Watchdog reveals lingering Google Privacy Sandbox worries
- Reference: 1714385714
- News link: https://www.theregister.co.uk/2024/04/29/uk_cma_google/
- Source link:
Google for the past few years has been trying to reinvent the software that delivers targeted ads online because the legacy approach, which relies on files called cookies that get used for ad tracking and measurement, denies privacy.
The Chocolate Factory refers to its suite of advertising application programming interfaces (APIs) as the [1]Privacy Sandbox , though regulators and privacy advocates continue to raise doubts that the software lives up to its name.
[2]
Ad industry rivals, not so much concerned about the privacy aspect of the whole affair, worry that Google's reimagined tech stack will put them at a competitive disadvantage by denying them the data they use to make their ads more effective.
[3]
[4]
Last year, Google started rolling out early versions of specific Privacy Sandbox APIs, like the [5]Topics API , in its Chrome browser, in order to test the technology. The ad targeting tech has since been made available [6]for Android applications .
The Topics API allows ads to be targeted at users of Chrome, Edge (soon), and Android devices based on interests conveyed through online interactions. The API uses an on-device classifier model to generate a list of interests inferred from browsing activity, based on a publicly accessible taxonomy that presently includes [7]469 topics like "Arts & Entertainment."
[8]
The API each week determines – locally instead of over a network – a person's top five topics, based on visited sites that implement the Topics API. The website publishers and third-party ad providers on sites supporting the Topics API receive a random list of up to three of the visitor's top five topics over the past three weeks, for a maximum total of five. These interests can be used to present ads that reflect what the visitors presumably want to see.
But the system is complicated and Google's assurances about the privacy advantages of its approach haven't convinced everyone, perhaps as a result of the company's persistent involvement in privacy scandals.
The CMA on Friday issued its latest [9]update on Google's commitments to implement its Privacy Sandbox ad technologies in a way that doesn't put rivals at a disadvantage.
[10]Cops cuff man for allegedly framing colleague with AI-generated hate speech clip
[11]Encrypted email service files DMA complaint claiming it vanished from Google Search
[12]UK's Investigatory Powers Bill to become law despite tech world opposition
[13]Google location tracking deal could be derailed by politics
The report incorporates input from the UK Information Commissioner's Office (ICO), which oversees privacy issues. A leaked draft of the ICO's Privacy Sandbox assessment earlier this week [14]revealed that the ICO still believes the technology isn't living up to its name. And now those concerns have been publicly articulated.
The CMA report lists almost 80 issues that have yet to be resolved to the satisfaction of UK regulators.
[15]
"The regulators are showing real concern about some significant areas – from latency and the role of cloud providers through to governance and privacy," said James Rosewell, co-founder of Movement for an Open Web, an advertising interest group, in a statement. "These are fundamental issues that are not going to be addressed overnight. The fact that the issues list is growing as the technology gets closer is a sign that Google has tied itself up in knots that it simply can’t unwind."
Rosewell argues that Google has not put enough thought into the governance of the new ad regime being proposed – most competitors don't want Google giving itself new gatekeeping powers – and that competing ad targeting schemes should be able to compete fairly in an open market.
Among the CMA's lingering worries about Google's technology, there's concern that the Topics interest-based ad mechanism doesn't explain itself well.
"We are concerned that the Topics consent user interface may not adequately inform users about how their personal data is used or how the topics generated may be used for purposes wider than interest-based advertising (e.g. as determined by organizations that decide to use the API)," the report says, adding that Google is planning to revise the Topics API consent interface.
There's also the possibility that Topics data about people's interests might be used for purposes other than advertising.
"Based on the ICO's preliminary assessment, we are concerned that topics data may be used for purposes outside that specified by the API, and in so doing may harm the user and breach Applicable Data Protection Legislation," the report says, while also observing that "Google does acknowledge that entities calling the API might use the data for other purposes."
Another worry is that if the taxonomy of interests in the Topics API expands sufficiently, there will be a larger number of data points that may prove sufficient to identify people. "We agree with the ICO that future utility-based changes to the taxonomy could introduce new privacy risks," the CMA report says.
Web publishers have their own wish list of fixes, like a way to correct an errant Topics classification of a website and associated interests. The report also covers other APIs like the Protected Audience API and Fenced Frames. It's clear Google still has quite a bit of work left to do.
