Brave accuses Google of trampling Europe's GDPR with stealthy netizen-stalking adverts

Brave, the maker of a Chromium-based browser with a focus on privacy, claims advertising giant Google flouts Europe's data protection rules by effectively leaking netizens' web browsing activities to advertisers. In an essay published on Wednesday, Brave's chief policy officer Johnny Ryan said Google’s Authorized Buyers real- …

[Anonymous Coward]

Fingerprint

_{Non-personal data shared in an RTB broadcast may include data about income, age and gender, habits, social media influence, ethnicity, sexual orientation, religion or political affiliation}

The actual data is way more than that list and effectively constitutes a fingerprint in its own right. Just in case that's not enough, they supply a full fingerprint anyway subtly disguised in the form of a URL or something similar.

(I'm using the word fingerprint to mean "uniquely identify an individual.")

[Tom 38]

Funny

I don't recall Google asking consent to do any such thing. I guess they are saying that people are somehow finding a magic page to opt in to this stuff?

[GnuTzu]

Re: Funny

Uh, it's time to check with the EFF to see what the layers found in the EULA--because you know the legalese was written in a way to encourage click-through.

[Slarti Bartfast]

Re: Funny

Tom I agree with you fully and have an upvote. However, I remember three years ago I was in a rush and needed to quickly find an out-of-hours pharmacy on Street View. When I visited the website I was blocked by a notification that I couldn't continue without agreeing to a new policy. I quickly clicked the agree button and thankfully I no longer have that burning sensation. It turns out though that I did agree to tracking and to start every conversation with the phrase "Pixel: the best Android phone you can buy". It transpires the Irish DPA (Unit 4, Google Way, Dublin) consider that 'informed consent' under GDPR.

[NATTtrash]

"We do not serve personalized ads or send bid requests to bidders without user consent," Google's spokesperson continued

Ooops, it happened again. Better get a clean pair of knickers...

[John Smith 19]

"a two thousand character string"

Hmm.

Their Americans so assume ASCII characters.

I'd say what 2^16000 is but Googles calculator fails above 2^1010 at 1.097225e+304

So yes I'd say that "annonmyization" fig leaf is Boris Johnson grade bu***hit.

Let's be clear here.

The root cause is that most people won't pay for stuff they see on the internet.

[Francis Irving]

Re: "a two thousand character string"

Google could stop tracking individuals and still make lots of money. They used to do so - early AdSense didn't track you. The New York Times does so, making as much money with non tracking adverts in Europe after GDPR as it used to make with tracking ones.

There is a strange myth that this tracking is necessary for an advertising funded internet. It wasn't and isn't. Plus, as you say, might be nice if more people paid for things too!

[Anonymous Coward]

Re: There is a strange myth that this tracking is necessary

it is "necessary" if you want MORE PROFIT! There's not end to human greed.

[Bronek Kozicki]

Re: "a two thousand character string"

"The root cause is that most people won't pay for stuff they see on the internet."

... I am already paying few websites I use for my daily news delivery and related discussions, and would happily pay El Reg if they graciously took my money. As it is, I block the ads like everywhere else and am effectively using this website for free ... but with peace of mind.

[Anonymous Coward]

Re: "a two thousand character string"

They can serve up adverts fine even to people with ad blockers. They would just need to host static images themselves and deliver them in a nice, unobtrusive way. They could then also reassure that the adverts being served have no way of causing privacy or malware issues for the user (unless they were clicked on). There's no point in individual profile targeting on The Register as it knows their readers' interests due to it's specialist nature.

However this would take more work and would lose access to large advertising networks and a guaranteed constant supply of advertisers via those networks. However it may just be worth it.

[Forget It]

Don't be Illegal

[Kabukiwookie]

Fine them into the ground

Every tine somethimg like this crops up, fines should double from the last one that was issued.

That'll either clean up their act or make some room in the forest for saplings to get some much needed light.

Aside from that Google should be broken up.

[Anonymous Coward]

"ethnicity, sexual orientation, religion or political affiliation"

These are sensitive data under EU rules (https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en).

Under GDPR, but specific processing needed by entities that must handle those data, the only way to collect and use them is if "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes" (bold mine).

I really doubt Google and the third parties using them had received an explicit consent - moreover if data contains a unique identifier and enough data points to de-anonymize them easily, I can easily see the foundations for a maximum GDPR fine....

[yoganmahew]

"search giant"?

No sir, "advertising tracking giant with search engine as bait" is the correct term.

[Anonymous Coward]

Brave accuses Google

a wannabe kettle meets a pot

[cantankerous swineherd]

"It is a parameter for measuring end-to-end latency."

these people think we're cnuts.

[Anonymous Coward]

I would have asked the spokesperson if she knew what latency is....

[nagyeger]

Latency: the minimum time to reply to a signal

So the signal is: google collecting loads of data and (allegedly) breaking GDPR left right and centre.

Initial reply time is quite slow, due to the transcription into legalese. error checking and passing from desk to desk, but never mind, the reply will come. (see icon) -->

[Anonymous Coward]

Watching for it

Watching for Alphabet/google to get broken up for anti trust. :) So much for buying up all the tech they could LOL

[Kabukiwookie]

Re: Watching for it

This will never happen without a drastic change in US leadership.

Technological dominance is more important to the US govt than technical excellence.

With China already outpacing the (real) US Economy, the US will wind up with neither.

[DCFusor]

Re: Watching for it

Not just leadership, the system itself.

It's not quite all about the money - being able to control the narrative has even more influence on politicians, because, after all that's what they mostly used those campaign contributions (known as bribes in other systems) for - to get elected. Hollywood and big tech have always had outsized influence on things - and now big tech has both narrative control AND lobby money.

No, I don't know the best answer to this set of problems. We let people who want power fight for it, and no matter who wins, it's one of "those types"...

[Mark 65]

Blocking

Makes a pi-hole server look a better investment day by day. Phones (and devices) are the big problem point though and the advertising scum know it. As you're generally kept out of the system gubbings there's not too much you can do. You can likely rely on Apple to fight against it, but only because they want you viewing their ads not Google's.