Brave browser team says Google is using hidden pages to circumvent GDPR

[nanoguy]

In brief: Google is under investigation by the Irish data regulator, which is overseeing its European business, for possible violations of GDPR. The search giant is being accused of exercising poor control or concern over protecting user data and evidence brought forward by Brave seems to confirm those allegations.

Brave is known for its privacy-focused web browser that supports native cryptocurrency wallets. Last year, it filed a GDPR complaint against Google in the UK and Ireland and decried the way the company processes user data to power its advertising business. However, Google strongly denied the accusations and the whole thing looked like it subsided after a few weeks.

This year, Brave is presenting new evidence that Google may be knowingly defying GDPR. The search giant allegedly uses a clever way to track its users while keeping the appearance that everything is in compliance with the European privacy laws. It turns out that Google is now under investigation by the Irish Data Protection Commission for possible GDPR violations as a result of Brave's complaint last year.

Brave's Chief Policy & Industry Relations Officer, Johnny Ryan gathered the evidence by using Google’s real-time bidding ad system, Authorized Buyers -- also known as DoubleClick. Google says it prevents many companies from using it to combine the profiles they receive about their visitors and that it no longer shares "pseudonymous identifiers that could help these companies more easily identify an individual."

However, Ryan discovered that Google labeled him with an identifying tracker that was then provided to many companies that logged on to a hidden web page that had no content. Instead, the page had a unique address that linked it to Ryan's browsing activity and thus allowed bidders to match their profiles of him and eventually get access to all his web browsing habits. In just one hour, the identifier was sent to at least eight ad companies.

Ryan didn't stop there and commissioned ad tech analyst Zach Edwards to try and reproduce the results. The analysis confirmed his findings and further revealed that Google may be using so-called "Push Pages" as a GDPR workaround. It turns out the search giant's secret identifiers are unique to every user and may have been shared with advertising companies to improve ad targeting.

Google is said to be cooperating with the Irish Data Protection Commission, but if it turns out the company has knowingly circumvented GDPR, it could face yet another hefty fine for its practices. The company told the Financial Times that it doesn't "serve personalized ads or send bid requests to bidders without user consent."

Permalink to story.

https://www.techspot.com/news/81746-brave-browser-team-google-using-hidden-pages-circumvent.html

 

[psycros]

They'll never, ever stop until the government takes over the web. Then we'll just be trading one set of spies for another.

 

[Uncle Al]

No surprise here!

 

[tkabou]

They'll never, ever stop until the government takes over the web. Then we'll just be trading one set of spies for another.

Indeed, the government is already owned by lobbyists and special interests. What are they going to come up with that'll sever the hand that feeds them?

There was a time government worked for the people that elected it, now it's sponsored by the taxpayer to subsidize multi-billion dollar corporations.

 

[Dosahka]

The real fine would to cease advertising in the UK for 1 month, that loss of money would be higher than just a single £300m fine.

 

[rrwards]

The real fine would to cease advertising in the UK for 1 month, that loss of money would be higher than just a single £300m fine.

Well back in March they were hit with a 1.7 billion dollar fine for breaking GDPR. My point is that it's good to know that the GDPR has some teeth, maybe Google will actually be hit with an amount to make them reconsider (though that's probably unlikely).

 

[Capaill]

The real fine would to cease advertising in the UK for 1 month, that loss of money would be higher than just a single £300m fine.

Well back in March they were hit with a 1.7 billion dollar fine for breaking GDPR. My point is that it's good to know that the GDPR has some teeth, maybe Google will actually be hit with an amount to make them reconsider (though that's probably unlikely).

Data controllers and processors face administrative fines of

the higher of €10 million or 2% of annual global turnover for infringements of articles:
8 (conditions for children’s consent),
11 (processing that doesn’t require identification),
25-39 (general obligations of processors and controllers),
42 (certification), and
43 (certification bodies)
the higher of €20 million or 4% of annual global turnover for infringements of articles:
5 (data processing principles),
6 (lawful bases for processing),
7 (conditions for consent),
9 (processing of special categories of data),
12-22 (data subjects’ rights), and
44-49 (data transfers to third countries).

 

[Dosahka]

Data controllers and processors face administrative fines of

the higher of €10 million or 2% of annual global turnover for infringements of articles:
8 (conditions for children’s consent),
11 (processing that doesn’t require identification),
25-39 (general obligations of processors and controllers),
42 (certification), and
43 (certification bodies)
the higher of €20 million or 4% of annual global turnover for infringements of articles:
5 (data processing principles),
6 (lawful bases for processing),
7 (conditions for consent),
9 (processing of special categories of data),
12-22 (data subjects’ rights), and
44-49 (data transfers to third countries).

As a senior IT person and Cybersecurity Expert, I know all of these, but thanks for the reminder! Always good to see that someone else knows these too on the internet.
My point was that they (Google) have and will develop new tools to try to circumvent these laws, simply to get more information, therefore more money and be a monopoly in certain areas. That is why I suggested to suspending some of their services rather than just fine them for money, because this is a bigger hit than pay few billions dollars fine which will make a small dent on their profit...

 

[Markoni35]

As a senior IT person and Cybersecurity Expert, I know all of these, but thanks for the reminder! Always good to see that someone else knows these too on the internet.
My point was that they (Google) have and will develop new tools to try to circumvent these laws, simply to get more information, therefore more money and be a monopoly in certain areas. That is why I suggested to suspending some of their services rather than just fine them for money, because this is a bigger hit than pay few billions dollars fine which will make a small dent on their profit...

That's a very good suggestion. Make their fees be paid in TIME, not money. Because time is the most expensive thing for a living creature, or a company. If individual criminals pay their debt to the society by serving time, so should web services too.

 

[Avro Arrow]

"The search giant is being accused of exercising poor control or concern over protecting user data and evidence brought forward by Brave seems to confirm those allegations."

I don't know what's worse, that Google is doing this or that the Eire government didn't foresee this (or something like it) happening.

Things like this are why I refuse to use any Chromium-based browser.