I’m Ryan Nakashima, Technology Writer for The Associated Press, and I’ve been breaking news about how Google tracks your location on Android devices and iPhones -- sometimes even when you tell it not to. Ask me anything.

What does google do with the information? Sell it to advertisers? Government?

Like other big tech companies, it will say it doesn’t technically sell your data, but it does make it available to advertisers that use its ad-buying tools. Google therefore profits from the data.

We don’t know all the details of how it works. But think of it this way: advertisers are buying a fraction of your attention based on interests Google thinks you have. And that is all based on what you search for, where you might travel and any other bit of data that Google collects.

Do discoveries like this ever surprise you any more or are you cynical like the rest of us?

Edit: spelling

We know to look for these kinds of things now, and I think it’s important to be vigilant to let the companies know we’re watching. It’s better than throwing your hands up and just saying ‘I have no privacy anymore.’ That’d be like living in a place with no curtains.

Is there anything thing we can do to retain privacy at this point? If companies are tracking us without our knowledge, what else are they doing? Would it require everyone to just stop using google all together?

As an exercise in what you can live with, I would recommend trying out another browser and another search engine. Or try using Google without logging in. Turn your “Web & App Activity” and “Location History” settings off and see if there is a noticeable difference in your experience.

I think in order to really buy the argument that sharing more data improves their services, you should really be convinced of that yourself.

One distinction I’d like to make is the difference between sharing anonymized data that generally improves services. For instance, without location tracking, Google Maps would not be able to give you live and historical traffic information.

But there’s a big difference between that and associating your coordinates with your personal Google account.

I have a boring life. Should I care about this issue? In my fifties and disabled. Not likely to reach my 70s.

If you’re here, you clearly do care. And that’s cool.

Are there any leads in your research that point to other big tech companies being duplicitous in their privacy practices? Do you think this will point to a shift in ease of acceptance of trading user data in exchange for "free" apps?

There is a growing group of user experience designers that look for all the ways that technology companies nudge you to do things that might not necessarily is in your best interest but is clearly in theirs. I highly recommend reading the book, “Nudge” by Cass Sunstein and and Richard Thaler about how people are nudged all the time. Applied to big tech companies including Facebook, that means you’re being nudged to share more.

Also, look up the keywords “dark patterns” on Google (yes, Google) for some practices that are not exactly forthright.

We are just scratching the surface.

​And yes, I think people are definitely rethinking the “easy” acceptance with this tradeoff between free apps and the privacy and attention we give up.

​

How ubiquitous do you think misleading interfaces and so-called "dark patterns," like the one you discovered, are? Is there any way we can discover them for ourselves like you did?

Check this out for starters: https://darkpatterns.org/hall-of-shame. Think about taking screenshots and sharing them. It’ll bring so-called “dark patterns” into the light.

how much are the employees of google judging me, between my search history and near-constant trips to taco bell?

The danger is that humans can indeed see what’s stored with your account, whether that’s real police or taste police.

​

What kind of smartphone do you use yourself?

I use a company-provided iPhone 8 for most of my smartphone activity. For my reporting on this story, I also personally used a Pixel 2 that had been loaned to us in the past by Google following the product release a while back. Other AP reporters and independent academic researchers who confirmed our findings used a variety of Android and iOS phones.

I’ve been always wondering how can all this info gathering affect average joe in a bad way.

Feel like they knowing that I, for example, like blue hoodies and my cofee without milk, can’t in any way negatively affect my life.

I feel like if they were just more honest with what they collect and how there wouldn’t be any issues. They provide so much services free of monetary charge, even if all my data was super secure idk of world where I have to pay 59£ a month for it would be a better option. What are the alternatives? But again. I don’t know much about this topic, maybe there is more to it and I should read up on it more.

I think a lot of people feel the way you do. And that’s fine. I think the stories we wrote highlight issues that concern people who want to have a clear choice about what they do and don’t share.

Have you ever for any reason thought that investigating into that subject is dangerous? i would certainly hope not but curious about your take on it.

I doubt there’s any real physical danger. But in terms of privacy, I think the more you look into it, the more you begin to wonder what exactly is being stored, how it’s used and who has access. For instance, I’m covering Google and the company certainly knows a lot about me.

