Google's Privacy Sandbox more like a privacy mirage, campaigners claim
(2024/06/13)
- Reference: 1718285409
- News link: https://www.theregister.co.uk/2024/06/13/noyb_gdpr_privacy_sandbox/
- Source link:
Privacy campaigner noyb has filed a GDPR complaint regarding Google's Privacy Sandbox, alleging that turning on a "Privacy Feature" in the Chrome browser resulted in unwanted tracking by the US megacorp.
The Privacy Sandbox API was [1]introduced in 2023 as part of Google's grand plan to eliminate third-party tracking cookies. Rather than relying on those cookies, website developers can call the API to display ads matched to a user's interests.
In the announcement, Google's VP of the Privacy Sandbox initiative called it "a significant step on the path towards a fundamentally more private web."
[2]
However, according to [3]noyb , the problem is that although Privacy Sandbox is advertised as an improvement over third-party tracking, that tracking doesn't go away. Instead, it is done within the browser by Google itself.
[4]
[5]
To comply with the rules, Google needs informed consent from users, which is where issues start.
Noyb wrote today: "Google's internal browser tracking was introduced to users via a pop-up that said 'turn on ad privacy feature' after opening the Chrome browser. In the European Union, users are given the choice to either 'Turn it on' or to say 'No thanks,' so to refuse consent."
[6]
Users would be forgiven for thinking that 'turn on ad privacy feature' would protect them from tracking. However, what it actually does is turn on first-party tracking.
[7]Meta will use your social media posts to train its AI. Europe gets an opt out
[8]Meta faces multiple complaints in Europe over plans to train AI on user data
[9]Microsoft accused of tracking kids with education software
[10]OpenAI slapped with GDPR complaint: How do you correct your work?
Max Schrems, honorary chairman of noyb, claimed: "Google has simply lied to its users. People thought they were agreeing to a privacy feature, but were tricked into accepting Google's first-party ad tracking.
"Consent has to be informed, transparent, and fair to be legal. Google has done the exact opposite."
Noyb noted that Google had argued "choosing to click on 'Turn it on' would indeed be considered consent to tracking under Article 6(1)(a) of the GDPR."
The Register asked Google to comment on noyb's [11]complaint filed with the Austrian data protection authority and will update this article should we receive a response.
[12]
Google's Privacy Sandbox initiative is not going smoothly. In April, the UK's Competition and Markets Authority [13]expressed concerns about privacy and competition, and Google [14]decided to push back the deprecation of third-party cookies in Chrome to early 2025. ®
Get our [15]Tech Resources
[1] https://www.theregister.com/2023/09/07/google_privacy_sandbox/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZmsXojOIvytDemTeTcCXFgAAAJU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://noyb.eu/en/google-sandbox-online-tracking-instead-privacy
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZmsXojOIvytDemTeTcCXFgAAAJU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZmsXojOIvytDemTeTcCXFgAAAJU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZmsXojOIvytDemTeTcCXFgAAAJU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2024/06/10/meta_ai_training/
[8] https://www.theregister.com/2024/06/06/meta_ai_complaints/
[9] https://www.theregister.com/2024/06/04/noyb_microsoft_complaint/
[10] https://www.theregister.com/2024/04/29/openai_hit_by_gdpr_complaint/
[11] https://noyb.eu/sites/default/files/2024-06/Google%20Sandbox%20Complaint%20EN_redacted.pdf
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZmsXojOIvytDemTeTcCXFgAAAJU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2024/04/29/uk_cma_google/
[14] https://privacysandbox.com/news/update-on-the-plan-for-phase-out-of-third-party-cookies-on-chrome/
[15] https://whitepapers.theregister.com/
The Privacy Sandbox API was [1]introduced in 2023 as part of Google's grand plan to eliminate third-party tracking cookies. Rather than relying on those cookies, website developers can call the API to display ads matched to a user's interests.
In the announcement, Google's VP of the Privacy Sandbox initiative called it "a significant step on the path towards a fundamentally more private web."
[2]
However, according to [3]noyb , the problem is that although Privacy Sandbox is advertised as an improvement over third-party tracking, that tracking doesn't go away. Instead, it is done within the browser by Google itself.
[4]
[5]
To comply with the rules, Google needs informed consent from users, which is where issues start.
Noyb wrote today: "Google's internal browser tracking was introduced to users via a pop-up that said 'turn on ad privacy feature' after opening the Chrome browser. In the European Union, users are given the choice to either 'Turn it on' or to say 'No thanks,' so to refuse consent."
[6]
Users would be forgiven for thinking that 'turn on ad privacy feature' would protect them from tracking. However, what it actually does is turn on first-party tracking.
[7]Meta will use your social media posts to train its AI. Europe gets an opt out
[8]Meta faces multiple complaints in Europe over plans to train AI on user data
[9]Microsoft accused of tracking kids with education software
[10]OpenAI slapped with GDPR complaint: How do you correct your work?
Max Schrems, honorary chairman of noyb, claimed: "Google has simply lied to its users. People thought they were agreeing to a privacy feature, but were tricked into accepting Google's first-party ad tracking.
"Consent has to be informed, transparent, and fair to be legal. Google has done the exact opposite."
Noyb noted that Google had argued "choosing to click on 'Turn it on' would indeed be considered consent to tracking under Article 6(1)(a) of the GDPR."
The Register asked Google to comment on noyb's [11]complaint filed with the Austrian data protection authority and will update this article should we receive a response.
[12]
Google's Privacy Sandbox initiative is not going smoothly. In April, the UK's Competition and Markets Authority [13]expressed concerns about privacy and competition, and Google [14]decided to push back the deprecation of third-party cookies in Chrome to early 2025. ®
Get our [15]Tech Resources
[1] https://www.theregister.com/2023/09/07/google_privacy_sandbox/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZmsXojOIvytDemTeTcCXFgAAAJU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://noyb.eu/en/google-sandbox-online-tracking-instead-privacy
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZmsXojOIvytDemTeTcCXFgAAAJU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZmsXojOIvytDemTeTcCXFgAAAJU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZmsXojOIvytDemTeTcCXFgAAAJU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2024/06/10/meta_ai_training/
[8] https://www.theregister.com/2024/06/06/meta_ai_complaints/
[9] https://www.theregister.com/2024/06/04/noyb_microsoft_complaint/
[10] https://www.theregister.com/2024/04/29/openai_hit_by_gdpr_complaint/
[11] https://noyb.eu/sites/default/files/2024-06/Google%20Sandbox%20Complaint%20EN_redacted.pdf
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZmsXojOIvytDemTeTcCXFgAAAJU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2024/04/29/uk_cma_google/
[14] https://privacysandbox.com/news/update-on-the-plan-for-phase-out-of-third-party-cookies-on-chrome/
[15] https://whitepapers.theregister.com/
Alumoi
Why am I not surprised that a company is lying through its teeth?
Snake
Because you both have an IQ higher than the average person in today's world - read: your IQ is higher than 30 :P
Why am I not surprised that a company that exists to track users and sell their data, is found to track users when they promised not to?