Regulators in Ireland are
investigating whether Google's real-time bidding platform violates Europe's privacy laws, officials said Wednesday.
“The purpose of the inquiry is to establish whether processing of
personal data carried out at each stage of an advertising transaction is in compliance with the relevant provisions of the General Data Protection Regulation,” the
Ireland Data Protection Commission stated.
The GDPR, which went into effect May 25 of last year, sets out sweeping privacy mandates, including the requirement that companies obtain people's consent before using their data for ad
targeting.
The Ireland DPC also plans to probe whether Google minimizes the data it collects and retains, and whether the company complies with transparency principles.
The
commission said Wednesday its investigation stems, in part, from filings by Johnny Ryan, chief policy officer for the Brave browser. Last September, Ryan alleged in complaints filed with European
regulators that Google (and other online ad tech companies) engage in “pervasive and invasive profiling and processing of personal data for profit.”
Among other allegations, he
said Google doesn't control what happens to data about consumers after it's shared with other companies via real-time bidding -- which means Google can't prevent third parties from using consumer data
in ways that may violate the GDPR, or even tell consumers how their data will be used by third parties.
A Google spokesperson said: “We will engage fully with the DPC’s
investigation and welcome the opportunity for further clarification of Europe’s data protection rules for real-time bidding. Authorized buyers using our systems are subject to stringent policies
and standards."
In January, Ryan supplemented the original complaint with new papers alleging that Google profiles web users based on sensitive data like “religious beliefs, ethnicities,
diseases, disabilities, and sexual orientation.”
Google said at the time it doesn't create profiles based on sensitive data, or allow advertisers to target people based on
categories including race, sexual orientation, health conditions and pregnancy status.
News of the investigation in Ireland comes four months after privacy regulators in France fined Google
around $57 million for failing to obtain people's unambiguous consent before using their data to target ads.