A new technology that Google uses to track billions of credit card transactions is unsafe, overly intrusive, and possibly in violation of federal law, according to a complaint the Electronic Privacy Information Center filed Monday with the U.S. Federal Trade Commission.
EPIC urged the FTC to investigate Google over its Store Sales Management program, criticizing it as unfair and deceptive to consumers, and lacking an easy way to opt out.
Google uses its SSM program to track whether consumers have converted online advertisements displayed on Google search pages into in-store purchases, according to the complaint. It collects credit card data on billions of transactions and matches them to determine the effectiveness of online ads in influencing consumers to purchase the promoted goods and services.
Google has refused to release specific data on the algorithm the SSM technology uses, but it apparently is based on CryptDB, which is described in a 2011 MIT research paper funded by Google and Citigroup, according to the complaint.
Google in 2014 launched Store Visit Management, a technology that allows advertisers to track the number of people who click on a Google AdWords ad and then visit their stores, the EPIC complaint notes. More than 5 billion store visits have been tracked by AdWords to date, with major retailers like Home Depot, Sephora and Nissan having used the tool.
Google earlier this year expanded the program to YouTube customers who buy YouTube TrueView ads, according to the complaint.
Google has denied the alleged customer privacy violations and said the complaint includes several inaccuracies.
All data is encrypted and aggregated, and Google does not share any identifiable credit card data, the company maintained. It uses only the data that customers have consented to have associated with Web and app activity in their Google account, which users can opt out of at any time.
The FTC has received the EPIC complaint, spokesperson Juliana Gruenwald confirmed.
However, the agency does not comment on investigations, even to confirm that an investigation is taking place, she added.
Google has found itself in the FTC’s crosshairs in the past. In 2012, it paid a then-record US$22.5 million to settle charges that it made misrepresentations to users of Apple’s Safari browser about whether they would be tracked with cookies or have targeted ads pointed at them.
Google’s ability to track ad spending and effectiveness is critical to its core business, which includes selling online ads on its search pages and measuring whether those impressions lead users to actual transactions.
“How much Google gets paid to place ads depends on how effectively Google places the ads,” said Paul Teich, principal analyst at Tirias Research.
“An old measure is click-throughs, but they are hard to verify, easy to game, and may not directly correlate to purchases of goods and services promoted by the ads we click through,” he told the E-Commerce Times.
Google’s dominance over consumer ad spending recently has been a major topic of conversation. The company this spring launched Google Attribution, a product that uses machine learning to measure the success of online marketing campaigns across different devices and channels.
Facebook last month confirmed plans to create a paywall for publishers, due to growing concerns that their articles and ads were drifting over to Google and Facebook, the two dominant platforms for online advertising.
Publishers that once were able to capture substantial online advertising revenues and data have found themselves losing out to the search and social media leaders.
EPIC in essence is trying to give users more control over their own data, particularly in terms of how that information is shared, said Nikki Baird, managing partner at RSR Research.
“The reality is that one too many services have been built on the premise that you get stuff for free in exchange for the provider collecting and monetizing your data,” she told the E-Commerce Times.
On the other hand, while Google could be more forthcoming about how the program works, the system appears to have enough privacy protections that neither Google nor its financial data source would be able to access specific information about individual user purchases, observed Joseph Lorenzo Hall, chief technologist at the Center for Democracy & Technology.
“They’re using some pretty fancy cryptography,” he told the E-Commerce Times, “to essentially mask and unlink individual data and get aggregate counts that don’t implicate individual purchases.”