Google swears left and right that they do not sell personal information. "We do not sell your data" is almost their mantra by now. But is it true? Yes, and no. Words can be used to clarify things, or obfuscate them, and Google is doing the latter.
- Google does not sell your data. Not exactly…
- What does Google do with the data?
- Why do I care?
Google does not sell your data. Not exactly…
In everyday language, selling is giving something away in exchange for something else of value. This is close enough to most legal definitions of sale. And in this sense, it is true enough that Google does not sell your data. Google is not a data broker: a company cannot pay Google to buy emails or IP addresses. But when it comes to privacy, not selling your data is not enough.
Google monetizes personal data in other ways, some of which involve disclosing personal data to third parties. One of those ways is real-time bidding system (RTB) that powers Google Adsense.
RTB protocols are complicated, and I can only scratch the surface here. If you’re interested, Brave has a detailed video explaining how RTB works.
In a nutshell, a website makes advertising spaces available for advertisers through Google Adsense’s intermediation. Several advertisers bid for the same advertising spaces whenever a visitor loads a page in an automated real-time auction. This real-time bid involves disclosing personal data to advertisers to cater their ads better.
For instance, let’s say Google figures out that you like guitars- whether through Google Analytics, your Google Maps data, your Google searches, etc. When you visit a website using Google Adsense, a real-time bid for advertising spaces begins, and Google tells advertisers that you like guitars. This allows advertisers to figure out how much an advertising space is worth to them and decide what kind of ad to serve you (this visitor likes guitars, so let’s show them guitars instead of pianos or drums).
This sounds innocuous enough, but it really isn’t. Profiling is based on the collection of thousands of data points about you, including your web searches, the websites you visited, and your location data. This allows for accurate predictions about your personality, behavior, and much more. You may not see ads for medication or sex toys, but that does not mean Google cannot take an educated guess about your medical conditions or sexual inclinations based on the data they have.
If you surf the Internet, chances are your personal data are auctioned dozens, if not hundreds, of times a day. Your data are disclosed to all advertisers participating in each auction- not just the winner. In fact, some data brokers participate in the auctions just to gather as much data as possible. This allows them to profile you and sell the information to the highest bidder. This happens because Google has no control over what happens to your data after they are disclosed.
This happens to the data of millions of people every day, as explained in this document by the Irish Council of Civil Liberties.
But real-time bidding is not a sale, because no one pays for the data. Advertisers buy advertising spaces, and Google gets its cut. Personal data are disclosed in the process, but they are not what advertisers pay for.
In a way, Google can truthfully claim that it doesn’t sell your data. But from a privacy perspective, it does not matter whether RTB is a sale or not.
To be clear: Google is not the only company doing this. RTB protocols are standard for all major players in the web advertising market. But Google is the dominant player in this market, so it holds a large share of the responsibility. And by insisting on the notion of sale in its disingenuous statements, the company is intentionally diverting the public’s attention from the irresponsible ways it makes loads of money by disclosing enormous amounts of personal data.
What does Google do with the data?
Google qualifies itself as a data controller for Google Ads as well as other services. Under the GDPR, the company does not merely process personal data to provide the service to the customer (that is, the site using Google Ads). Google can use the data for its own purposes, which include powering its advertising services, developing new products, and training AI models.
Fortunately, Google is not always a data controller. For instance, Google is a data processor for EU customers interacting with Google Analytics, so it uses visitor data in a more limited way.
Of course, you could reject cookies from Google Analytics. But Google can still track you without them. Think of all the personal data Google collects from Google searches, Google Maps, Youtube, Google APIs, and the advertising IDs on Android devices.
The privacy issues with Google’s products don’t end here- far from it. Android devices track users by default with advertising IDs (which is invasive and probably illegal under the GDPR). Android also tracks all calls and messages without providing any information about the tracking, asking for consent, or even offering an opt-out. And we recently explained how the company recently changed the url for Google Maps to extend location permission to the entire https://www.google.com domain on their browsers.
Google is constantly looking for ways to collect as much data as possible and turn it into as much money as possible.
So does Google sell your data? I will leave that open to interpretation.
Why do I care?
I believe in an independent web that is friendly to website visitors. This is the reason I built a privacy-friendly Google Analytics alternative that collect no personal data and does not use trackers or cookies. If this resonates with you, feel free to give it a try.