Article Details

Scrape Timestamp (UTC): 2024-06-13 13:33:40.412

Source: https://www.theregister.com/2024/06/13/noyb_gdpr_privacy_sandbox/

Original Article Text

Click to Toggle View

Google's Privacy Sandbox more like a privacy mirage, campaigners claim. Chocolate Factory accused of misleading Chrome browser users. Privacy campaigner noyb has filed a GDPR complaint regarding Google's Privacy Sandbox, alleging that turning on a "Privacy Feature" in the Chrome browser resulted in unwanted tracking by the US megacorp. The Privacy Sandbox API was introduced in 2023 as part of Google's grand plan to eliminate third-party tracking cookies. Rather than relying on those cookies, website developers can call the API to display ads matched to a user's interests. In the announcement, Google's VP of the Privacy Sandbox initiative called it "a significant step on the path towards a fundamentally more private web." However, according to noyb, the problem is that although Privacy Sandbox is advertised as an improvement over third-party tracking, that tracking doesn't go away. Instead, it is done within the browser by Google itself. To comply with the rules, Google needs informed consent from users, which is where issues start. Noyb wrote today: "Google's internal browser tracking was introduced to users via a pop-up that said 'turn on ad privacy feature' after opening the Chrome browser. In the European Union, users are given the choice to either 'Turn it on' or to say 'No thanks,' so to refuse consent." Users would be forgiven for thinking that 'turn on ad privacy feature' would protect them from tracking. However, what it actually does is turn on first-party tracking. Max Schrems, honorary chairman of noyb, claimed: "Google has simply lied to its users. People thought they were agreeing to a privacy feature, but were tricked into accepting Google's first-party ad tracking. "Consent has to be informed, transparent, and fair to be legal. Google has done the exact opposite." Noyb noted that Google had argued "choosing to click on 'Turn it on' would indeed be considered consent to tracking under Article 6(1)(a) of the GDPR." The Register asked Google to comment on noyb's complaint filed with the Austrian data protection authority and will update this article should we receive a response. Google's Privacy Sandbox initiative is not going smoothly. In April, the UK's Competition and Markets Authority expressed concerns about privacy and competition, and Google decided to push back the deprecation of third-party cookies in Chrome to early 2025.

Daily Brief Summary

DATA BREACH // Privacy Advocates Charge Google with Misleading Tracking Practices

Privacy group noyb filed a GDPR complaint against Google's Privacy Sandbox, alleging it deceives Chrome users by enabling disguised tracking.

Introduced in 2023, the Privacy Sandbox API aims to replace third-party cookies with a system where ads are shown based on user interests directly through the browser.

Despite claims of enhancing user privacy, the API instead facilitates Google to perform first-party tracking directly within the Chrome browser.

Users opting into the feature under the premise of increased privacy were unknowingly consenting to Google's internal ad tracking.

Legal concerns revolve around the lack of transparent, informed consent required by GDPR, with noyb accusing Google of outright lying to users.

Google defended its consent mechanism, claiming it complies with legal standards under GDPR.

The UK's Competition and Markets Authority has also expressed concerns over privacy issues with the Sandbox, prompting a delay in phasing out third-party cookies until 2025.