Ireland Launches Investigation into Google’s Online Advertising Practices

On May 22, 2019, Ireland’s Data Protection Commission announced an investigation into Google Ireland Limited’s ("Google") collection and processing of personal data in the context of its online Ad Exchange. The purpose of the inquiry pursuant to section 110 of the Data Protection Act 2018 is to establish whether the processing of personal data at each stage of an advertising transaction is in compliance with the General Data Protection Regulation (“GDPR”).

This investigation followed a formal complaint submitted in September 2018 by Johnny Ryan, chief policy officer at Brave Software Inc., a private web browser. He accused Google’s DoubleClick/Authorized Buyers system of broadcasting users’ personal data to thousands of companies, thus failing to protect the data from unauthorized access. When a person visits a website that uses the DoubleClick/Authorized Buyers system, personal data about them and what they are viewing is broadcast in a “bid request” to companies in an effort to solicit bids from potential advertisers’ for the opportunity to show an ad to this specific user. Similar complaints were submitted to other European data regulators.

“Surveillance capitalism is about to become obsolete,” Ryan stated. “The Irish data protection commission’s action signals that now – nearly one year after the GDPR was introduced – a change is coming that goes beyond just Google. We need to reform online advertising to protect privacy, and to protect advertisers and publishers from legal risk under the GDPR.”

Google has found itself in hot water in Europe before, as the European Union Competition Commission has fined the US-based company over €8-billion since 2017 for their online advertising practices (as reported in the E-TIPS® Newsletter here and here).

Summary By: Anna Troshchynsky