Storm erupts over new Google advertising tracking tool

Google has found itself engulfed in yet another data privacy storm following the tech giant’s decision to launch a new tool that allows online advertisers to collect data about users’ hardware and software – and which is virtually impossible for consumers to delete.

So called “fingerprinting” creates a unique digital ID for a user’s device while tracking data such as IP addresses, browser versions, operating systems, screen resolutions, installed fonts, and even behavioural data.

Unlike cookies, which are stored on individual browsers and can be managed by users, a device “fingerprint” is generated dynamically from signals that are much harder to clear or block.

Google, which had previously branded the technique “wrong”, flagged up this month’s launch back in December.

In a new blog post it claims the launch was in response to the fact advertisers were finding it difficult to deliver targeted ads because people now browse the Internet using a range of devices, such as game consoles and smart TVs.

Google stated: “Privacy-enhancing technologies offer new ways for our partners to succeed on emerging platforms… without compromising user privacy.

“We continue to require advertisers and publishers to be fully transparent with users about the data they collect and how it is used.

“Policies need to meet the speed of technological advancements, with privacy at the core. With this update, we can help businesses, large and small, meet the opportunities of the evolving digital landscape, while meeting user expectations for privacy.”

However, the UK Information Commissioner’s Office has already slammed the move as “irresponsible”.

Executive director of regulatory risk Stephen Almond said: “Businesses do not have free rein to use fingerprinting as they please. Like all advertising technology, it must be lawfully and transparently deployed – and if it is not, the ICO will act.

“The ICO’s view is that fingerprinting is not a fair means of tracking users online because it is likely to reduce people’s choice and control over how their information is collected. The change to Google’s policy means that fingerprinting could now replace the functions of third-party cookies.

“We think this change is irresponsible. Google itself has previously said that fingerprinting does not meet users’ expectations for privacy, as users cannot easily consent to it as they would cookies. This in turn means they cannot control how their information is collected.

“Businesses should not consider fingerprinting a simple solution to the loss of third-party cookies and other cross-site tracking signals.”

Meanwhile, Lena Cohen, from privacy group the Electronic Frontier Foundation, said: “By explicitly allowing a tracking technique that they previously described as incompatible with user control, Google highlights its ongoing prioritisation of profits over privacy.

“The same tracking techniques that Google claims are essential for online advertising also expose individuals’ sensitive information to data brokers, surveillance companies, and law enforcement.”

Speaking to the BBC, Martin Thomson, an engineer at Google rival Mozilla, said that fingerprinting will give the advertising industry “permission to use a form of tracking that people can’t do much to stop”.

In response, Google commented: “We look forward to further discussions with the ICO about this policy change.

“We know that data signals like IP addresses are already commonly used by others in the industry today, and Google has been using IP responsibly to fight fraud for years.”