Colour us shocked: Google in €50m GDPR fine appeal bombshell Google is to appeal the €50m data protection fine handed down to it by the French data protection agency earlier this week. The search giant claimed it had "worked hard" to create a transparent and straightforward GDPR consent process for its ads personalisation settings, and was "concerned about the impact of this ruling on …
Google is concerned. Politicians around the world are slowly waking up to the issues of online privacy and Alphabet, Facebook, Apple etc etc's role in violating and abusing it. In their eyes, we are the product. Our data is their data and can be freely exploited to "personalise" advertising.
Which would be fine, if that advertising was relevant and not just f'ng annoying. Two examples spring to mind.. The Twix 'two brothers (no cup)' ad and Virgin's special deal for tickets London-Manchester. The latter because a) I don't live in London b) I have no desire to visit Manchester and c) it seemed to be the only ad played every break (no Kit Kat) for around a week.
And the latter was all the more curious because if the ad slinger's algorithms worked, it would have known where I lived and that I'd not searched for 'fun things to do in Manchester' or 'Manchester goons wanted for arson work on adslingers HQ'. Which is also the problem for Alphabet. It's advertisers are also waking up to reputational risks, or just the effectiveness of mistargetted advertising. Which means there's a risk that Google won't have quite the same value if it loses both "customers" and advertisers.
@Jellied Eel
" Our data is their data and can be freely exploited to "personalise" advertising."
Not with Google - their data on us is their data and can be freely exploited to "personalise" advertising, no matter how that data was obtained.
@DCdave
It's an interesting question whether the 'personalisation' of adverts might make their delivery to the targeted individual 'direct marketing' in law. If so, 'personalised' adverts on a web site could require explicit informed consent provided to each advertiser - not just to an intermediary such as Google, which would merely be acting as a service provider to advertisers (and thus as their data processor under the GDPR).
It's an interesting question whether the 'personalisation' of adverts might make their delivery to the targeted individual 'direct marketing' in law.
Interesting point. I'm guessing Google would argue it's targetted advertising and they'd interpret personalised as an ad containing the target's personal data.. Which I guess could get tricky if that's an ad injected into someone's gmail based on analytics and/or content. Where I'm less guessing is they're probably spending a lot of lobbying $$ to ensure changes to distance selling or direct marketing regulations favour their preferred model. Where this often comes unstuck though is if regulators get hold of sales presentations to advertisers which make claims that would be considered illegal.
Where google says, "...it had "worked hard" to create a transparent and straightforward GDPR consent process for its ads personalisation settings"
For the first part, they're trying to reduce the fine by arguing against Article 83.2(c):
"[Regarding] the general conditions for imposing administrative fines)...the intentional or negligent character of the infringement..."
Ditto the second part regarding their concerns, relate to Article 83.2(k)
"..mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement..."
CNIL's final decision will likely be based on the perceived "m.o" of Google.
Where google says, "...it had "worked hard" to create a transparent and straightforward GDPR consent process for its ads personalisation settings"
Yes, they certainly worked very hard on their privacy settings and opt in/out stuff. It must have taken some real effort and brainstorming sessions to make it that difficult, awkward and time consuming. But they need to work way, way harder at understanding the definitions and intent of the words "transparency" and "straightforward"
Can you talk us through what will happen to mobile phones once Google walk away from the EU as you suggest?
Does Google block access to all Android services that are non-compliant with this ruling and wait until a replacement appears?
Are new Android phones removed from sale?
What replaces Android? And who provides it? And what about mobile devices that can't use the replacement (I', assuming the existing Android ecosystem is too diverse to easily replace in one hit)?
Will mobile phone users accept restrictions on their mobile services while a service that complies with this GDPR ruling is created?
Lineage OS with no gapps then all the fun of downloading APK's, what could possibly go wrong?
Google won't sit back, it has too much money. Could it dismantle the EU? They do say corporations have a lot of control these days, we know they do in America and America likes to change governments to their liking.
Could it dismantle the EU? They do say corporations have a lot of control these days, we know they do in America and America likes to change governments to their liking.
Good grief, don't know where to start on that one.
Let's just say, trying that will likely end with a couple hundred 'Gilet jaunes' bearing down on you, or Google.
This is what I have; to answer the question, I very probably still have a few of them snitching on me back to Facebook just by using their SDK. Still need to find out which ones... could setup MITM like these guys. Well, since they already showed me what I'm looking for, I can also just start unzipping and strings | grep.
No, because it knew it would have still made a lot of money. Retire Android and fully open the market to any competitor? Chineses are ready with their own Android forks...
They are not so fool, pure revenges may be cheap at first, and become very expensive later...
The difference with MS is that they made their money directly from Windows licence sales with a big chunk of them on the enterprise side (select/volume licensing) rather than once every three-five year end user sales. If MS stopped doing business with the EU, it immediately reduced sales.
For Google, they don't make any money directly from Android phone sales - if manufacturers deliver compliant OSes, Google will suffer a reduction in users/play store revenues but won't immediately suffer a loss of all revenue. Plus users are likely to workaround any steps taken to comply with the request. The majority of end users are likely to see the French ruling as the problem rather than Google...
As for China replacing Android, which would ideology would the EU prefer? Citizens privacy or the fear of China?
Maybe I'm wrong *shrugs*
"Are they really?"
In my experience yes - in a business or social situation, suggesting ways that people can address privacy issues in a meaningful way rarely results in long term change (i.e. more than a few weeks) as the convenience of the services offered for the majority of people outweighs the loss of privacy.
I'm not trying to push a pro-Google agenda, I'm trying to be realistic about how people actually behave in spite of knowing how information maybe used - pretending we can significantly alter the behavior of mobile users by fining Google is delusion IMHO. It only works as long as the fines are minimal (relative to the cost of fighting them/overall profits) and the changes required to comply are minimal tweaks to existing agreements so that the majority of users just accept the updated terms and conditions.
i.e. Google get their hands on the majority of their users data and regulators get a nice fine to show they did something.
