Imran Rahman-Jones
Technology reporter
Privacy campaigners have called Google’s new rules on tracking people online “a blatant disregard for user privacy.”
Changes which come in on Sunday permit so-called “fingerprinting”, which allows online advertisers to collect more data about users including their IP addresses and information about their devices.
Google says this data is already widely used by other companies, and it continues to encourage responsible data use.
However the company had previously come out strongly against this kind of data collection, saying in a 2019 blog that fingerprinting “subverts user choice and is wrong.”
But in a post announcing the new rule changes, Google said the way people used the internet – such as devices like smart TVs and consoles – meant it was harder to target ads to users using conventional data collection, which users control with cookie consent.
It also says more privacy options provide safety to users.
Google told the BBC in a statement: “Privacy-enhancing technologies offer new ways for our partners to succeed on emerging platforms… without compromising on user privacy.”
But opponents to the change say fingerprinting and IP address collection are a blow to privacy because it is harder for users to control what data is collected about them.
“By allowing fingerprinting, Google has given itself – and the advertising industry it dominates – permission to use a form of tracking that people can’t do much to stop,” said Martin Thomson, distinguished engineer at Mozilla, a rival to Google.
Fingerprinting collects information about a person’s device and browser and puts it together to create a profile of that person.
The information is not explicitly collected in order to advertise to people, but it can be used to target specific ads based on that user’s data.
For example, a person’s screen size or language settings are legitimately needed in order to display a website properly.
But when that is combined with their time zone, browser type, battery level – and many other data points – it can create a unique combination of settings which makes it easier to work out who is using a web service.
These details along with someone’s IP address – the unique identifier used by internet devices – were previously prohibited by Google for ad targeting.
Privacy campaigners say that unlike cookies, which are small files stored on a local device, users have little control over whether they send fingerprinting information to advertisers.
“By explicitly allowing a tracking technique that they previously described as incompatible with user control, Google highlights its ongoing prioritisation of profits over privacy,” said Lena Cohen, staff technologist at the Electronic Frontier Foundation.
“The same tracking techniques that Google claims are essential for online advertising also expose individuals’ sensitive information to data brokers, surveillance companies, and law enforcement,” she added.
“My argument would be that fingerprinting sits in a little bit of a grey area,” says Pete Wallace, from advertising technology company GumGum.
“Should people feel comfortable staying in a grey area of privacy? I’d say no,” he adds.
GumGum, which has worked with the BBC on ad campaigns before, relies on something called contextual advertising, which uses other data points to target adverts to online users, such as keywords on the website they are on – rather than their personal data.
Mr Wallace says allowing fingerprinting represents a shift in the industry.
“Fingerprinting feels like it’s taking a much more business-centric approach to the use of consumer data rather than a consumer-centric approach,” he says.
“This sort of flip-flopping is, in my opinion, detrimental to that route that the industry seemed to be taking towards this idea of really putting consumer privacy at the forefront.”
He adds that he hopes ad tech companies conclude “that it isn’t the appropriate way to use consumer data,” but expects them to look at fingerprinting as an option in order to better target adverts.
Advertising is the lifeblood of the internet business model, and allow many websites to be freely available to users without them having to directly pay to access them.
But in return, users often have to give up private information about themselves so that advertisers can show them relevant adverts.
The UK’s data watchdog, the Information Commissioner’s Office (ICO), says “fingerprinting is not a fair means of tracking users online because it is likely to reduce people’s choice and control over how their information is collected.”
In a blog post in December, the ICO’s Executive Director of Regulatory Risk Stephen Almond wrote: “We think this change is irresponsible.”
He added that advertisers and businesses which decide to use this technology will have to demonstrate how they are staying within data and privacy laws in the UK.
“Based on our understanding of how fingerprinting techniques are currently used for advertising this is a high bar to meet,” he wrote.
Google said in a statement: “We look forward to further discussions with the ICO about this policy change.
“We know that data signals like IP addresses are already commonly used by others in the industry today, and Google has been using IP responsibly to fight fraud for years.”
A spokesperson added: “We continue to give users choice whether to receive personalised ads, and will work across the industry to encourage responsible data use.”
