UK ICO Criticizes Google Advertising Policy Update

The U.K. data regulator blasted Google for a changes to policies governing online advertising the government agency says amount to bestowing permission to track users by the indelible fingerprint of their devices.

See Also: Does Office 365 Deliver The Email Security and Resilience Enterprises Need?

The Information Commissioner’s Office on Thursday said policy updates set to take effect in February mean that individuals will no longer be able to control how their data is being used and processed for advertising. Google is a dominant player in the online advertising market, so a policy allowing advertisers to deploy digital fingerprinting is significant, wrote Stephen Almond, ICO executive director of regulatory risk.

“Our response is clear: businesses do not have free rein to use fingerprinting as they please. Like all advertising technology, it must be lawfully and transparently deployed – and if it is not, the ICO will act,” he said.

Device fingerprinting allows companies to collect unique data such as IP addresses, data provided by plugins, and timestamps that can uniquely identify customers. Unlike browser cookies, which users can disable or delete, fingerprinting data relies on signals that cannot be erased easily and are often difficult for browsers to block, the ICO said.

Google in a synopsis of upcoming ad policies says it’s allowing marketers to use internet protocol addresses in combination with privacy-enhancing technologies “such as on-device processing, trusted execution environments, and secure multi-party computation.” IP addresses are becoming more important with the growth of connected TVs, Google said, describing it as one of the fastest growing advertising channels.

“The change to Google’s policy means that fingerprinting could now replace the functions of third-party cookies,” Almond said. The agency published draft updated guidance for advertisers on the deployment of technologies such as tracking pixels and device fingerprinting. Obtaining user consent is an absolute prerequisite before deploying such tracking methods, the draft guidance states.

“Data signals like IP addresses are already commonly used by others in the industry today, and Google has been using IP responsibly to fight fraud for years,” a Google spokesperson said in a prepared statement. “We continue to give users choice whether to receive personalized ads, and will work across the industry to encourage responsible data use.”