Resource Data

Google may have shared data with sanctioned Russian ad firm, report says

Google may have shared potentially sensitive user data with a sanctioned ad tech company owned by Russia’s largest state bank until June 23, according to a report by ProPublica. This comes just four months after the Senate Intelligence Committee warned the tech giant to remain vigilant of possible exploitation by Russia and Russian-related entities following Russia’s invasion of Ukraine.

Google has authorized RuTarget, a Russian company that helps brands and agencies buy digital ads, access and store data about people browsing websites and apps in Ukraine and other parts of the world, according to research and data from digital advertising analytics firm Adalytics. Its findings showed that nearly 700 cases of RuTarget were receiving user data from Google despite the ad tech company being added to the US Treasury’s list of sanctioned entities on February 24. According to ProPublica, data sharing between the two would not stop until June. On the 23rd, the day the publication contacted Google for comment.

RuTarget is owned by Sberbank, a Russian state bank that the Treasury and ProPublica say is “of unique importance” to the country’s economy. On April 6, Sberbank was added to the US Treasury’s list of Russian entities and persons subject to full blocking sanctions.

SEE ALSO:

Google will automatically remove visits to abortion clinics from your location history

The analysis showed that Google shared data about users browsing websites based in Ukraine. This is concerning because critical information such as unique mobile phone identifiers, IP addresses, location information and details of user interests and online activity could be used by the Russian government to track people or places of interest.

A Google spokesperson told ProPublica that the company blocked RuTarget from using its services in March. However, Google acknowledged that data about users and ad purchases from Google was always received before being alerted by ProPublica and Adalytics. Google did not immediately respond to Mashable’s request for comment.

One of the biggest concerns of earnings and lawmakers is the data of global internet users that is passed to companies as part of the digital ad buying process. This treasure trove of user data, called bidstream data, is used as part of a half-trillion-dollar digital advertising industry dominated by Google, according to ProPublica.

ProPublica says this data is auctioned off in real time as users visit a site, after which “within milliseconds, data collected about that user is shared with potential ad buyers to help them decide whether to bid or not to display an ad to the user.” Ad buying companies such as RuTarget, whether bidding or not, may receive and store this auction feed data. And since Google operates the largest ad buying exchange in the world, the more RuTarget connects to ad exchanges such as Google, the more data and information it can collect.

The findings of RuTarget’s relationship with Google come at a time when tech companies are coming under increasing scrutiny from lawmakers concerned about how tech companies handle our personal data.

The user data Google shares with RuTarget and other ad buyers comes from millions of websites and apps that depend on the company for ad revenue, ProPublica added. Specifically, information from major publishers like ESPN and Reuters was accessible to RuTarget “as a recipient of user data in cookie consent pop-ups presented to users browsing their sites from within the EU and other jurisdictions including data privacy laws require such disclosures.”

The findings from ProPublica and Adalytics are troubling to say the least. The average consumer probably wouldn’t like the idea that until a few weeks ago their information was being shared with a sanctioned Russian advertising company. As of this writing, Google is currently in the midst of a class action lawsuit that alleges that the company “does not tell account holders which companies are bidding on and therefore accessing their personal information.”