In the race to monetize as much personal data as possible via its online advertising platform, Google is allegedly constructing a number of “hidden” web pages that will enable the company to circumvent its own GDPR-compliant internal policies. At issue is a new complaint from privacy-focused web browser Brave that Google is using a secret system of hidden web tracking pages in order to serve up personally identifiable information to advertisers. In fact, Brave feels so strongly about this allegation that it has been added to an ongoing complaint that it originally lodged with the Irish Data Protection Commission (DPC) back in 2018.
Details of the new complaint alleging hidden web tracking by Google
The details of Google’s hidden web tracking system to serve personalized ads were outlined by Brave’s Chief Policy Officer, Dr. Johnny Ryan, who has been campaigning very publicly against Google for the past year. According to Ryan, Google has created a system of web tracking that will enable it to keep its online advertising model as profitable as possible. The story was first reported in the Financial Times.
At issue is Google’s real-time bidding system for online advertising known as the Authorized Buyers platform (and formerly known as DoubleClick). This is an algorithmic advertising platform that helps to serve up targeted ads to users when they are using the Google Chrome browser. The key here, of course, is having the right personal data about web users, so that online advertisers know how much to bid on each ad, and which ad to show that user. In browsers that still enable cookies, this is relatively easy to do because advertisers have, at a minimum, data related to your browsing history. But when users opt out of allowing tracking cookies, that’s when the task of serving up personalized ads becomes much more difficult.
So, as might be expected, Google has come up with a workaround for this problem. According to Brave, Google still creates unique identifiers for each web user linked to their browsing activity – but instead of sending this information directly to advertisers as part of bid requests, it creates an elaborate network of hidden web pages that advertisers can log into instead. Once they are logged in, they can then grab this personally identifiable information and match it with any information they already have about the user in order to create very sophisticated advertising profiles and decide how much to bid. But there’s just one problem with this indirect form of web tracking – it’s not GDPR-compliant.
Ryan tested his hypothesis that Google was secretly collecting personal data about him – which might include personal information, social media usage information, or even clues as to his political affiliation or ethnicity – and then sharing it with online advertisers by using a new version of Google Chrome on a new device. This was to ensure that there was no prior browsing history, no login information and no cookie information available to Google. What he found, though, was that Google was still able to serve him very personalized ads. So how did Google do it?
As part of his own investigation, Ryan found that Google was creating multiple hidden web pages, each one dedicated to tracking his online browsing behavior. And he also noticed that multiple advertisers and other users were accessing those pages. In just one hour of web browsing on Google Chrome, he uncovered 9 web tracking pages and 11 duplicate pages.
As Ryan suggests in his complaint, if Google is tracking him, they are likely tracking just about everyone else as well. After all, Google’s Authorized Buyers program is used by 8.4 million websites worldwide, and Google Chrome is one of the most popular web browsers in the world. So Ryan is asking the Irish Data Protection Commission to look into this and stop Google from doing it in the future.
Google denies secret web tracking
Predictably, Google completely denies all wrongdoing. In a statement, Google said, “We do not serve personalized ads or send bid requests to bidders without user consent.” In other words, Google claims that no workarounds of any kind have been used in cases where users are not able to be tracked via cookies. Moreover, Google says that it will continue to cooperate fully with the Irish Data Protection Commission.
It is also worth noting that Google is Brave’s No. 1 competitor, and anything that Brave can do to weaken Google is going to help Brave. That might explain why Brave has been so open and vocal about these web tracking pages – the allegation might sound like a lot of technical mumbo-jumbo to many, so Brave is doing everything that it can to explain Google’s practices in normal, everyday language. After all, everyone is able to imagine – at least, at a very high level – how a system of secret web tracking pages might work.
More privacy headaches for Google
This current allegation over secret web tracking is just the most recent privacy headache for the Silicon Valley giant. It seems like everywhere Google turns these days, there’s a new privacy problem staring it in the face. For example, the company’s popular video platform, YouTube, just got hit with a $170 million fine from the U.S. Federal Trade Commission (FTC) for serving up personalized ads to young kids under the age of 13. And Google has been dogged by persistent complaints that many of its most popular services – such as Google Search – intrusively invade into people’s personal privacy.
And, on top of all that, there’s now growing momentum for both state and federal antitrust probes into Google’s behavior. There is mounting concern that not only is Google playing fast and loose with users’ personal data, but also that it is intentionally stifling competition and causing harm to consumers via its monopolistic online advertising system. Thus, it’s important to view Brave’s web tracking allegations as part of this broader context – it’s just one more example of how Google is using its dominant market power to abuse the very system that has enabled it to become one of the most powerful and profitable companies in the world.