Who pay for processing my personal data ?
Last November I submitted a data access request to Google. One month later (which is the maximum delay to provide a first answer), Google informed me that my request would take some time process. Two months later Google offered another answer … and told me that they won’t be able to respond to my request.
The main objective of my data request, which is available bellow, is to obtain information about how I’m targeted on Google services. Ideally, I’d like to know which advertisers are using Google services to target me, how they are targeting me and eventually how much it costs them. Indeed, I’d like to put some “pressure” on the advertiser that rely on platforms which are not compliant with EU regulation. The best way to do it is to stop buying from these companies, hence the need to list them.
The reason I’m targeting advertisers is because they are the only stakeholders which can trigger immediate reaction from platforms like Google and Facebook. At the end of the day, they are the one paying the platforms and I wanted to know who’s paying for the processing of my data.
Three months to get a PDF
My first observation is about when Google decided to respond: they always use the full extent of the delay allowed by the GDPR (see article 12-3). While I could have understood that Google waited three months to process my request and retrieved the data, in they came back almost empty handed.
The only element that Google provided me is the list of advertisers that targeted me through “Customer Match” (i.e. the advertiser that uploaded my contact info to target me on Google). As far as I know, there is no simple way to get this data on Google, and indeed Google did not provide my a nice json file as it does on Takeout, but a pdf listing six advertisers. Funny enough, the document is marked “Google Confidential and Proprietary ».
When it comes to ad transparency, Google fares poorly compared to Facebook. The ad section of Facebook tells you a lot about the ads you’ve seen and how you’ve been targeted. The information may not be exhaustive as some ads are still missing, but at least, it’s quite simple to know who’ve targeted you using your contact info whereas Google just oppose a pdf file without much detail.
Nothing on the “Reminder ads”
Google does not offer any answer the the rest of my request. According to the response, the list of advertisers that are retargeting me on Google service is available on the “Ads Settings” page. I see no mention of such retargeting on this page. Actually, the page only contains a list of interests, almostall of them have been inferred from my use of Google services. The remaining of the answer explains me that it “does not maintain a database of every advertisement seen by a specific user. Account holders can visit My Activity to see the websites and apps they’ve visited on which Google ads were shown”.
So Google does not say that they don’t have the data I asked, they simply argue that it’s not sitting in a database. I guess, they know for each ad if I have seen it or not but it would be very resource consuming to go through all ads and check if my “cookie” saw the ad. While I understand that they did not search exhaustively which ads I have seen, they could have answered that sooner, it was not necessary to exhaust the legal delay.
Any idea?
Google did not provide me the data I was looking for but there could be other way to obtain the list of advertisers targeting me. Technically, it is possible to write a browser extension that would collect all the ads that I “see” on Google and would compile a nice page (like AdAnalyst for Facebook).
I will also request data more accurately. For instance, I could ask for each service separately, which advertiser targeted me. I’ll also ask what are the cookie IDs that were associated to my account and then ask which advertiser targeted these cookies.
Image de couverture par Jay Goldman
https://creativecommons.org/licenses/by-nc-sa/2.0/