I don’t have any evidence anyone at the company has ever looked up my Google account, but as a precaution, I did create several new Google accounts for testing on this story.

Can we trust Google's automatic password saver function (like keychain but on Chrome) to be truly private? Or is that also mine-able? Also, does Google access microphones on iPhone when using Google Maps, Gmail or Chrome for iPhone? It seems mighty coincidental that I can say out loud (and never write it or search it) something like "window shades" and then suddenly have ads showing me "window shades"

I think those are great questions and worth looking into. Anything you share can likely be used by Google to determine your interests and have advertisers target you based on them.

I recently saw a new feature by Google that needs more explanation. In the past, if I put in a credit card number into a site while using Chrome, the browser offered to remember it and autofill it in other spots. Now when it offers to remember the credit card, it also says it will associate it with a Google Pay account. That’s not something I necessarily want to be linked because this potentially feeds more information about my spending habits to Google.

I’ve also noticed Google become more insistent when I’m on other websites that I sign in to my Google account. I don’t necessarily want all that to be linked to Google.

As for the “is Google listening?” question, basically you should remember that when you use your voice for search, Google records a snippet, saves it to your MyActivity, transcribes it (otherwise it couldn’t run a search). Since those words are saved to your MyActivity, they are available to be targeted by advertisers.

The fact that you are even asking this question shows the long-term challenges these companies have to earn and keep our trust.

Does this include Android phones without Google Apps and Services installed?

Almost all Android phones have these Google Apps and Services installed by default. While you can disable some of the apps, Android will do things like check the weather regardless.

If you mean forked versions of Android, there aren’t many that are popular, such as Amazon’s Fire OS. It would require some testing. But fundamentally, it doesn’t matter what phone you have, if you use Google Search and are logged in to your Google account, some of the behavior we reported will still be occurring.

What laws can be passed in states to prevent this from happening? We can't rely on the federal government for anything these days.

In Europe, the General Data Protection Regulation has sharpened the practices of companies like Google, but there’s definitely more to be done. I’m not a regulator, but some principles sound like they would work here. Being upfront with people, not storing or processing data in ways that are not clear to the user when they’re being asked to decide. Those types of protections might be enshrined in law. California has passed a law that will do some of this.

Do you believe in the "Singularity" and if so when do you think it will occur?

It’s an interesting theory -- that at some point machines will gain a level of intelligence that will surpass humans. Some have explained it to be when computers gain a real understanding of language and can then read everything that exists.

At that point, no human will be able to catch up. I have no idea when it’ll happen. And there are smart people at work trying to make sure we actually don’t hit that point. Optimistically, that point will never come if we don’t allow it to.

Do you believe this "big brother" approach by huge companies like google will ever change? In your opinion, what can be done to prevent government from accessing our private data like that?

Companies that use technology will always want more data about you. It helps them serve you better but they should make you aware of what they’re collecting and why. As long as it’s a fair exchange, people will keep participating.

As for governments, they have enormous power to go after data like this if they suspect you of a crime. Police have used warrants to pull location about specific users from Google, and even to find users who have been in a certain area. It’s a relatively new area and until this all gets tested further in court, it’s unclear to me what will happen. The Fourth Amendment of the U.S. Constitution protects people from “unreasonable searches and seizures,” but Google is a global company and that surely doesn’t apply everywhere.

Do you follow cases of consumer recourse? Are we basically comprehensively agreeing to arbitration and how does that tend to work out?

Ultimately, the federal government has some role in protecting consumers.

Several experts have said that the false statement Google made about the privacy settings is a violation of its 2011 consent agreement with the Federal Trade Commission, which says in part that Google must be upfront about the degree to which consumers actually have control over their privacy. The settlement “bars the company from future privacy misrepresentations” and a link to the press release about it is here: https://www.ftc.gov/news-events/press-releases/2011/03/ftc-charges-deceptive-privacy-practices-googles-rollout-its-buzz

Google ran afoul of that agreement just a year later in 2012 over how it treated users of Apple’s Safari browser. It was fined $22.5 million. A press release about that penalty is here:

https://www.ftc.gov/news-events/press-releases/2012/08/google-will-pay-225-million-settle-ftc-charges-it-misrepresented

A privacy group called the Electronic Privacy Information Center wrote to the FTC last week saying the findings of the AP report prove that Google’s recording of location data in contravention of the setting “clearly violates” the 2011 deal. Our story about that is here: https://apnews.com/c27d9e7b10e24a679b02472325b3fcec

Also, a man in San Diego sued Google, alleging breaches of California privacy law. A story about that came out here: https://arstechnica.com/tech-policy/2018/08/did-google-violate-users-privacy-when-it-secretly-kept-location-data/

What vpn do you recommend?

