Exclusive
"Providing location information without consent for those under 14 is illegal": Google Korea loses appeal

[비즈한국] It has been confirmed that Google Korea, which operates the child location tracking service "Family Link," has lost in the appellate court following its defeat in the first trial after filing an administrative lawsuit against the government's corrective order and 3 million won fine for violating the Location Information Act. The court ruled that providing location information of children under 14 to parents without the child's consent is a violation of the law. It dismissed Google's logic—that obtaining consent from the legal guardian (the parent) is sufficient—as a misinterpretation of the exceptional provisions.

Court: “Child’s consent must be obtained; guardian’s consent cannot serve as a substitute”

On the 12th of last month, the 7th Administrative Division of the Seoul High Court (Presiding Judge Goo Hoe-geun) ruled against the plaintiff in the appeal of the lawsuit filed by Google Korea Ltd., the Korean subsidiary of Google, against the Korea Communications Commission (KCC) to cancel the corrective order. The court upheld the first-instance ruling from last September, which favored the KCC, and dismissed the plaintiff's appeal.

The KCC imposed a corrective order and a 3 million won fine on Google Korea in June 2023. The Commission determined that Google Korea failed to properly implement the consent procedure for providing personal location information while operating its child safety app "Family Link." The core of the issue is that Google did not obtain consent from the information subject (the child) regarding the terms of service, and failed to notify the child of the purpose of provision or obtain their consent before providing the information to a third party (the parent).

Family Link is Google's family account management service that connects parents' and children's devices to manage smartphone usage, including approving or blocking app installations, filtering harmful content, and checking usage status and time. Parents can use this app to track their child’s location based on the smartphone's GPS.

The central point of contention in the case was whether the consent of a legal guardian could substitute for the consent of a child under 14.

Google has argued for a different interpretation of the domestic Location Information Act, claiming that only the legal guardian's consent is required and that cases requiring the child's own consent are rare globally. Article 25, Paragraph 1 of the Location Information Act states, "If a location information business, etc., intends to collect, use, or provide personal location information from a child under 14, it must obtain the consent of their legal guardian." Google argued that this provision means "the legal guardian's consent is sufficient for collecting, using, or providing a child's personal information, and the child's own consent is not separately required."

However, the Seoul High Court rejected this claim and, like the first trial, ruled that Google Korea violated the Location Information Act. The court clarified that the law requiring the legal guardian's consent for the use of a child's personal location information is an "additional safeguard" to prevent misuse and abuse, and is not intended to "substitute" the child's consent with that of the parent.

The court cited the first-instance judgment, stating, "Clear grounds are needed to exclude the general principle and recognize an exception where a third party's consent can substitute for the consent of the subject of personal location information," and concluded, "Even when considering the additionally submitted evidence, the first trial's fact-finding and judgment are recognized as legitimate." It pointed out that Google Korea's logic essentially reverses the exception.

Previously, the 13th Administrative Division of the Seoul Administrative Court (Presiding Judge Park Jeong-dae) ruled, "Even though dual consent provides stronger protection for a child’s personal location information, there is no need to exclude the child's right to consent and limit their right to self-determination regarding personal location information by having the legal guardian exercise it entirely on their behalf."

SKT, KT, and LG obtain child consent… What is Google’s next move?

Google Korea also argued that because there is an exception (Article 26, Paragraph 1) for children aged 8 or under where the parent’s consent is considered to include the child’s, it should be possible in practice to substitute parental consent for children aged 9–14. However, this argument was also not accepted.

The court noted that this overlooks the legislative intent to respect a child’s right to self-determination regarding sensitive information, as well as the cognitive development standards established by law. The court drew a clear line, stating, "The age of 8 is the threshold where a child can understand the meaning of their personal location information being provided, and it is entirely possible to continue providing services for children 8 and under by obtaining their consent."

The KCC’s corrective measures followed a recommendation from the National Human Rights Commission of Korea to verify whether the location tracking features in child safety apps infringe upon fundamental rights, such as a child’s freedom of privacy.

The practices of other companies that properly implement the consent procedure were also mentioned. The court stated, "The defendant’s investigation confirmed that in the case of child safety apps from the three major mobile carriers, the service is provided by obtaining consent from the child themselves in addition to their legal guardian."

With the court reiterating that there is no justification for maintaining the Family Link service in its current form, attention is focused on Google's future response. Google Korea stated, "It is difficult to provide a specific answer as our official position has not yet been decided." Google Korea had filed an appeal four days after the first-instance ruling.

It is understood that Google modified parts of the Family Link sign-up process following the KCC's corrective order. Currently, the procedure includes a step for the child’s own consent when linking an account for a child under 14. Parents exercise their right to consent through identity verification while setting up or supervising the account, and the child goes through a step of reviewing the supervision features, such as location information sharing, on their own device to complete the process.