to sell such data to advertisers. To date, five states – California, Colorado, Connecticut, Utah, and Virginia – have passed comprehensive consumer privacy legislation. A federal comprehensive privacy bill was introduced earlier this year, but has yet to come to a vote and is still being negotiated.

In addition to this settlement, Google recently agreed to an $85 million settlement with Arizona based on similar allegations. Texas, Indiana, Washington State, and the District of Columbia also sued Google in January based on its location-tracking practices.

The attorneys general of Oregon and Nebraska led the settlement negotiations, assisted by Arkansas, Florida, Illinois, Louisiana, New Jersey, North Carolina, Pennsylvania, and Tennessee. The final settlement was also joined by Alabama, Alaska, Colorado, Connecticut, Delaware, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Minnesota, Mississippi, Missouri, Nevada, New Mexico, New York, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Utah, Vermont, Virginia, and Wisconsin.