European privacy advocates filed a formal GDPR complaint overnight about Google’s use of advertising trackers, alleging the tech giant is tracking phone users without proper consent through its unique advertising IDs.
Google mandates that any developer uploading an app to the Google Play Store includes its Advertising ID capability. According to Google’s description, the Advertising ID allows developers to better monetise apps with a standard API and users can reset it or use it to opt out of personalised ads.
But according to NOYB (none of your business), a European not for profit advocating for digital privacy, Google’s Advertising ID, unlike Apple’s version, can not be disabled and tracks users “without a valid legal basis”.
“The data collected with this unique tracking ID is passed on to countless third parties in the advertising ecosystem,” NOYB said in a statement overnight announcing its GDPR complaint.
“The user has no real control over it: Google does not allow to delete an ID, just to create a new one.”
Under GDPR, data processors must have a legal basis for processing data. For advertising companies like Google that typically means they need genuine consent from the people the data concerns.
French data regulators last year slapped Google with a €50 million fine because the consent it was collecting for ad personalisation was neither “informed” nor “unambiguous” and “specific” as is required under GDPR.
Privacy group NOYB helped initiate the French investigation and are now turning to Austrian data regulators, filing a complaint about the Advertising ID tracking on behalf of an Austrian citizen.
The group says the complaint is also partially based on the report by the Norwegian Consumer Council which revealed the extent of data trading and accused advertising technology companies of “systematically breaking the law”.
NOYB alleges users can not control the processing of their data because they can not delete the tracking ID and google does not collect valid opt-in before generating them.
“It is grotesque: Google claims that if you want them to stop tracking you, you have to agree to new tracking,” said NOYB privacy lawyer, Stefano Rossetti.
“It is like cancelling a contract only under the condition that you sign a new one. Google’s system seems to structurally deny the exercise of users’ rights.”
NOYB is seeking for regulators to investigate the practice, ensure Google halts it for the complainant and shares any data that was processed, and impose an “an effective, proportionate and dissuasive fine” against Google.
Under GDPR, data processors like Google can be fined up to €20 million, or 4 per cent of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher.
Google did not immediately respond to questions about the allegations.
The tech giant is currently under active GDRP investigations by European regulators for its location tracking and the use of personal information in online advertising. In Australia, Google faces a similar legal challenge from the ACCC about location data. The competition regulator is also conducting an inquiry into the online advertising ecosystem where Google will be scrutinised.