Exactly because most of the people accept defaults and don't bother anymore. That's why GDPR is made the way it is, and that's why Google is so worried.
People won't look for workarounds but a minority, and that only if Google finds ways to block them enough without incurring into privacy and antitrust fees. Both are playing against Google now.
"In my experience yes - in a business or social situation, suggesting ways that people can address privacy issues in a meaningful way rarely results in long term change (i.e. more than a few weeks) as the convenience of the services offered for the majority of people outweighs the loss of privacy."
Spot on. Just look at the reaction by Uber users in London when Uber was found to be operating illegally. There was no "OMG, Uber are nasty and need to get their act together". The actual reaction was "OMG, how am I going to get anywhere? Those nasty people at TFL have took away my Uber wah! wah!"
Still, Google has shareholders. Are you sure pulling away from the EU market won't greatly decrease Google share values? Also, how could Google sell its services in EU if it pull the plug? It would also have an immediate, direct impact on sales of its ads services. EMEA revenues are 1/3 of Alphabet revenues, and most of them I guess are from EU, not Zimbabwe - especially since in East Europe it has a strong and direct competitor like Yandex, better aligned with the local "market".
Which shareholder accept a sudden reduction of about 1/3 in revenues - and related shares drop?
MS antitrust ruling had a big impact on MS - better Linux interoperability and the rise of competing browsers meant a big impact on Windows server sales. Mozilla first, and the Chrome, took big advantage from the bad light IE was put under. But "pulling the plug" would have been even worse - it would have left open the desktop market to competitors as well.
Sure, Google is at a crossroad, because GDPR can make most of its business model unworkable. It can try to water down regulations, but it could be impossible. It could require a payment or data slurping acceptance to access services, but still it's different than "slurping by default".
I never said EU will be happy with Chinese filling the gap - but Chinese will be happy to try to fill the gap - especially if they can get rid of Google - as their handsets are already among the most sold, while Apple has a small market share in most EU countries. Anyway, a market of 400+ millions of people most of them with adequate spending capabilities is something Google can't ignore, especially as long as the mobes sales peak is probably in the past, and handing customers to competition would be suicidal.
"How's that, will they send daily emails off to Google with their location history?"
Well...how do users currently get around restrictions at the moment for content that is either geofenced or blocked in their countries? VPN services...
No e-mail back to Google, but if the apps still report location data, does it make much difference?
What does geofencing have to do with Google slurping your location 24/7? Do tell.
If Google is forced to remove the slurping, the only thing the customer will notice is increased battery life. There are no downsides.
"If Google is forced to remove the slurping, the only thing the customer will notice is increased battery life. There are no downsides."
Except we seem to have a generation of people who either don't understand the concept of data privacy or are simply happy to give it up so their phone can tell them of the wonderful special offers as they walk past Starbucks. Having location data switched can be very useful, but it's been abused so much, no one concerned about privacy would ever turn it on. But I'd be prepared to bet that if all data slurping was turned off along with location information, a significant proportion of users would voluntarily turn it on so they can get those "special offers" as they walk around town.
"What does geofencing have to do with Google slurping your location 24/7? Do tell."
How will Google remove services from phones? They probably won't - it's easier to block access from Europe to comply with legal requirements.
Will customers remove apps they use/require? Unlikely - they'll use VPN services to access the blocked content.
That is a misunderstanding of GDPR. Blocking access to services based on location doesn't mean you're compliant with GDPR, it means the opposite.
And if Google do pull the plug they'll lose the world's biggest market.
"That is a misunderstanding of GDPR. Blocking access to services based on location doesn't mean you're compliant with GDPR, it means the opposite."
I am taking the hypothetical scenario where Google is deemed non-compliant with GDPR and walks away ie. is banned in the EU.
If blocking access to Google is not deemed sufficient and Google have "withdrawn services", what will happen?
The majority of commentators are happy with Google being fined and I'm not disagreeing as long as there is a practical agreement at the end. If Google alters its method of obtaining consent but stills falls short of EU regulations, what are the options on both sides?
I don't buy the "Google won't walk away from a third of their market" argument because even if they did, I suspect the vast majority would do whatever it took to follow them. At least for 1-3 years until they could afford a new phone. That's a long time for authorities to cope with widespread civil disobedience... And after 1-3 years, people move to non-android phones and load Google apps anyway...
Google: way past applauding, no longer appealing, how about appaling?
...
no, actually, I'm long past even the "Google are appaling!" stage. Sadly, even if I could wish them away (begone, disappear with no trace), there would surely appear another "appealing" pretender to the evil throne :/
How many web sites use European data slurpers vs Google. Facebook #2.
1) Other people doing it is no defence
2) It IS the US origin companies that are doing most of it
3) It's just about competition? Google, Facebook etc have no competition. In other areas there is Amazon.
Triple the fine on appeal and keep fining them.
I do hope all the other lawbreakers will be brought to account. You even have to block Google cookies to avoid an evil T&C page you have to agree with on Google search. Alternatives? Yes. I used to use Altavista. Google has bought in companies in so many areas and destroyed competition.
"2) It IS the US origin companies that are doing most of it"
It's the US origin companies doing it most successfully at present in the European region.
Most European data slurpers either have existing methods of obtaining information (i.e. relationships with retailers for sales data and potentially customer loyalty schemes) or feed their data into Facebook/Google for the analytics...
The Amazon model would be a form of the legacy model (i.e. the customer loyalty card that provides a identifier for historical purchases) assuming that no one has done anything dumb in Amazon in regards to passing data to third-parties.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
