Consumer Privacy Groups Seek Halt to Google-DoubleClick Deal

A trio of privacy and consumer rights groups formally asked government regulators to halt Google's announced acquisition of DoubleClick, an online advertising firm that serves ads on thousands of web sites, until the companies agree not to merge their immense databases and allow users to see the information that the companies have collected on their search and browsing habits. Google's announcement of the $3.1 billion cash deal immediately made rights groups' collective neck hairs stand up.

The complaint to the Federal Trade Commission charges that the companies are engaging in unfair business practices by not adequately informing customers about what data is collected and by not allowing people to see and delete their information. The Electronic Privacy Information Center largely authored the complaint (.pdf), which was co-authored with the Center for Digital Democracy and U.S. PIRG.

Neither Google nor DoubleClick have taken adequate steps to safeguard the personal data that is collected. Moreover, the proposed acquisition will create unique risks to privacy and will violate previously agreed standards for the conduct of online advertising. [...]

Google's proposed acquisition of DoubleClick will give one company access to more information about the Internet activities of consumers than any other company in the world. Moreover, Google will operate with virtually no legal obligation to ensure the privacy, security, and accuracy of the personal data that it collects. At this time, there is simply no consumer privacy issue more pressing for the Commission to consider than Google's plan to combine the search histories and web site visit records of Internet users.

Google keeps every search terms put into its search engine and ties them to a cookie in a user's browser, including the IP address of a user's computer. This data is mostly anonymous (depending on the search terms or use of Google Maps), but could be umasked if someone subpoenaed an ISP for IP records and then asked Google to turn over all requests from that IP address.

Users who use Google's search engine while logged into a user account will have even deeper profile and is not likely to be anonymous data.

For its part, DoubleClick uses tracking cookies across a wide swath of the web and knows largely anonymous data on what websites people visit.

Combining the two data sets, as Google plans to, would create a massive data base of information on where people surf and what they surf on, though Google says that it will actually set policies that protect people's privacy more than they had before.

EPIC has successfully used complaints to the FTC in the past to force changes in data practices at corporations, including Microsoft and DoubleClick.

Specifically the groups want the FTC to:

• Initiate an investigation of the proposed acquisition of DoubleClick by Google specifically with regard to the ability of Google to record, analyze, track, and profile the activities of Internet users with data that is both personally identifiable and data that is not personally identifiable.
• Order DoubleClick to remove user identified cookies and other persistent pseudonym identifier from all corporate records, databases, and data sets under the control of DoubleClick prior to the transfer to Google, unless DoubleClick obtains explicit affirmative consent, following an opportunity for the individual to whom the data concerns to inspect, delete and modify the data.
• Order Google to present a public plan for how it plans to comply with such well established government and industry privacy standards as the OECD Privacy Guidelines.
• Order Google to provide for reasonable access to all personally identifiable data maintained by the company to the person to whom the data pertains.
• Order Google to establish a meaningful data destruction policy and require that Google destroy all cookies and other persistent identifiers resulting from Internet searches that are or could be personally identifiable once the user terminates the session with Google.
• Pending an adequate resolution of the issues identified in this Complaint, as well as other matters that may be brought to the Commission' attention, the Commission should use its authority to review mergers to halt Google' proposed acquisition of DoubleClick.