Privacy activist Max Schrems claims Google Advertising ID on Android is unlawful, files complaint in France
- Reference: 1617793993
- News link: https://www.theregister.co.uk/2021/04/07/max_schrems_google_complaint/
- Source link:
Last November the European group filed a complaint to the German and Spanish data protection authorities concerning Apple's IDFA (Identifier for Advertisers) on iPhones, claiming it was equivalent to a tracking cookie being placed by a website without the user's consent, which is against the EU's e-Privacy law.
[1]
The group is now taking similar action against Google, with a complaint filed with France's data protection authority. In the [2]complaint [PDF], noyb claimed the Android Advertising ID (AAID) "is simply a tracking ID in a mobile phone instead of a tracking ID in a browser cookie," and therefore both the storage of the AAID and its access are illegal because this "should be authorized by the user through prior consent."
Privacy Shield binned after EU court rules transatlantic data protection arrangements 'inadequate' [3]READ MORE
[4]
The complaint has been filed by a private individual whose name is redacted, referred to as "the complainant." According to the document, "the complainant was never requested such consent, neither during the first setup of the system, nor at a later stage."
The document also notes the widespread use of the AAID for functions including identifying a specific device or application, personalising advertising, and customer-matching across IDFA and AAID.
The document requests that the French authority investigates the matter, orders Google to bring its data processing into conformance with privacy law, and imposes a fine. According to noyb, CNIL (Commission Nationale de l'Informatique et des Libertés) [5]can take action "without the need for cooperation with other EU Data Protection Authorities."
This is the second complaint against Google filed by the pressure group. An [6]earlier complaint filed in Austria includes the observation that the AAID cannot be deleted, only reset, and that resetting the AAID does not delete previously collected data nor prevent further data from being collected.
[7]
The work of Schrems has had a powerful impact in the past. His action complaining about Facebook data being transferred to the US [8]resulted in the invalidation of the the EU-US Privacy Shield agreement. ®
Get our [9]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YG3XKChWoyiOw3G2t8ve9gAAABQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://noyb.eu/sites/default/files/2021-04/AAIDcomplaint_Redacted.pdf
[3] https://www.theregister.com/2020/07/16/privacy_shield_struck_down/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YG3XKChWoyiOw3G2t8ve9gAAABQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://noyb.eu/en/buy-phone-get-tracker-unauthorized-tracking-code-illegally-installed-android-phones
[6] https://www.theregister.com/2020/05/13/google_android_gdpr_complaint/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/legal&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YG3XKChWoyiOw3G2t8ve9gAAABQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2020/07/16/privacy_shield_struck_down/
[9] https://whitepapers.theregister.com/
Kudos to him
That is all.
That's what you get when software has to cost nothing
Without a real market for paid software, all the software you get is create by other business needs. Android is a perfect example. It does exist only to sustain Google's ads business. And because Google can give it away for free, there's no market for a paid mobile OS that could sustain its development through sales. Only Apple is able to compete because it has a fashion devices division plus the store and ads revenues.
Probably the only solution is to regulate strongly the ads business forbidding it to use the money to subsidize other products which are obviously developed to feed the main ads business itself from the gronud up. But people would complain because they would only see the need to pay for software while not being able to see the hidden costs of privacy invasion to sustain an invasive ads business model.
Re: That's what you get when software has to cost nothing
The Linux kernel is free (in both senses) as are most distributions. Not to mention all the significant web servers bar IIS. (Using IIS is a clue that the empty suits are making technical decisions in my opinion.)
There are other funding models than stalking.
Re: That's what you get when software has to cost nothing
For server-side software, probably. Google itself needs a server operating system it doesn't have to pay for, and of course, web servers. That's also true for Facebook, IBM, and others. Funding a common kernel is less expensive than having to develop it.
The problem is for client-side software. Even with Linux the good product is the kernel and some server applications. The desktop part is the worse one, as its desktop applications.That's why even if free it went almost nowhere as a desktop operating system. If no real money can be made almost everybody is not interested.
Android took the LInux kernel and had to design and add the whole GUI part and basic applications for a mobile phone, and that's expensive to develop. Nobody is going to invest money in another mobile OS, even if the kernel is there for free.
See how even Microsoft took a lot of time trying to develop a different mobile OS and eventually failed because it wasn't enough to have user and developers switch.
Re: That's what you get when software has to cost nothing
Microsoft had a mobile offering long before the Linux based apple and Android offerings, it failed to make much progress because it was slow and bulky requiring expensive processors and memory that swallowed battery power. Symbian was there at the very beginning, a development of epoc32 it was very good for phones as it had a number of features specifically to help it for low powered low memory battery devices. The Linux kernel was not developed for this and frankly doesn't work well.
