Electronic Privacy Information Center  
     

Privacy? Proposed Google/DoubleClick Deal

Top News | EPIC's Complaint | EPIC's June 2007 Supplement to the Original Complaint | EPIC's September 2007 Supplement to the Original Complaint |FTC Authority | Antitrust Experts on Privacy Review by FTC | FTC Review of EPIC DoubleClick Complaint | Impact of Search Engines | Google's Business Practices | DoubleClick's Business Practices | Google and Privacy | European Review of Google Merger | FTC Review of EPIC Microsoft Passport Complaint | FTC Review of EPIC Choicepoint Complaint | Complaint's Parties | Resources | Editorials | News Items

On April 20, 2007, EPIC, CDD, and US PIRG filed a complaint (pdf) with the Federal Trade Commission, requesting that the Commission open an investigation into the proposed acquisition, specifically with regard to the ability of Google to record, analyze, track, and profile the activities of Internet users with data that is both personally identifiable and data that is not personally identifiable. EPIC further urged the FTC to require Google to publicly present a plan to comply with well-established government and industry privacy standards such as the OECD Privacy Guidelines. Pending the resolution of these and other issues, EPIC encouraged the FTC to halt the acquisition. The three groups filed a supplement (pdf) to the complaint with the Commission in June.

On September 17, 2007, at the National Press Club, EPIC, the Center for Digital Democracy, and US PIRG announced a second supplement (pdf) to the groups' original complaint (pdf) and subsequent supplement (pdf) with the FTC concerning the proposed Google-DoubleClick merger. The amended complaint detailed new facts supporting the conclusion that the FTC should block Google's proposed acquisition of DoubleClick.

The FTC has made a "second request" in its review of Google's merger with DoubleClick (the world’s largest Internet advertising technology firm). According to FTC Chair Majoras's statement (pdf) on the merger review process, "the majority of investigations in which the FTC issued a second request resulted in a merger challenge, consent order, or modification to the transaction, suggesting that the FTC generally issues second requests only when there is a strong possibility that some aspect of the investigation would violate the antitrust laws."

At a hearing on "An Examination of the Google-DoubleClick Merger and the Online Advertising Industry: What Are the Risks for Competition and Privacy?" on September 27, 2007, Sen. Herb Kohl said (pdf), "Some commentators believe that antitrust policymakers should not be concerned with these fundamental issues of privacy, and merely be content to limit their review to traditional questions of effects on advertising rates. We disagree. The antitrust laws were written more than a century ago out of a concern with the effects of undue concentrations of economic power for our society as a whole, and not just merely their effects on consumers’ pocketbooks. No one concerned with antitrust policy should stand idly by if industry consolidation jeopardizes the vital privacy interests of our ciitzens so essential to our democracy."

On December 21, 2007, the FTC approved the proposed merger without conditions in a 4-1 opinion (pdf). EPIC responded (pdf), saying that the unique circumstances of the online advertising industry required the FTC to impose privacy safeguards as a condition of the Google- Doubleclick merger. EPIC said that the FTC "had reason to act and authority to act, and failed to do so."

At a hearing before the European Parliament on January 21, 2008, EPIC President Marc Rotenberg testified (pdf) that the European Commission must establish privacy safeguards because the US Federal Trade Commission failed to do so (pdf) during the US merger review. Mr. Rotenberg also said that Google was beginning to reveal the characteristics of an "information monopolist" and that it was important for governments to act to preserve the rights of citizens and to safeguard competition and innovation in the information economy. .

Top News

EPIC's Complaint

On April 20, 2007, EPIC, CDD, and US PIRG filed a complaint (pdf) with the Federal Trade Commission (FTC), urging the Commission to open an investigation into the proposed acquisition of DoubleClick by Google. The groups urged the FTC to assesses the ability of Google to record, analyze, track, and profile the activities of Internet users with data that is both personally identifiable and data that is not personally identifiable. The groups stressed that the increased collection of personal information of Internet users by Internet advertisers poses far-reaching privacy concerns that the FTC should address. The groups further noted that Google fails to follow previously agreed upon standards for online advertising conduct, and urged the FTC to to require Google to publicly present a plan to comply with these standards. Pending the resolution of these and other issues, EPIC encouraged the FTC to halt the acquisition.

