Australia's competition watchdog has launched Federal Court proceedings against Google LLC over whether the search engine giant gained customer consent to expand usage of their personal information.
The Australian Competition and Consumer Commission (ACCC) alleges Google misled consumers when it failed to properly inform them and gain their explicit informed consent about its move to combine personal information in consumers’ Google accounts with information about their individual activities on non-Google sites.
Google has flagged that it strongly disagrees with the ACCC's allegations and intends to defend its position.
However, the ACCC alleges that Google began carrying out the practise in in 2016, using its own technology DoubleClick to display ads to users.
This meant this data about users non-Google online activity became linked to their names and other identifying information held by Google. Previously, this information had been kept separately from users Google accounts, meaning the data was not linked to an individual.
Google then used this newly combined information to improve the commercial performance of its advertising businesses, the ACCC said.
“We are taking this action because we consider Google misled Australian consumers about what it planned to do with large amounts of their personal information, including internet activity on websites not connected to Google,” ACCC Chair Rod Sims said.
“Google significantly increased the scope of information it collected about consumers on a personally identifiable basis. This included potentially very sensitive and private information about their activities on third party websites. It then used this information to serve up highly targeted advertisements without consumers’ express informed consent.
“We allege that Google did not obtain explicit consent from consumers to take this step. The use of this new combined information allowed Google to increase significantly the value of its advertising products, from which it generated much higher profits.”
Additionally, Sims said the ACCC considers that consumers effectively pay for Google’s services with their data, so this change introduced by Google increased the “price” of Google’s services without consumers’ knowledge.
From 28 June 2016 until at least December 2018, Google account holders were prompted to click “I agree” to a pop-up notification from Google that purported to explain how it planned to combine their data and sought the consumers’ consent for this.
The notification also stated: “More information will be available in your Google Account making it easier for you to review and control”; and “Google will use this information to make ads across the web more relevant for you.”
Before June 2016, Google only collected and used, for advertising purposes, personally identifiable information about Google account users’ activities on Google owned services and apps like Google Search and YouTube.
After June 2016, when consumers clicked on the “I agree” notification, Google began to collect and store a much wider range of personally identifiable information about the online activities of Google account holders, including their use of third-party sites and apps not owned by Google.
Previously, this additional data had been stored separately from a user’s Google account.
Combined with the personal data stored in Google accounts, this provided Google with valuable information with which to sell even more targeted advertising, including through its Google Ad Manager and Google Marketing Platform brands.
The ACCC alleges that the “I agree” notification was misleading, because consumers could not have properly understood the changes Google was making nor how their data would be used, and so did not — and could not — give informed consent.
“We believe that many consumers, if given an informed choice, may have refused Google permission to combine and use such a wide array of their personal information for Google’s own financial benefit,” Sims said.
On 28 June 2016, Google deleted this statement and inserted the following statement: “Depending on your account settings, your activity on other sites and apps may be associated with your personal information in order to improve Google’s services and the ads delivered by Google.”
“Google made a clear representation about how it would protect users’ privacy. The ACCC alleges that Google made changes without obtaining the explicit consent it had promised consumers it would obtain before altering how it protected their private information,” Sims said.
In 2008, Google acquired ad-tech supplier, DoubleClick and its services are used through Google Ad Manager and Google Marketing Platform. These services track users' internet activity on third-party sites that display ads through the use of DoubleClick’s technology.
Google’s acquisition of DoubleClick required approval by competition authorities including the US Federal Trade Commission and the European Commission. The ACCC also reviewed and cleared this transaction.
FTC and EC cleared the acquisition, and in doing so considered submissions from Google that it would not be able to combine DoubleClick’s data on consumers’ internet activity with its own data about consumers’ activity on Google services because, at the time, DoubleClick’s contracts with its users prevented Google from doing so.
A Google spokesperson told ARN: “In June 2016, we updated our ads system and associated user controls to match the way people use Google products: across many different devices.
"The changes we made were optional and we asked users to consent via prominent and easy-to-understand notifications. If a user did not consent, their experience of our products and services remained unchanged. We have cooperated with the ACCC’s investigation into this matter.
"We strongly disagree with their allegations and intend to defend our position," the spokesperson added.