Tech companies 'using sensitive personal data to target users for ads'
Google and other big online ad companies are targeting people for ads based on inappropriately personal and sensitive data, Irish and European researchers claim.
Terms used to target people include 'incest', 'abuse', 'impotence' and 'eating disorders'.
Google and a number of major online ad auction companies use data to determine what users watch, read and listen to on the web - and this specific information is used to guide advertisers.
Dr Johnny Ryan, a Dubliner working for the privacy browser Brave, has jointly submitted a complaint to the Irish Data Protection Commissioner and its British and Polish counterparts.
The EU's GDPR privacy law gives special protection for categories of private data that could expose individuals to particular vulnerability.
Most online advertising technology works by profiling a person based on what they look at or do online, before using this information to guide advertisers.
But the search giant together with other ad auction companies that operate according to guidelines laid down by the Interactive Advertising Bureau (IAB) have gone too far, according to the researchers.
"While it is acceptable for a library to mark an area with the words 'substance abuse', it would not be acceptable for a library to mark a person who enters that section with those words too," said Dr Ryan.
"But online, these companies and Google labels about what you read, watch and listen to online stick to you for a long time, perhaps forever, because of the tracking IDs and other information specific to you and your device that is routinely included in ad auction bid requests that are routinely sent to hundreds of companies every time you load a page," he said.
Dr Ryan has made the complaint with Jim Killock, of the British Open Rights Group, Michael Veale, of University College London, and the Warsaw-based digital rights organisation, the Panoptykon Foundation.
They claim that online ad giants are unlawfully profiling internet users' religious beliefs, ethnicities, sexual orientation, diseases and disabilities.
A spokesperson for Google Ireland said it does not tolerate 'sensitive' targeting of individuals for ad purposes.
"We have strict policies that prohibit advertisers on our platforms from targeting individuals on the basis of sensitive categories such as race, sexual orientation, health conditions and pregnancy status," said the spokesperson.
"If we found ads on any of our platforms that were violating our policies and attempting to use sensitive interest categories to target ads to users, we would take immediate action."
The complaint comes as big tech companies come under sustained fire for privacy breaches and criticism of the way they profile people online.
Last week, Google was fined €50m by French data protection authorities under the GDPR law for not being transparent over how it uses data and its methods of personalising online ads.
"Actors in this ecosystem are keen for the public to think they are dealing in anonymous, or at the very least non-sensitive data, but this simply isn't the case," said Mr Veale.
"Hugely detailed and invasive profiles are routinely and casually built and traded as part of today's real-time bidding system, and this practice is treated though it's a simple fact of life online.
"It isn't. It both needs to, and can, stop."