Why did the android and apple systems get started? One has to suspect government involvement, the USaA now has an excellent way of spying on us all. Why did they make progress? I suspect again the USA government leaned on allies to get media promotion of it, they leaned on allies to hide the reasons. Of course Nokia was complicit in this, hiring an oaf with zero brains but the gift of the gab to act as CEO and to destroy the symbian OS even though it was making Nokia a shed load of money. Shareholders cocked up and didn't remove him, the lie was told, the damage done and not undone. Nokia is history, the only operating system not loaded with American spyware has gone by the board and the brainless gormless morons who don't understand that the world and freedom went to hell in a handcart 40 years back are still too stupid and I'll educated to think further than the next sexual adventure of their favourite film star.
Re: That's what you get when software has to cost nothing
"The desktop part is the worse one, as its desktop applications."
Tell, what I am missing out at? Because I live under the illusion that I am missing nothing.
Re: That's what you get when software has to cost nothing
From my point of view, I have to buy a phone that needs an OS, if the phone comes with an OS, as far as I am concerned I have paid for the OS at the same time I bought the phone.
I have little choice so from my point of view the OS is not free, the phone maker may not pay Google directly for it but the cost of it being loaded to the phone is also built into the phone price. So again, it is not free for me and I don't see that Google or anyone else has the right to invade my privacy.
"From my point of view"
From yours, but not the device makers. They face the choice of writing their own mobile OS ($$$$$$$$$$), buy one ($$$) or use Google's "free" one ($0). With very thin margin, the choice is obvious. You're just paying the device, not the software.
Of course Google has no right to invade your privacy, but the problem is Google makes it free exaclty because it wants to invade your privacy. And this way it also undercuts any other attempt to develop a competitor mobile OS - unless someone with enough cash from another business attempts the same - but as no one is a charity, even that OS would come with its poisoned pill.
Re: "From my point of view"
Symbian cost very little and didn't have such baggage. Further you could run with less memory, a cheaper processor and smaller battery while maintaining better user performance.
Re: That's what you get when software has to cost nothing
Errr. Nice try but no.
How do you explain almost the exact same feature in iOS?
To be clear all your points are valid on their own merits but conflating them with free software is dubious at best.
"How do you explain almost the exact same feature in iOS?"
Apple is not silly, it does make money collecting data and selling ads placements to advertisers as well and not leave that business to others (see its "privacy" new rules...." all your data are belong to us and only us"), just it's not its main business, and even if it makes less money than Google from ads it has so large profits it can still invest in OS development.
But Apple is the only phone manufacturer with real high margins from its device sales. If Apple started to sell iOS, I don't think manufacturer would buy it over the free Android - but maybe for very high-end devices with high margins.
Apple could probably remove its ID and survive, Google won't spend money in Android without getting data back. Yet Android became the dominant mobile OS because it's free, and nobody really want to invest to build a different OS when margins are very low. But Huawei, of course, but just because forced to. Just look at where they are, though - while still able to start from what of Android is open source. Only Microsoft had the resources to attempt it, but utterly failed - and still it had its Ads ID as well, too tempting...
Re: "How do you explain almost the exact same feature in iOS?"
I think you have to look no further than both are USA companies and the USA is the biggest, basest,dirtiest, sneakiest spy outfit the world has ever seen. Snowdon showed a small tip of a huge berg and has been silenced.
@LDS - Re: "How do you explain almost the exact same feature in iOS?"
Correction: Microsoft still has advertizing ID in Windows 10. You can disallow applications to use it for targeting advertizing. For now.
Re: That's what you get when software has to cost nothing
It's not about the software costing nothing, it's about the true price of using the software (eg. surrender of one's privacy) being intentionally hidden from the customer.
If eg. phone purchasers were offered a choice:
a) Have all your usage, location, purchase history, sexual preferences, etc. tracked 24/7 and stored indefinitely.
or
b) Pay $10 extra
We may see a market for paid mobile OSes start to develop.
"We may see a market for paid mobile OSes start to develop."
Are you sure? And you wrote $10 - which may be not the price. If it was $49? $99? $199? There are people who download and install cracked software from unknown sources to save that, with a great risk to be p0wned and give miscreants far more personal data and money.
Probably like once people complained about PCs with Windows preinstalled it's time to complain about phones with Android pre-installed (and much harder to remove than Windows...) and let people choose from different OSes. But just like people choose Windows because Linux (desktop) has no enough applications people are used to, most people would install Android anyway.
Re: "We may see a market for paid mobile OSes start to develop."
Symbian was only 10 dollar in small quantity, any decent numbers and it was cheaper, s the phone companies jointly owned it then it actually cost them all less than the ticket price. More over as it required less processor, battery and memory to deliver the same speed or better of user experience it made a cheaper phone possible.
Re: That's what you get when software has to cost nothing
There is a market for paid software because their is a market for the devices. The software is part of the BOM, the cost of porting is not insignificant but is also divided over the production as part of the BOM. The truth is the USA wants to spy on people and Google/apple are their tools. This is why they got upset by a Chinese firm on the infrastructure because it would have made spying difficult. The EU and UK both bend us over and bare our collective arses for the USA which probably goes part way to how the backhanders are allowed to work so well in terms of media publicity in favour of this spyware
Re: That's what you get when software has to cost nothing
Android is free but the Google platform that goes along isn't, manufacturers need to buy a licence from Google to install Gmail, Google Maps and the Google Play store - collectively called Google Mobile Services - so Google is already getting their [1]money from users/customers. Every additional penny is just a bonus.
