EPIC: “In December 2023, Google announced an update to its location data policy to provide users with more control over their sensitive location information. While this seems like a promising step in the right direction, we should be mindful of Google’s long history of failing to uphold its privacy obligations and vigilant in monitoring Google’s follow-through on its commitments….Location data can reveal a lot about us. Records of a person’s physical movements through the world can divulge sensitive information: a health condition inferred from a person’s visits to a dialysis clinic, someone’s religious affiliation inferred from their attendance at a mosque, or an individual’s sexuality inferred from his attendance at a gay speed dating event. Some location information may seem innocuous in isolation, but when these data points are collected over time, they can form a detailed profile of a person. Apps, phone providers, mobile ad companies, and other platforms collect our location data and often sell it to data aggregators and data brokers. These profiles can be used in harmful ways, including to target advertisements at us. Even worse, location data may be retained indefinitely, opening it to increased risk of access by law enforcement. While location data can reveal the most intimate details of our lives, it is far from the only type of information that can leave us vulnerable to privacy harms. For example, search query histories—records of terms entered into a search engine by a person—can be deeply revealing, even more so when taken together with location data. If a person searches “HIV treatment near me,” finds an address, and routes himself to that address, the resulting records will enable a clear and reliable inference about his HIV status. This information together may offer a more certain profile of a person than either search query history or location information alone. Because of this, it is important that Google—like any company—limit its collection of such sensitive information to what is strictly necessary to provide the product or service requested by a user. In the wake of Dobbs, Google’s excessive retention of personal information—including location history and search query history—can cause grave harms to its users. Location data may reveal whether someone visited an abortion clinic, how long they stayed at the clinic, and where they obtained follow-up care. Location data may reveal whether a person drove someone across state lines to receive abortion care. Google’s retention of this information can leave people vulnerable to undue criminal punishment because it means that the records are subject to law enforcement access. Indeed, the harms of location data retention can manifest in many ways: a pregnant person who refuses to seek care because they are afraid of criminalization; a physician forced to practice under the constant thread of legal sanction; a mother who nervously drives her child to receive abortion care; a person wrongfully jailed for having a miscarriage; or a citizen who refrains from researching the current state of abortion laws in their state before an election out of fear…”