• by Laurie Sullivan  @lauriesullivan, July 31, 2017

The Electronic Privacy Information Center filed a complaint asking the Federal Trade Commission to review the algorithm in Google AdWords that ties consumer online behavior to in-store purchases.

Google invested years in building a privacy solution. Here's how it works: An advertising campaign runs on Google that gets 10,000 clicks. A store participating in the program makes $5,000 in sales. By connecting the data, Google can tell that 12% of the consumer clicking on ads made a purchase. There's no individual data about the consumer or the product he or she purchased made available.

The data is collected in aggregate, encrypted and anonymized before it is given to advertisers, according to Google, but that doesn't seem to satisfy the Electronic Privacy Information Center.

"This type of sales measurement is common and before we launched our solution, we invested in building a new, custom encryption technology that ensures users' data remains private, secure, and anonymous," per a Google spokesperson. "We do not have access to any identifiable user’s credit and debit card data from our partners for this product, nor do we share any personal user information with our partners. We only use data for users that have consented to have their web and app activity associated with their Google account, which users can opt-out of at any time.”

Privacy Checkup has had 45 million visits since the launch. It helps people understand how they can easily opt-out of data collection. The checkup takes users through a list of options and enables them to specifically choose to prevent an account from being associated with different types of data.

The privacy group argues that if consumers do not want their purchases tracked, Google doesn't give them enough information on making a decision on whether or not to use cash or a credit card. And it doesn't provide enough information on the retailers using the technology. Consumers can opt out through Google's My Activity page, but they also have an option to pay cash for purchases, which reduces the ability to track back spending.

Earlier this year Google began to track credit card purchases through a service it calls Store Sales Measurement, which connects offline purchases to online profiles. The product is in beta only in the U,S.

Then in May 2017, Google said third-party partnerships would allow it to capture 70% of all payment card transactions in the U.S., as it matches transactions back to Google advertisements through anonymized and encrypted store sales data in aggregate.

Google claims it developed custom encryption to anonymize the payment data it receives from third parties. A spokesperson calls it "double-blinded" encryption. The encryption technology is not CryptDB, a system developed by MIT Researchers in 2011, partially funded by Google, according to the spokesperson. It's not clear if the technology is based on this this encryption. 

Still, the Electronic Privacy Information Center claims Google is gaining access to highly sensitive consumer information such as the credit and debit card purchase records of the majority of U.S. consumers, according to The Washington Post.