Stop tracking me, Google: Austrian citizen files GDPR legal complaint over Android Advertising ID
- Reference: 1589393710
- News link: https://www.theregister.co.uk/2020/05/13/google_android_gdpr_complaint/
- Source link:
Based in Vienna, Austria, Noyb is a nonprofit founded by [1]Max Schrems , a lawyer and privacy advocate, to focus on "commercial privacy and data protection violations". It [2]says that "the core task of the office is to work on our enforcement projects and to engage in the necessary research for strategic litigation."
The complaint against Google, which was filed with the Austrian Data Protection Authority, is based on the claim that Google's Android operating system generates the advertising ID without user choice as required by GDPR. "In essence, you buy a new Android phone, but by adding a tracking ID they ship you a tracking device," [3]said Noyb lawyer Stefano Rossetti.
[4]According to Google : "The advertising ID is a unique, user-resettable ID for advertising, provided by Google Play services. It gives users better controls and provides developers with a simple, standard system to continue to monetize their apps. It enables users to reset their identifier or opt out of personalized ads (formerly known as interest-based ads) within Google Play apps." The opt-out is in Google settings but when you do opt out, it does not delete the advertising ID.
It appears that the effectiveness of the opt-out is in part down to app developers. "The status of the 'Opt out of Interest-based Advertising' or 'Opt out of Ads Personalization' setting must be verified on each access of the ID," Google's [5]documentation states.
There is an option to reset the ID, but when you do so you get a new one, so this will only be effective long-term if you do it repeatedly. "It is like cancelling a contract only under the condition that you sign a new one," said Rossetti.
[6]
The settings for the Google advertising ID on an Android mobile
The complaint can be viewed [7]here [PDF] and raises key questions about privacy, choice, and tracking. It states that the complainant (the name is redacted) completed a Google contact form to withdraw consent to use of the advertising ID (if consent had been given, which is disputed), and to object to its processing. Article 7 of the GDPR states that "the data subject shall have the right to withdraw his or her consent at any time." Article 21 is a "right to object at any time to processing of personal data concerning him or her" for marketing and profiling, following which the law states that "the personal data shall no longer be processed for such purposes."
The complaint says that there is no opt-in "consent button" for the advertising ID. Although users have to agree to the general Google privacy policy, according to the complaint this consent "was neither informed, specific (the data subject has to agree to all Google services in a single step), nor free (the user cannot use a €800 phone without agreeing)."
Google responded to the request by stating that "in the case of non-account holders, Google does not have the means to verify the identity of data subjects from an Advertising ID and therefore, we cannot take specific action on the basis of the content contained in your email" and that "you may immediately cease the processing of personal data related to your Advertising ID by resetting your Advertising ID."
However, the GDPR states in Article 12 that "the controller shall not refuse to act... unless the controller demonstrates that it is not in a position to identify the data subject." The complaint claims that "no technical or logical argument was provided, as to why the identification of the Complainant was not possible."
Apple, notes the complaint, has a similar advertising ID in iOS but [8]explains that this can be "replaced with a non-unique value of all zeros to prevent the serving of targeted ads".
The complaint requests that Google is ordered to "permanently delete the advertising ID", provide access to the data collected, and be fined based on various GDPR breaches.
According to Noyb, the complaint was partially based on the Norwegian Consumer Council's investigation called [9]Out of control . This report claimed it could demonstrate "how every time we use our phones, a large number of shadowy entities that are virtually unknown to consumers are receiving personal data about our interests, habits, and behaviour."
The UK's Information Commissioner's Office has [10]said that it has "significant concerns about the lawfulness of the processing of special category data which we've seen in the industry, and the lack of explicit consent for that processing".
However, the watchdog recently [11]stated that it had decided "to pause our investigation into real-time bidding and the adtech industry" because of COVID-19. It said that "concerns about adtech remain and we aim to restart our work in the coming months, when the time is right" – news which was not well received by privacy advocates. ®
Sponsored: [12]Choosing A Low-Code Vendor
[1] https://search.theregister.co.uk/?q=Max+Schrems
[2] https://noyb.eu/en/our-team-members-and-partners
[3] https://noyb.eu/en/complaint-filed-against-google-tracking-id
[4] https://support.google.com/googleplay/android-developer/answer/6048248?hl=en
[5] https://play.google.com/about/monetization-ads/ads/#!?zippy_activeEl=ad-id#ad-id
[6] https://regmedia.co.uk/2020/05/13/advertisingid.png
[7] https://noyb.eu/sites/default/files/2020-05/complaint_aaid_redacted.pdf
[8] https://support.apple.com/en-us/HT205223
[9] https://www.forbrukerradet.no/undersokelse/no-undersokelsekategori/report-out-of-control/
[10] https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/12/adtech-and-the-data-protection-debate-where-next/
[11] https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2020/05/ico-statement-on-adtech-work/
[12] https://go.theregister.co.uk/tl/1936/-8579/choosing-a-low-code-vendor?td=wptl1936
It will fix nothing
You can reset the Advertising ID every time you turn the phone on but the phone is full of cookies tracking you without the Advertising ID. Users are just sheep feeding the advertising companies.
