• by Wendy Davis  @wendyndavis, July 31, 2017

The Federal Trade Commission should investigate Google's in-store tracking program, which attempts to link people's online activity with their brick-and-mortar purchases, the Electronic Privacy Information Center says in a new complaint.

"Google has collected billions of credit card transactions, containing personal customer information, from credit card companies, data brokers, and others and has linked those records with the activities of Internet users, including product searches and location searches," EPIC writes in documents filed with the FTC. "This data reveals sensitive information about consumer purchases, health, and private lives."

Google officially unveiled the in-store tracking program in May. The program, now in beta, links data about credit or debit card transactions with information about ads clicked on by logged-in users.

Information is provided to advertisers on an aggregated and anonymized basis, but EPIC says Google should offer more details about how it de-identifies the data.

"We're trying to put that issue squarely before the FTC," EPIC President Marc Rotenberg tells MediaPost. He says his organization is in favor of companies de-identifying data, but believes the procedures need to be evaluated.

Rotenberg adds that programs that mesh online and offline tracking data not only threaten privacy, but that Google's move into offline analytics could pose a competitive threat to other ad companies.

"Clearly, as Google moves to extend its advertising dominance from the online world to the offline world, alarm bells should be going off," he says.

Google has said that consumers can opt out of tracking of their online activity, but EPIC alleges in its complaint that the process is "burdensome, opaque, and misleading."

EPIC is calling on the FTC to require Google to offer a "clean and simple" opt-out tool. The advocacy group also wants Google to reveal the identities of the data brokers or other third parties that provide information about people's purchases, and to disclose the details of the algorithm that powers the program.

A Google spokesperson says that the company "invested in building a new, custom encryption technology that ensures users' data remains private, secure, and anonymous" before rolling out the program. "We do not have access to any identifiable user’s credit and debit card data from our partners for this product, nor do we share any personal user information with our partners. We only use data for users that have consented to have their Web and App activity associated with their Google account, which users can opt-out of at any time,” the spokesperson says.

When Google first unveiled the program, the industry-funded think tank Future of Privacy Forum wrote that the company "seems to have put years of top level research" into encryption. "We expect that after the initial controversy over its application to analyze the effectiveness of advertising, researchers will take a hard look at how these methods can be used for a wide range of socially valuable research," the group wrote.