Google swears left and right that they do not sell personal information. "We do not sell your data" is almost their mantra by now. But is it true? Yes, and no. Words can be used to clarify things, or obfuscate them, and Google is doing the latter.
- Google does not sell your data. Not exactly…
- What does Google do with the data?
- Conclusions
- Why do I care?
Google does not sell your data. Not exactly…
In everyday language, selling is giving something away in exchange for something else of value. This is close enough to most legal definitions of sale. And in this sense, it is true enough that Google does not sell your data. Google is not a data broker: a company cannot pay Google to buy emails or IP addresses. But when it comes to privacy, not selling your data is not enough.
Google monetizes personal data in other ways, some of which involve disclosing personal data to third parties. One of those ways is real-time bidding system (RTB) that powers Google Adsense.
RTB protocols are complicated, and I can only scratch the surface here. If you’re interested, Brave has a detailed video explaining how RTB works.
In a nutshell, a website makes advertising spaces available for advertisers through Google Adsense’s intermediation. Several advertisers bid for the same advertising spaces whenever a visitor loads a page in an automated real-time auction. This real-time bid involves disclosing personal data to advertisers to cater their ads better.
For instance, let’s say Google figures out that you like guitars- whether through Google Analytics, your Google Maps data, your Google searches, etc. When you visit a website using Google Adsense, a real-time bid for advertising spaces begins, and Google tells advertisers that you like guitars. This allows advertisers to figure out how much an advertising space is worth to them and decide what kind of ad to serve you (this visitor likes guitars, so let’s show them guitars instead of pianos or drums).
This sounds innocuous enough, but it really isn’t. Profiling is based on the collection of thousands of data points about you, including your web searches, the websites you visited, and your location data. This allows for accurate predictions about your personality, behavior, and much more. You may not see ads for medication or sex toys, but that does not mean Google cannot take an educated guess about your medical conditions or sexual inclinations based on the data they have.
If you surf the Internet, chances are your personal data are auctioned dozens, if not hundreds, of times a day. Your data are disclosed to all advertisers participating in each auction- not just the winner. In fact, some data brokers participate in the auctions just to gather as much data as possible. This allows them to profile you and sell the information to the highest bidder. This happens because Google has no control over what happens to your data after they are disclosed.
This happens to the data of millions of people every day, as explained in this document by the Irish Council of Civil Liberties. RTB and data brokering are so problematic that even NATO- yes- NATO!- considers them a security threat. It's that bad.
But real-time bidding is not a sale, because no one pays for the data. Advertisers buy advertising spaces and Google gets its cut. Personal data are disclosed in the process, but they are not what advertisers pay for.
In a way, Google can truthfully claim that it doesn’t sell your data. But from a privacy perspective, it does not matter whether RTB is a sale or not.
To be clear: Google is not the only company doing this. RTB protocols are standard for all major players in the web advertising market. But Google is the dominant player in this market and holds a large share of the responsibility. And by insisting on the notion of sale in its disingenuous statements, the company is intentionally diverting the public’s attention from the irresponsible ways it makes loads of money by disclosing enormous amounts of personal data.
What does Google do with the data?
It is no secret that Google tracks Internet users. This happens with Google Analytics' cookies, and with an enormous amount of personal data that Google collects from Google searches, Google Maps, Youtube, Google APIs, and the advertising IDs on Android devices.
Google qualifies itself as a data controller for Google Ads as well as other services. Under the GDPR, the company does not merely process personal data to provide the service to the customer (that is, the site using Google Ads). Google can use the data for its own purposes, which include powering its advertising services, developing new products, and training AI models.
Ultimately, Google’s privacy policy and data collection practices for a specific service don’t matter much. The Google service ecosystem as a whole provides the company with enormous amounts of data, most of which is fed to online advertising. Think of all the personal data Google collects from Google searches, Google Maps, Youtube, Google APIs, and the advertising IDs on Android devices.
Finally, let's get rid of the idea that all of this is fine and happens with "consent". If a friend mails you with their gmail account, or uses Google Maps to find your address, your data will be stored.
There is no such thing as de-Googling your life. You may not use Google but Google still uses you.
Conclusions
The privacy issues with Google’s products don’t end here- far from it. Google tracks Android users by default with advertising IDs. It tracks all calls and messages without providing any information about the tracking, asking for consent, or even offering an opt-out. And we recently explained how the company recently changed the url for Google Maps to extend location permission to the entire https://www.google.com domain on their browsers.
Google is constantly looking for ways to collect as much data as possible and turn it into as much money as possible.
So does Google sell your data? I will leave that open to interpretation.
Why do I care?
We believe in an independent web that is friendly to website visitors. This is the reason we built a privacy-friendly Google Analytics alternative that collect no personal data and does not use trackers or cookies. If this resonates with you, feel free to give it a try.