Ohio is expected to receive $162,000 from Google as part of a $7 million settlement reached with the company after its "Street View" vehicles collected personal data from unsecured wifi networks across the country.
(NOTE - To read a copy of the settlement, scroll down to the end of this story and click on the link.)
The cars were deployed to photograph homes and businesses between 2008 and 2010 to use for the company's location software, which offers pictures of streets all over the world. They also, however, secretly picked up emails, passwords and browser information from private users.
"Consumers have a reasonable expectation of privacy," said Connecticut Attorney General George Jepsen, who led 38 states and the District of Columbia in a two-year investigation and announced the agreement Tuesday. "This agreement recognizes those rights and ensures that Google will not use similar tactics in the future to collect personal information without permission from unsuspecting customers."
The settlement was reached after efforts to pursue the case through the legal system faltered because the technology is so new it was unclear how courts would have ruled on the issue.
"Each day it becomes increasingly important that we do what we can to safeguard our personal information," Ohio Attorney General Mike DeWine said. "While we all must do what we can to safeguard our own personal information, this settlement recognizes the privacy rights of individuals and serves as a reminder that this information cannot be collected without a person's permission."
Connecticut, led by former Attorney General and current Sen. Richard Blumenthal, launched the multi-state investigation in 2010. In 2011, Jepsen announced they would instead reach a settlement. That decision, he said, was due to lack of legal precedent on wireless communications.
Connecticut will receive $520,823 from Google, the largest share in the settlement.
"The legal theory ... has never been tested in this context before," said Jepsen. While $7 million may seem like a mild inconvenience for a company like Google that rakes in billions annually, Jepsen said that amount was more than what they would have been entitled to had a judge ruled in their favor. He also said it's not just about money, but about establishing privacy standards for emerging technologies.
"The real critical thing is getting Google to change their corporate culture and adopt what I think will be best practices for the industry," Jepsen said.
Legislative action is required to establish better industry standards and Blumenthal, who launched this investigation in the attorney general's office, said he would continue to pursue the issue in Congress.
"Whether there could have been a stronger settlement under existing law could be debated, but there's clearly a need for stronger, more stringent consumer privacy laws," said Blumenthal, who recently co-sponsored a bill to regulate collection and use of personal data gathered through online tracking.
"I think that these reprehensible practices show the clear and present dangers to consumers' privacy requiring legislation to better protect them," he said.
A federal probe into the same issue resulted not in court action, but a $25,000 fine. In 2012, the Federal Communications Commission (FCC) decided not to take enforcement actions, and cited, as Jepsen did, lack of precedent for applying the law to these types of communications.
Instead, they imposed the fine, charging that Google "deliberately impeded and delayed the bureau's investigation."
The company agreed to pay the fine to close the matter, but disagreed with the FCC's charges that it had not cooperated.
"Initially Google pushed back pretty hard," Jepsen said of the states' investigation. "But in the last year or so they've become willing to sit down and view it as a problem to be solved and I give them credit for it because this is all such uncharted territory."
The company did not use any of the data in any product or service, Jepsen said.
The information collection also was not disclosed to a third party, Google officials said. The information was segregated and secured.
Jepsen explained that while it cannot be destroyed immediately because it is being used in lawsuits related to this issue, it will be destroyed eventually.
"The real goal here is trying to set industry standards so this kind of thing doesn't happen in the future," said Jepsen.
While Google represented it was unaware the data was being collected, the assurance of voluntary compliance it signed with the states Tuesday acknowledged the data or information collected may have included addresses of requested Web pages, partial or complete email communications, and any confidential or private information being transmitted to or from the network user while the Street View cars were driving by.
Google has since disabled or removed the equipment and software used to collect the kind of data specified in the settlement from its Street View vehicles, and agreed not to collect any additional information without notice and consent.
Other key elements of the agreement require Google to run an employee training program about privacy and confidentiality of user data and continue the program for at least 10 years. It must also conduct a public service advertising campaign to help educate consumers about steps they may take to better secure their personal information while using wireless networks.
Other states participating in the settlement are: Alaska, Arizona, Arkansas, California, Colorado, Delaware, Florida, Hawaii, Illinois, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Mississippi, Missouri, Montana, Nebraska, Nevada, New Jersey, New Mexico, New York, North Carolina, North Dakota, Oklahoma, Oregon, Rhode Island, South Carolina, Tennessee, Texas, Vermont, Virginia and Washington.
EDITOR'S NOTE: Jenny Wilson of The Hartford Courant (MCT) contributed to this story.