Australian regulator accuses Google of data privacy deceit

The Australian competition regular has accused Google of failing to get adequate permission from consumers to use personal data for targeted advertising, an affair the regulator plans to fine the search company millions of dollars over.

Announced on Monday, the Australian Competition and Consumer Commission (ACCC) has launched Federal Court proceedings against Google, under the belief Google misled consumers to obtain consent to "expand the scope of personal information that Google could collect and combine about consumers' internet activity."

The ACCC statement insists Google failed to properly inform consumers and failed to gain explicit informed consent about a change in 2016 that led to it combining personal information from Google accounts with data on a person's activities from other sources. This external data was gathered on pages that used Google's DoubleClick advertising tools.

As data about non-Google activity was linked to identifying details held by Google itself, rather than being kept separate, Google then allegedly used the combined information to improve the performance of its advertising.

For the change, Google provided account holders with a pop-up prompt from 2016 until 2018 that claimed to explain how Google would combine data, one that also requested permission from the user to do so. Clicking on "I Agree" enabled Google to collect and store a wider range of information, including data from third-party sites and apps, the ACCC states.

"The ACCC alleges that the 'I agree' notification was misleading, because consumers could not have properly understood the changes Google was making nor how their data would be used, and so did not - and could not - give informed consent," said the commission.

Text changes in Google's Privacy Policy (via ACCC)

As part of the accusation, the ACCC believes Google misled consumers about a related privacy policy change, when language changed on June 28, 2016 from a statement advising it would not combine DoubleClick cookie data with personal information without opt-in consent to one where the data may be associated "depending on your account settings."

The policy also states "We will not reduce your rights under this Privacy Policy without your explicit consent," which the ACCC alleges Google failed to acquire.

"The use of this new combined information allowed Google to increase significantly the value of its advertising products, from which it generated much higher profits." said commission chairman Rod Sims. "The ACCC considers that consumers effectively pay for Google's services with their data, so this change introduced by Google increased the "price" of Google's services, without consumers' knowledge."

The ACCC anticipates being able to fine Google "in the millions" for the activity, Sims explained to Reuters. While the fine would be beneficial, the filing may more importantly establish a point in common law over what a company can potentially do to customer data, and their privacy implications.

"We will keep taking action, as will agencies overseas," said Sims, "and it will shape how these platforms behave, to make sure that the internet is a benefit to users, not a detriment."

This is not the only lawsuit Google is dealing with over its handling of personal data and user privacy. On July 15, law firm Boies Schiller Flexner accused Google of illicitly gathering user data from mobile users via its apps, claiming the search giant's reassurances about privacy are "blatant lies" that don't stop it from acquiring data and tracking users throughout their everyday life.

Despite attempts by Google to acquire and use more user data, other companies are working to minimize the amount of data it can pick up. In the case of Apple, Safari has already proven itself useful in blocking Google Analytics and other trackers, while new features arriving in iOS 14 advising users of tracking permissions are already worrying advertisers in Europe.