[1] https://www.theverge.com/2018/10/19/17999366/google-eu-android-licensing-terms
While we're here...
" the complainant was never requested such consent, neither during the first setup of the system, nor at a later stage "
Can we also smack on the head the idea of degraded functionality if the user refuses permission?
My work committee has set up a fancy new website using [1]AdvanGO . When you try to sign up, it offers the usual options to opt out (note, not opt in) to lots of tracking. So a sensible person unticks all of this. To then find that the site refuses to progress without having all this crap ticked, with the message "Merci d'accepter les cookies afin d'accéder au formulaire d'inscription". That pretty much makes giving the consent option utterly meaningless theatre.
[1] https://www.advango.fr/
Re: While we're here...
That practice is already illegal under GDPR. You might want to point that out to your employer.
Re: While we're here...
Yes, there's also the issue you can do very little until you create a Google account (and maybe one with the phone maker too....). And all of them makes very difficult if not impossible to backup and sync data locally and not with their motherships.
Re: While we're here...
" Can we also smack on the head the idea of degraded functionality if the user refuses permission "
It was smacked on the head ages ago. Document 17/EN WP259 of the Article 29 Data Protection Working Party entitled Guidelines on Consent under Regulation 2016/679 (Adopted on 28 November 2017) includes the following:
3.1.4. Detriment
The controller needs to demonstrate that it is possible to refuse or withdraw consent without detriment (recital 42). For example, the controller needs to prove that withdrawing consent does not lead to any costs for the data subject and thus no clear disadvantage for those withdrawing consent.
[...]
If a controller is able to show that a service includes the possibility to withdraw consent without any negative consequences e.g. without the performance of the service being downgraded to the detriment of the user, this may serve to show that the consent was given freely.
Note the "may serve" - this is a minimum requirement. The problem is simply that nobody is taking any notice, mainly because the prospect of any significant penalty is vanishingly small.
Re: While we're here...
Yes, not the only website. Banners covering half the screen with no way to opt out or on one site a list of 1000 or more boxes and switches are taking the piss. The BBC itself is just as damned bad, you can't say no to their cookies, you can see their policy but can't say no! Thus is not what the EU can have meant. I think it is time for the EU to run a site where you can reply these things, when you do the owner of the site should face billion dollar dines and multi year jail sentences.
Re: While we're here...
And that is what people like TrustArc and EnTrust and all the other US shysters who run these screens on behalf of companies (and the ad industry) bank on... the fact that you *don't* want to untick or tap tens or hundreds of boxes/sliders and just accept already... and that they can point the EU Data Commissioner at it saying "well, they agreed to it, look!"
There's the 'legitimate purpose' thing that many companies use for tracking too. You have to click on 'Object' or 'Object to all' to stop the tracking, only for them to try it again next time.
Re: While we're here...
That goes counter to the GDPR. I suggest you have your genius lawyers look at it again. If there is one item that is required, then mark it as required and not unselectable, everything else that's optional is... optional.
However...
Almost all the enforcement activity relating to data subject rights (as opposed to "data breaches") seems to be focused on the behemoth corporations, which frankly don't give one hoot (let alone two) about it as they can outspend any challenger and carry on pretty much regardless. When [1]we researched compliance with the GDPR across a wide range of verticals and organisation scales, we found that practically no organisation is complying with the requirements relating to even the most basic data subject rights, so the problem is vastly more serious than suggested by a few highly publicised slaps on the wrist to the giant antisocial networks and the like. Let's not forget that, despite the good intents and the razzmatazz surrounding the cases, so far every penalty awarded to these behemoths has been negotiated down to coffee money on appeal. What's needed is generalised corporate culture change, and that will only happen via assured high probability of getting caught regardless of organisation scale.
[1] http://businessinforisk.co.uk/library/Awful_not_Lawful-final-BiR.pdf
Worth noting
While the anti British BBC shamelessly promoted iPhone even telling fat lies about it being the first smartphone and the great celebrations on Android that Europe had its own smartphone operating system. This was symbian. It did not collect or share (as it had not collected) tracking information for anyone. It ran for more than a week without charge (still does on my old phones). It provided a series of classes (it was c++) for handling strings which did not overflow, it had a system for handling the inevitable issues with out of memory. It also managed it's 'disc' writes in such a way you couldn't lose your whole phone due to a power issue at 'the wrong time' (something my crappy android has done twice now resulting in total factory start and days sorting out multifactor passwords and other accounts.
Shame the unwashed illiterate masses don't have a clue so are led by marketing lies and Medi interest driven by the inevitable back handers
Re: Worth noting
the great celebrations on Android that Europe had its own smartphone operating system. This was symbian.
Cannot parse. It could make sense if "on Android" were deleted.
Has this man no shame?
Thanks to him the share prices of many major tech firms could be down and, worse still, executives may face the horrors of a reduced bonus.
Has he no idea what havoc he may be wreaking?