Re: It will fix nothing
Obviously you do not seem to think that the PhD candidate who took down the EU's "safe harbour" instrument, dragged the EU through the CJEU and forced it to change a number of its laws, and slapped Facebook's arse in Ireland, might actually know what he's doing.
In all honesty, governments need to decide if targeted advertising is legal or not
All of this grey area crap is just vacilliating around the real question. Should you be able to gather data for people for the purposes of monetising them.
If the answer is yes, then accept that it means companies hold data on all individuals if they use devices or services offered by those companies, if not, then we've got to be prepared to pay monthly for phones, email, websites etc.
"In all honesty, governments need to decide if targeted advertising is legal or not"
In all honesty, governments can have access to the data, if they decide they need it, so governments have a source of tracking info that costs them nothing and is managed for them by somebody else who likely does a better job of it than most governments will.
Don't expect laws against it any time soon by a government near you.
Is that not his point? He paid for a £800 smartphone, that he cannot use without agreeing to 3rd party adtech companies profiling his entire life.
Granted you could make a different argument regarding users of a "free" service.
In all honesty
In all honesty, everything you said is wrong.
"governments need to decide if targeted advertising is legal or not [...] All of this grey area crap is just vacilliating around the real question. Should you be able to gather data for people for the purposes of monetising them."
There is a grey area, and it's important. Gathering information about what someone does on your platform so you can make recommendations to them on that platform usually doesn't draw much ire. For example, I don't care if Amazon records a history of things I buy and uses it to suggest products while I'm logged into the same account. The problems occur when that data is released or when collection isn't obvious. I'm not happy for Amazon to start selling that information to others, nor am I happy for Amazon to collect information about my browsing elsewhere or when I'm not logged into an account with them. It's a control thing. If Amazon only collects things I do on their platform and connects it to the logged-in account, then I can stop them doing that by not using their platform or anonymize it by using multiple accounts. If they do other things, I have no certainty about what is happening and certainly no control over any of it.
"If the answer is yes, then accept that it means companies hold data on all individuals if they use devices or services offered by those companies"
So if the answer to a very generalized question is yes, we basically give up on all controls? Because a lot of the question isn't about something that clean cut. A lot of the concern is about what the companies do with the data, how they collect it, and how much information and control the consumer has. These are the important questions, but you fail to mention them at all.
"if not, then we've got to be prepared to pay monthly for phones, email, websites etc."
Wrong. We pay for phones. It's called the purchase price and it's quite high. The software comes on those phones, just like there's firmware on your microwave. You don't decide you have to pay a subscription for your microwave, nor would you accept it monetizing you. The same applies to phones. While removal of some of the profitable ways to monetize users might mean more sites have to switch to a subscription model, it isn't guaranteed. Advertising wouldn't be made illegal--advertising tailored to the content or of a general nature is fine. Collecting information in an open and transparent way about what is collected, how, and what is done with it likewise would work. What you're serving us is a false dichotomy, and a very popular one among people who violate our privacy. You're telling us that having our data strip-mined is necessary to an internet of free services. Well, that's not true for all free services, it may prove false for many others about which we have no information, and for those that are left, we might be willing to pay that price.
Google are so full of it
"in the case of non-account holders, Google does not have the means to verify the identity of data subjects from an Advertising ID" - so they do have the means for 99.9999999% of Android users.
"you may immediately cease the processing of personal data related to your Advertising ID by resetting your Advertising ID." - and then immediately start the processing of personal data with the new advertising ID generated immediately afterwards.
Re: Google are so full of it
'"in the case of non-account holders, Google does not have the means to verify the identity of data subjects from an Advertising ID" - so they do have the means for 99.9999999% of Android users.'
I agree that Google probably can identify people, but that's not what they said.
Legal statements are risky. No matter what you say, someone will try to use it against you; the less you say, the better. Google gave a very narrow answer, no doubt choosing their least-unfavorable case and hoping to limit the conversation. If their answer were less narrow, maybe they would have to admit something, but it wasn't.
Re: Google are so full of it
It does not need to verify any identity whatsoever. It has the AdvertisingID, and a request to stop. It stops, and that's it.
This "verify identity" bullshit is just to protect its revenue stream. It is not required for the user, it does not bring any essential service to the user, and the right thing to do would be to say : "Okay, we have stopped collecting data on that ID. If you wish to resume, you may reset your AdvertisingID".
But that would cut into its bottom line, so fuck the user, we keep collecting.
Once again Max Schrems is putting his finger on the point that hurts. I sincerely hope he wins this case.
From my own investigations.....
I run this on startup:
# When the Google ad is changed, the following files are changed:
#
# /data/data/com.google.android.gms/shared_prefs/adid_settings.xml
# /data/data/com.android.vending/shared_prefs/finsky.xml
#
# The following 2 fields in finsky.xml are changed:
#
#
#
#
# Where:
# x - Represents the new ad id
# S - Represents the epoch timestamp date in seconds when the ad-id was changed.
# s - Represents the epoch timestamp date milliseconds when the ad-id was changed.
#
rm -fv /data/data/com.google.android.gms/shared_prefs/adid_settings.xml
Re: From my own investigations.....
I use Brave.
No ads on Brave. No need to worry about settings.
ICO (...) pause our investigation because of COVID-19
yeah, covid19 ate my homework, cause this only became apparent to ICO, in March/April 2020. They are f... useless.