CMO

ACCC launches fresh legal challenge against Google's consumer data practices for advertising

Google says it will defend itself against the Australian industry watchdog's latest proceedings through the Federal Court alleging it misled consumers about using personal data for digital advertising fro at least 18 months

The Australian Competition and Consumer Commission (ACCC) has launched fresh proceedings against Google in the Federal Court, alleging the digital giant misled consumers about using their personal data for advertising across third-party sites for at least 18 months.  

The latest court proceedings centre around allegations Google failed to properly inform consumers nor explicitly gain consent to start combining personal information in consumers’ Google accounts with information about their activities across third-party sites using Google technology (formerly known as DoubleClick and acquired by Google in 2008) for targeting digital advertising from mid-2016 to at least the end of December 2018.

The industry watchdog alleges data about users’ non-Google online activity was linked to identifying information, such as their names, from mid-2016 and used in combination to improve the digital giant’s advertising performance. The changes are alleged to have impacted millions of Australians holding Google accounts.

The ACCC has also alleged Google misled consumers about a related change to its privacy policy.

The latest court proceedings come nine months after the ACCC launched a separate legal action against Google for allegedly engaging in misleading conduct around the location data the search giant was collecting, keeping and using on individual consumers. These separate proceedings, which pertain to data collection and use since January 2017, are positioned as a breach of Australia’s Consumer Law.

Both legal undertakings come 12 months after the Australian Government’s Digital Platforms Inquiry was concluded. The final report and 23 recommendations, tabled in July 2019, called for urgent holistic and dynamic reforms to competition law, consumer protection, media regulation and privacy laws in order to counter the adverse effect digital giants, Google and Facebook, are having on the local economy, media landscape, competition and consumer rights. Throughout the course of the inquiry, the ACCC hinted it would look to instigate further legal action against the two digital players based on the alarming findings of its report.

In a statement today announcing the latest legal action, ACCC chair, Rod Sims, said the watchdog considered Google to have misled Australian consumers about what it planned to do with large amounts of their personal information, including Internet activity on websites not connected to Google.

“Google significantly increased the scope of information it collected about consumers on a personally identifiable basis. This included potentially very sensitive and private information about their activities on third-party websites. It then used this information to serve up highly targeted advertisements without consumers’ express informed consent,” Sims stated. “We allege that Google did not obtain explicit consent from consumers to take this step.”

The use of this combined information allowed Google to increase significantly the value of its advertising products, from which it generated much higher profits, Sims said.

“The ACCC considers that consumers effectively pay for Google’s services with their data, so this change introduced by Google increased the ‘price’ of Google’s services, without consumers’ knowledge,” he said.

In its response to the latest court proceedings, Google Australia said it would be defending its position against the allegations and highlighted the optional nature of the changes for consumers. These changes were covered by global press at the time they were announced, and positioned as opt-in offerings.

“In June 2016, we updated our ads system and associated user controls to match the way people use Google products: across many different devices. The changes we made were optional and we asked users to consent via prominent and easy-to-understand notifications. If a user did not consent, their experience of our products and services remained unchanged," Google stated.

"We have cooperated with the ACCC’s investigation into this matter. We strongly disagree with their allegations and intend to defend our position.”

Notification options

In its filing, the ACCC said from 28 June 2016 until at least December 2018, Google account holders were prompted to click ‘I agree’ to a pop-up notification that claimed to explain how personal data was to be combined and used in advertising. The notification, ‘Some new features for your Google Account’, stated optional features had been introduced to accounts giving consumers more control over the data Google collects and how it’s used, while allowing Google to show them more relevant advertising.  

According to the ACCC, before June 2016, Google only collected and used personally identifiable information about Google account holders for advertising purposes across its owned services and apps such as Google Search and YouTube.

After June 2016, when consumers clicked the “I agree” notification, Google began to collect and store a much wider range of personally identifiable information about the online activities of Google account holders, including their use of third-party sites and apps not owned by Google. Previously, this additional data had been stored separately from a user’s Google account, the ACCC alleges.

“Combined with the personal data stored in Google accounts, this provided Google with valuable information with which to sell even more targeted advertising, including through its Google Ad Manager and Google Marketing Platform brands,” the ACCC stated in its media release today.

“We believe that many consumers, if given an informed choice, may have refused Google permission to combine and use such a wide array of their personal information for Google’s own financial benefit,” Sims said.

Privacy policy allegations

The ACCC has also raised Google’s privacy policies since mid-2016 as part of its latest legal action against the company.

According to the ACCC, Google had previously stated in its privacy policy before 28 June 2016 that it would not combine DoubleClick cookie information with personally identifiable information without opt-in consent. On 28 June 2016, Google inserted the following statement: “[d]epending on your account settings, your activity on other sites and apps may be associated with your personal information in order to improve Google’s services and the ads delivered by Google.”

Google’s privacy policy also states: “[w]e will not reduce your rights under this Privacy Policy without your explicit consent.”

The ACCC alleges Google did not obtain consumers’ explicit consent for this change to the privacy policy, and the statement is therefore misleading.

“The ACCC alleges that Google made changes without obtaining the explicit consent it had promised consumers it would obtain before altering how it protected their private information,” Sims said.

Follow CMO on Twitter: @CMOAustralia, take part in the CMO conversation on LinkedIn: CMO ANZ, follow our regular updates via CMO Australia's Linkedin company page, or join us on Facebook: https://www.facebook.com/CMOAustralia