Like many big tech companies, Google is currently attempting to reposition itself as a privacy-friendly company with the interests of its members at the forefront of all its activities.
As such the letter sent by genuinely privacy-friendly browser company Brave to the UK’s Information Commissioner yesterday will no doubt be seen as something of an embarrassment to Google.
This is because the letter makes it abundantly clear that, despite Google’s claims to the contrary, its advertising system still allows companies to target Google users on the basis of a whole host of different identifiers which are supposed to be private.
How Google’s RTB system works
The letter has been sent to the Information Commission from lawyers representing Brave and is all about Google’s Real-time bidding (RTB) system
RTB is the automated tool Google users to place millions of advertisements on websites across the internet. It allows companies to pay an agreed fee to get their advert seen by a set number of people a certain number of times over a 24-hour period.
Companies can select the type of person they want to see their advert from various categories. Google collects a huge amount of data from its users to help feed these different categories.
This sort of information used to categorize people is things like a person's IP address, browser history, location, time zone, language, mouse cursor movement, search queries, or demographic data.
Last June, the Information Commissioner warned that this system was likely to be putting people’s privacy at risk. As a result, Google has announced that it plans to phase out the use of third party tracking cookies that allow advertisers to track people online by the end of 2022.
It also claimed that it would remove content categories as soon as this month. But Brave’s lawyers argue in their letter that these steps don’t go far enough.
What Brave claims
In their letter to the Information Commissioner, they argue that because Google is still sharing details of individual websites that people visit, it is still easy for advertisers to micro-target audiences.
This information can either be sufficient on its own or combined with data bought from elsewhere using a process called “jigsaw identification”. The end result for users is that if they visit a recipe website, adverts for kitchens and cooking implements are likely to crop up on almost every webpage they visit.
These targeted adverts can be extremely annoying, but as the CEO of Brave Jonny Ryan explained to the Telegraph, this is not the biggest concern about this process.
“The real danger is not annoying adverts – rather that companies you don’t know are profiling you and learning about what makes you tick, and using this in ways you can’t guess,” he explained. “The next time you apply for a job, perhaps the algorithm shortlisting CVs is fed with data about what sites you frequent, for example.”
In their letter, Brave claims that Google is still able to allow advertisers to target people on the basis of things like region, gender, and sexuality.
They are not the first big tech company to be accused of permitting such targeting. Last year Facebook was forced to pay almost £4 million pounds to a US civil rights group after it was found that their targeted advertising system allowed companies to block people from ethnic minority from adverts for things like housing, jobs, and financial services.
Google refutes allegations
Google has defended itself against the claims made by Brave.
In a statement, it said, “Our real-time bidding product policies specifically prohibit collecting users’ sensitive information, such as health conditions, religious beliefs, and sexual orientation. We conduct reviews to ensure bidders are abiding by our policies and if we find violations, we take action.”
However, it will now be for the Information Commissioners Office to determine if it think the steps Google has taken go far enough or if more needs to be done.
There is no doubt that removing the feature to categorise people would be a big step in the right direction and would stop companies from being able to discriminate or target advertising based on information that should be private.
But Brave is absolutely right to point out that, while this information may no longer be explicitly provided by Google, it is still perfectly possible for many companies to figure it out for themselves on the basis of other information Google provides.
Is this an invasion of privacy? We would certainly argue that it is which is why we always recommend our readers opt for privacy-friendly browsers like Brave or DuckDuckGo.
It is difficult to see how the Information Commissioner could reach a different conclusion but the question is what steps he would feel are proportionate to address the problem.
Preventing Google from sharing details of websites people visit would be a big step and hit Google hard in the pocket. They would no doubt fight such a move hard too, so the likelihood of a compromise being reached seems far more likely.