The ACCC has launched Federal Court proceedings against Google LLC (Google), alleging Google misled Australian consumers to obtain their consent to expand the scope of personal information that Google could collect and combine about consumers' internet activity, for use by Google, including for targeted advertising.
The ACCC alleges Google misled consumers when it failed to properly inform consumers, and did not gain their explicit informed consent, about its move in 2016 to start combining personal information in consumers' Google accounts with information about those individuals' activities on non-Google sites that used Google technology, formerly DoubleClick technology, to display ads.
This meant this data about users' non-Google online activity became linked to their names and other identifying information held by Google. Previously, this information had been kept separately from users' Google accounts, meaning the data was not linked to an individual user.
Google then used this newly combined information to improve the commercial performance of its advertising businesses.
The ACCC also alleges that Google misled consumers about a related change to its privacy policy.
"We are taking this action because we consider Google misled Australian consumers about what it planned to do with large amounts of their personal information, including internet activity on websites not connected to Google," ACCC Chair Rod Sims said.
"Google significantly increased the scope of information it collected about consumers on a personally identifiable basis. This included potentially very sensitive and private information about their activities on third party websites. It then used this information to serve up highly targeted advertisements without consumers' express informed consent," Mr Sims said.
"We allege that Google did not obtain explicit consent from consumers to take this step."
"The use of this new combined information allowed Google to increase significantly the value of its advertising products, from which it generated much higher profits."
"The ACCC considers that consumers effectively pay for Google's services with their data, so this change introduced by Google increased the "price" of Google's services, without consumers' knowledge," Mr Sims said.
"I agree" notification
The conduct is alleged to have impacted millions of Australians with Google accounts.
From 28 June 2016 until at least December 2018, Google account holders were prompted to click "I agree" to a pop-up notification from Google that purported to explain how it planned to combine their data, and sought the consumers' consent for this.
Some new features for your Google Account
We've introduced some optional features for your account, giving you more control over the data Google collects and how it's used, while allowing Google to show you more relevant ads.
The notification also stated, "More information will be available in your Google Account making it easier for you to review and control"; and "Google will use this information to make ads across the web more relevant for you."
Before June 2016, Google only collected and used, for advertising purposes, personally identifiable information about Google account users' activities on Google owned services and apps like Google Search and YouTube.
After June 2016, when consumers clicked on the "I agree" notification, Google began to collect and store a much wider range of personally identifiable information about the online activities of Google account holders, including their use of third-party sites and apps not owned by Google.
Previously, this additional data had been stored separately from a user's Google account.
Combined with the personal data stored in Google accounts, this provided Google with valuable information with which to sell even more targeted advertising, including through its Google Ad Manager and Google Marketing Platform brands.
The ACCC alleges that the "I agree" notification was misleading, because consumers could not have properly understood the changes Google was making nor how their data would be used, and so did not - and could not - give informed consent.
"We believe that many consumers, if given an informed choice, may have refused Google permission to combine and use such a wide array of their personal information for Google's own financial benefit," Mr Sims said.
Privacy policy change
Before 28 June 2016, Google stated in its privacy policy that it "will not combine DoubleClick cookie information with personally identifiable information unless we have your opt-in consent."
On 28 June 2016, Google deleted this statement and inserted the following statement: "[d]epending on your account settings, your activity on other sites and apps may be associated with your personal information in order to improve Google's services and the ads delivered by Google."
Google's privacy policy also states: "[w]e will not reduce your rights under this Privacy Policy without your explicit consent."
The ACCC alleges that Google did not in fact obtain consumers' explicit consent for this change to the privacy policy, and that Google's statement that it would not reduce consumers' rights without their explicit consent was therefore misleading.
"Google made a clear representation about how it would protect users' privacy. The ACCC alleges that Google made changes without obtaining the explicit consent it had promised consumers it would obtain before altering how it protected their private information," Mr Sims said.
DoubleClick
In 2008, Google acquired DoubleClick, a supplier of ad-serving technology services to publishers and advertisers.
Google now supplies DoubleClick's services through its Google Ad Manager and Google Marketing Platform brands, which are the leading suppliers of ad-tech intermediary services.
These services track users' internet activity on third-party sites that display ads through the use of DoubleClick's advertising technology.
Google's acquisition of DoubleClick required approval by competition authorities including the US Federal Trade Commission and the European Commission. The ACCC also reviewed and cleared this transaction.
FTC and EC cleared the acquisition, and in doing so considered submissions from Google that it would not be able to combine DoubleClick's data on consumers' internet activity with its own data about consumers' activity on Google services because, at the time, DoubleClick's contracts with its users prevented Google from doing so.
The agencies did not, however, rely on these submissions in clearing the acquisition.
Before 28 June 2016, Google collected and stored this information on a non-personally identifiable basis, as stated in its privacy policy.
On 28 June 2016, it changed its privacy policy by removing the term explaining how it would treat this DoubleClick data.
Impact of the change - hypothetical example
Mary has a Google account. She regularly uses the internet on both her desktop computer and mobile device, while logged in to her Google account.
Before 28 June 2016, if Mary used a web browser on her desktop computer to visit non-Google websites, including websites that use DoubleClick technology, such as news or shopping sites or to research a health issue, Google did not save data about these activities with Mary's Google account.
Similarly, if Mary used a non-Google app on her mobile device, for example, a fitness app, Google did not save data about this activity with her Google account.
While Google may have collected information about these activities, it stored this information separately from a user's Google account.
After 28 June 2016, if Mary clicked "I agree" on the notification described above, Google started saving information about Mary's activities on non-Google websites and apps that used Google/DoubleClick technology, with her Google account.
For example, if Mary was researching a personal health issue on her desktop computer and visited a health website that uses Google technology to display ads, Google would have saved data about this activity with Mary's Google account.
Similarly, if Mary used a fitness app on her mobile device that used Google technology to display ads, Google would have saved data about this activity with Mary's Google account.
Google uses information that is stored with a consumer's Google account to show them targeted ads.
Images
Depending on the device and Google service being used by the consumer, the notification published by Google from 28 June 2016 was presented in a variety of ways. A copy of the notification in the form published to consumers using desktop devices is provided below for reference.
Source: Provided to the ACCC by Google Australia Pty Ltd
The relevant changes to Google's Privacy Policy made on 28 June 2016 are also shown below for reference:
Source: Accessed from https://policies.google.com/privacy/archive?hl=en-US on 24 June 2020
Background
Google LLC (Google) is a multinational company incorporated in the United States with its headquarters in Mountain View, California. It is a subsidiary of Alphabet Inc.
Google supplies a range of services to consumers in Australia including Google Search, Google Maps, Gmail, YouTube, Google Play and Google Chrome.
Google also provides advertising services and analytics services to individuals and businesses. Advertising services are provided on Google services, such as Google Search, Google Maps and YouTube, as well as on websites and mobile device based applications not published or controlled by Google that partner with Google to display advertisements.
Google derives the majority of its revenue from its advertising and analytics services.
Note: The concise statement has not been attached as it has been filed on a confidential basis pending claims by Google.