Google said in a statement last week that it continues to expect the Privacy Sandbox to improve upon the not-very-private status quo. "We've been closely engaging with the ICO, and other privacy and competition regulators globally, and will continue to do that to reach an outcome that works for users and the entire ecosystem," the biz said.
It's not as if Google has a choice while under the regulatory microscope. ®
Get our [16]Tech Resources
[1] https://privacysandbox.com/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zi-EH9uYnZ58lon0tcjXvgAAAIs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zi-EH9uYnZ58lon0tcjXvgAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zi-EH9uYnZ58lon0tcjXvgAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2023/09/06/google_privacy_popup_chrome/
[6] https://developers.google.com/privacy-sandbox/relevance/topics/android
[7] https://github.com/patcg-individual-drafts/topics/blob/main/taxonomy_v2.md
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zi-EH9uYnZ58lon0tcjXvgAAAIs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.gov.uk/cma-cases/investigation-into-googles-privacy-sandbox-browser-changes
[10] https://www.theregister.com/2024/04/25/ai_voice_arrest/
[11] https://www.theregister.com/2024/04/26/google_search_dma_complaint/
[12] https://www.theregister.com/2024/04/26/investigatory_powers_bill/
[13] https://www.theregister.com/2024/04/16/google_location_tracking_deal_could/
[14] https://www.theregister.com/2024/04/22/ico_google_privacy_sandbox/
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zi-EH9uYnZ58lon0tcjXvgAAAIs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://whitepapers.theregister.com/
Dear Google, I dropped 3rd party cookies in the 90s. It isn't hard or time consuming, just install a decent browser like Firefox and disable them. :D
Enshitification of Google
I've had a gmail/Google account for many years, only used for non-important stuff and remembering my music history/taste on YouTube. A while ago they stopped me logging in unless I gave them a mobile number "to verify it was me". Bollocks. They wanted it as a unique ID to relate me to other web activity. Someone on here said to wait a few days and they'll stop insisting on a phone number and sure enough it started working again. However, Google have now pulled the same stunt again and this time I decided "feck them", so have abandoned my gmail/Google account for good. Track this Google (holds up middle finger).
Ad industry rivals, not so much concerned about the privacy aspect of the whole affair, worry that Google's reimagined tech stack will put them at a competitive disadvantage by denying them the data they use to make their ads more effective.
Well, yeah. Dropping third party cookies is a privacy improvement, so it's bad for them. Google is the one actor in the whole industry who needs third party cookies the least, which is technically a good thing in this case because otherwise they would not going forward with this. Every time Google pushes for privacy, it's because it fucks everybody equally but they stay ahead.
Top heavy and misses the point anyway
Whatever the tech mechanisms, it's still monitoring and profiling individuals. Gooooooooooogle still has a view of what you do, so bang goes privacy again. What's really needed is for the con that is user-targeted advertising to be punctured once and for all. Masses of evidence show that it only really works for the brokers as the ostensible 'targeting' is typically crap. This won't change if a digest of the previous week's browsing is used instead of cookies, as what they just did is an inherently lousy basis for assessing what will interest the user next. The efficient approach to ad targeting (insofar as any approach is efficient at all) is page content relevant ad placement which would not require any snooping on users at all. But I suspect that broker profits would fall, as they're primarily boosted by the fact that real time auctioning tends to inflate placement prices.
Oh wait -- I said "misses the point", but it depends on whose position that's judged from. If the point is to maximise broker revenue as it seems to be, the current approach will persist. Albeit in a succession of technical guises, the underlying principle will be retained.
Re: Top heavy and misses the point anyway
I used to think that, but it turns out that it has bad problems, too. It causes site operators to enshittify their content and spread their focus by adding garbage material that might seem, to a computer, to be relevant to high-value ads, but is actually worthless to any user. In fact it seems to be causing search engines to use the presence of such filler as a metric of "quality", and promote sites with high volumes of ad-relevant garbage over sites that deliver clear, concise, focused information the user actually wants. This is part of the reason that your Google search results suck nowadays.
I'm about ready to say just give up and ban all advertising outright.
If America is a friendly country to the UK
Surely it should be Ok for the Americans to have all the data that the UK has?
That's what friends do - share right?
Re: If America is a friendly country to the UK
Hi friend, can you just let me know your bank account name, number, sort code, username and password. I plan nothing nefarious, it is just as a friend you completely trust me. ;-)
the data they use to make their ads more effective.
Are they sure? How do they know?