User finds that Google was hiding three Google Pay privacy settings, like sharing creditworthiness, from its default view; Google says it was a bug it is fixing
Lawrence Abrams / BleepingComputer :
Context & Ripple Effects
This lands six days after Google publicly touted an increased focus on privacy, claiming it had made settings easier to find while Wired noted they remained confusing (that easier-to-find push is the immediate backdrop). A user finding three Google Pay controls — including one for sharing creditworthiness information — sitting outside the default view cuts directly against that messaging.
The 'bug' explanation also has to be read against the record the corpus already documents: court filings describe engineers acknowledging location-privacy settings were misleading (unsealed engineer admissions), other filings detail deliberate efforts to make popular privacy toggles harder to find and pressure on partners like LG to follow suit (the harder-to-find settings disclosures), and an internal database logged years of privacy mishandling (the 2013–2018 issue tracker).
First-order effects
- Google Pay users gain access to three previously non-default controls — most notably whether to share creditworthiness data — once Google ships the fix it says is coming.
- Google's just-launched privacy messaging takes an immediate credibility hit, since the discovery surfaced within a week of its own campaign to showcase more discoverable settings.
Second-order effects
- Plaintiffs and regulators litigating Google's settings design now have a payments-data example to add to the location-data record, extending the alleged concealment pattern from where you go to your financial standing.
Third-order effects
- If courts and regulators treat repeated 'buried setting' incidents across products as design rather than accident, default-on data sharing for sensitive categories like creditworthiness becomes the next front in consent-based enforcement — with Google's own internal logs serving as the evidentiary trail.
The trend: Privacy-control placement is becoming a legal battleground, as each newly discovered hidden setting strengthens the argument that Google's defaults, not bugs, do the data-sharing work.