The ACCC is taking on Google, accusing the tech giant of misleading consumers about combining their personal data

Google has been accused of misleading consumers over the use of their data from using the internet, with consumer watchdog the Australian Competition and Consumer Commission (ACCC) launching legal action against the tech giant.

The ACCC alleges Google failed to properly inform consumers, and did not gain their explicit informed consent, about its move in 2016 to start combining personal information in their Google accounts with information about those individuals’ activities on non-Google sites that used Google technology, formerly DoubleClick technology, to display ads.

It meant that data about a users’ non-Google online activity became linked to their names and other identifying information held by Google. Previously, this information had been kept separately from users’ Google accounts, meaning the data was not linked to an individual user. The data was used for Google’s advertising businesses.

The ACCC also alleges that Google misled consumers about a related change to its privacy policy.

ACCC Chair Rod Sims said his organisation believes Google misled Australian consumers about what it planned to do with large amounts of their personal information.

“Google significantly increased the scope of information it collected about consumers on a personally identifiable basis. This included potentially very sensitive and private information about their activities on third party websites. It then used this information to serve up highly targeted advertisements without consumers’ express informed consent,” he said.

“We allege that Google did not obtain explicit consent from consumers to take this step.”

“The use of this new combined information allowed Google to increase significantly the value of its advertising products, from which it generated much higher profits.”

Sims said the ACCC considers that consumers effectively pay for Google’s services with their data, so this change introduced by Google increased the “price” of Google’s services, without them knowing.

The consumer watchdog argues that from 28 June, 2016 until at least December 2018, Google account holders were prompted to click “I agree” to a pop-up notification from Google that purported to explain how it planned to combine their data, and sought consent.

It said in part:

“We’ve introduced some optional features for your account, giving you more control over the data Google collects and how it’s used, while allowing Google to show you more relevant ads.

“More information will be available in your Google Account making it easier for you to review and control”

Google’s privacy policy before 28 June, 2016, said that it “will not combine DoubleClick cookie information with personally identifiable information unless we have your opt-in consent.”

After that date, Google replaced that phrase with “[d]epending on your account settings, your activity on other sites and apps may be associated with your personal information in order to improve Google’s services and the ads delivered by Google.”

Before June 2016, Google only collected and used, for advertising purposes, personally identifiable information about Google account users’ activities on Google-owned services and apps such as Google Search and YouTube.

But after consumers clicked on the “I agree” notification, Google began to collect and store a much wider range of personally identifiable information about online use including their use of third-party sites and apps not owned by Google. That additional data was previously stored separately from a user’s Google account.

The ACCC alleges that the “I agree” notification was misleading, because consumers could not have properly understood the changes Google was making nor how their data would be used, and so did not – and could not – give informed consent.

Sims said the ACCC believes that many consumers, “if given an informed choice, may have refused Google permission to combine and use such a wide array of their personal information for Google’s own financial benefit”.

The ACCC also singles out Google’s privacy policy saying: “[w]e will not reduce your rights under this Privacy Policy without your explicit consent” arguing the company did not obtain explicit consent for this change to the privacy policy, and that Google’s statement that it would not reduce consumers’ rights was therefore misleading.

“The ACCC alleges that Google made changes without obtaining the explicit consent it had promised consumers it would obtain before altering how it protected their private information,” Sims said.

The issue involves Google’s 2008 acquisition of ad-tech company double-click, which at the time required the approval of competition regulators around the world, including the ACCC. At the time Google said DoubleClick’s contracts with users prevented Google from combining DoubleClick’s data with its own, but that changed in June 2016 with the new terms.

On 28 June 2016, it changed its privacy policy by removing the term explaining how it would treat this DoubleClick data.

A date for the ACCC’s Federal Court action has yet to be set.