From AP Technology Editor David Hamilton: We don’t have a specific recommendation beyond noting the obvious point that any free VPN service is most likely making money from the data that you’re routing through their service. For paid VPN services, there are lots of reviews available from reputable sites like CNET, PCmag.com, Tom’s Guide and The Wirecutter.

Do you think Google is going to get in trouble because of this? Even if they did, how can we know for sure that Google is not tracking us anymore??

Are we fighting a losing battle or have we already lost the battle?

In a previous answer, I highlighted some of the issues that the Federal Trade Commission might look into. Google made a promise for 20 years to not misrepresent the privacy controls they offer. If they break the promise, they can be fined. I don’t know you can be sure Google is not tracking you. While we used tools that surface some of what they’re tracking (in myactivity.google.com), there are other things that we can’t see. Insofar as there is a battle, it’s true there’s no putting the genie back in the bottle and anyone on the internet or who has a phone has left digital traces of themselves everywhere. I think the first step at the moment is simply to become aware of all of the data about us that is actually out there.

So if my wife asks me not to do something and I still do it, am I literally Google?

I’m married so I know better than to comment on that. :)

I was also a John S. Knight Journalism Fellow at Stanford in 2016-17 studying the trade-off between advertising and subscriber support for the news media.

Hi, could you link me to your work on this topic? It would be very relevant to me.

Sure, I wrote a bunch of Medium posts on the topic for a start: https://medium.com/@rnakashi/how-best-to-handle-ad-blocking-subscribers-raise-prices-1421b7b770a8

How often are you able to do investigative work and discover such things as in this story versus picking up on something that is already gathering steam?

This took months to pull together and there are plenty of other outlets working on different aspects of what data the big companies are collecting on us.

As you can imagine, it’s hard enough keeping track of all the news about Google. It’s even harder to do original work. It’s a rare thing to be able to work on this, so we hope it was helpful!!

Are you worried that eventually you will get blackballed by big tech companies like Google? and/or do you feel the need to "manage" the relationship?

This is a balancing act that every business journalist faces with the companies they cover. We approach it from the point of view of asking hard questions and giving companies every opportunity to respond, share information or grant interview requests.

In the case of this story and Google, we were very upfront with questions all along the way. So far we haven’t heard any complaints from them.

Is there a way for users to stop the unwanted location tracking? I assume no on Android, how about iOS? Just completely remove all Google apps from your device?

It’s not easy. By virtue of the fact that lots of people didn’t know exactly what the location history setting was doing, a lot of historical location data has now been stored in peoples’ Google accounts. Finding and deleting it is not easy, but we describe some steps here: https://apnews.com/b031ee35d4534f548e43b7575f4ab494

To prevent future tracking, you need to turn off Google account settings for both “Web & App Activity” and “Location History.” You can find this at myactivity.google.com under “activity controls.” This should stop records of your location from being saved to your account, while still enabling you to use location while you are in an app such as Google Maps.

Websites will still know your general location because of your IP address and that might be stored in conjunction with cookies that are placed on your web browser. You could clear your cookies from time to time.

Cellphone carriers will also know your general location over time, and that has frequently been used by police to find the general location of suspects.

These methods, however, are not as precise as what Google was capable of because of a variety of techniques including the use of GPS and Wi-Fi signal mapping.

Can you hear my conversations?

Send me your Google Takeout and I’ll let you know.

Was there ever an "Aha!" moment, or was it kind of a slow build toward the full picture of what Google and other companies are doing?

Sure, on this story, when we discovered what the “Web & App Activity” and “Location History” settings were actually doing, that was the light going off. We started off as confused as anyone; it took lots of testing, some of which ran down blind alleys, to figure out what was really going on.