Google Faces Allegations of Deceiving Users to Harvest Data for Advertising Purposes

The Italian authority overseeing competition and consumer rights has initiated an inquiry into Google’s practices of obtaining user consent for intertwining their activities across various services for the purpose of advertising profiling. The inquiry raises concerns regarding possible “unfair commercial practices” by the advertising technology leader.

The investigation centers on the methods by which Google secures consent from European Union users to correlate their activities on different Google services such as Google Search, YouTube, Chrome, and Maps. This amalgamation of user activities facilitates targeted advertising, forming the backbone of Google’s revenue system.

A spokesperson for Google, speaking to TechCrunch, stated in light of the AGCM’s investigation, “We are currently examining the specifics of this situation and will engage cohesively with the authorities in charge.”

Since the early days of March, Google has found itself governed by the EU’s Digital Markets Act (DMA), a competitive regulation framework applicable throughout the EU, including Italy. Google, along with several other major players such as Meta, X, Amazon, ByteDance, and Microsoft, has been labeled as an “internet gatekeeper,” holding significant influence over diverse major digital platforms.

The DMA’s role becomes pertinent in this case as it enforces specific consent requirements for gatekeepers regarding the processing of personal data for advertising, or merging data collected from their myriad of services. This probe by the AGCM is particularly concentrating on the latter.

The AGCM mentioned in a press statement that Google’s consent mechanism could potentially “constitute a misleading and aggressive marketing strategy.” This is primarily because it seems to be coupled with “inadequate, incomplete, and potentially misleading information,” possibly swaying users’ consent decisions.

Typically, the European Commission oversees the enforcement against gatekeepers; however, this anomaly in regulatory actions underlines the Italian authority’s proactive approach towards addressing gaps left by the Commission, particularly regarding Google’s consent acquisition for data linking. This also reflects on broader EU and member state efforts aiming at harmonizing competition enforcement without redundancy.

A Commission spokesperson acknowledged the AGCM’s probe, highlighting its complementary role to the DMA’s objectives and underscoring the need for gatekeepers to adhere to broader EU and national consumer protection and data privacy statutes.

Examining the Mechanics of Google’s Consent Requests

The AGCM expresses concerns that Google’s consent requests may not furnish users with sufficient information for making an educated and voluntary decision. It suggests that when Google does provide information, it’s often done so in a manner that’s both inadequate and vague, with a particular lack of transparency about the implications of account linking.

Moreover, doubts are cast on the breadth of information shared by Google, particularly on how users’ data may be mixed and utilized across its vast service spectrum, and whether users can limit their consent to particular services only.

As per the DMA, any consent obtained for linking accounts for advertising has to be in compliance with the GDPR, which demands consent be “freely given, specific, informed, and unambiguous.”

Furthermore, GDPR requires that consent mechanisms through written online statements be distinctly separate from other matters, easily understandable, and crafted in straightforward language.

While GDPR enforcement typically falls within the remit of data protection agencies, the incorporation of GDPR consent standards within the DMA has led the Italian competition and consumer watchdog to closely examine the consent processes adopted by Google.

In addition to the concerns over the clarity and completeness of information provided by Google, the AGCM is also questioning the methodology applied by Google in seeking consent. This indicates potential issues with the “techniques and methods” used in consent solicitation, possibly pressuring users into making consent decisions they wouldn’t otherwise make.

This scrutiny comes against a backdrop of growing regulation against manipulative design practices, or “dark patterns,” which mislead users into making unintended choices. With the DMA referencing GDPR consent standards and the Digital Services Act outright banning deceptive designs, Europe is making strides towards ensuring consumer services adhere to more ethical digital practices.

The report includes recent inputs from the Commission.