EPIC's June 2007 Supplement to the Original Complaint

On June 6, 2007, EPIC, CDD, and US PIRG filed a supplement (pdf) to the groups' original complaint (pdf) with the Federal Trade Commission (FTC) concerning the Google/DoubleClick merger. The new complaint explains the need for the FTC to consider consumer privacy interests in the context of a merger review involving the Internet's largest search profiling company and the Internet's largest targeted advertising company. The complaint provides additional evidence about Google and DoubleClick's business practices that fail to comply with generally accepted privacy safeguards, and proposes further steps that the Commission should take if the merger is to be approved.

EPIC's September 2007 Supplement to the Original Complaint

On September 17, 2007, at the National Press Club, EPIC, the Center for Digital Democracy, and US PIRG announced a second supplement (pdf) to the groups' original complaint (pdf) and subsequent supplement (pdf) with the FTC concerning the proposed Google-DoubleClick merger. The amended complaint detailed new facts supporting the position that "Google and DoubleClick have engaged in unfair and deceptive trade practices in violation of Section 5 of the Federal Trade Commission Act [. . . and] Google and DoubleClick have failed to establish adequate privacy safeguards to protect the interests of Internet users." The groups said, "[P]ending the establishment in fact of such protection, the Commission should block the proposed merger."

FTC Authority to Act

The FTC's primary enforcement authority with regards to privacy is derived from 15 U.S.C. § 45, commonly known as section 5 of the Federal Trade Commission Act (FTCA). Section 5 of the FTCA allows the FTC to investigate "unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce." Although this law does not grant the FTC specific authority to protect privacy, over the last number of years it has been used to bring public attention to significant privacy issues and to provide a legal basis so as to reform business activities that threaten consumer privacy.

Antitrust Experts on Privacy Review by FTC

Impact of Search Engines

Internet search engines, such as those offered by Google, Yahoo, and Microsoft, are the primary means by which individuals access content on the Internet. Search terms entered into the main Google search engine alone may reveal a plethora of personal information such as an individual's medical issues, associations, religious beliefs, political preferences, sexual orientation, and investments monitored. In 2005, more than 60 million American adults used search engines on a typical day. The number is no doubt much higher today.

FTC Review of EPIC DoubleClick Complaint (2000 - 2001)

The Federal Trade Commission has previously investigated DoubleClick Inc. for violations of the Federal Trade Commission Act. On February 10, 2000, EPIC filed a complaint with the FTC concerning the information collection practices of DoubleClick. EPIC alleged that DoubleClick was unlawfully tracking the online activities of Internet users and combining surfing records with detailed personal profiles contained in a national marketing database. EPIC asked the FTC to investigate the practices of the company, to destroy all records wrongfully obtained, to invoke civil penalties, and to enjoin the firm from violating the Federal Trade Commission Act. On February 14, 2000, DoubleClick revealed in a document filed with the Securities and Exchange Commission that the FTC was investigating the company's privacy practices.

On March 2, 2000, DoubleClick CEO Kevin O'Connor released a statement that said that the company made a "mistake by planning to merge names with anonymous user activity across Web sites in the absence of government and industry privacy standards."' The FTC investigation into the company's privacy practices continued.

On January 22, 2001, the FTC released a letter announcing that it had closed its investigation of DoubleClick. The letter listed a number of commitments DoubleClick agreed to make, including a commitment to abide by the NAI Privacy Principles.

Google's Business Practices

Google operates the largest Internet search engine in the United States. According to a comScore press release, Google captured almost 50% of the U.S. search engine market in March 2007, with approximately 3.5 billion search queries were performed on Google web sites. Google's services include:

  1. Google search: any search term a user enters into Google;
  2. Google Desktop: an index of the user's computer files, e-mails, music, photos, chat, and web browser history;
  3. Google Talk: instant-message chats between users;
  4. Google Maps: address information requested, often including the user's home address for use in obtaining directions;
  5. Google Mail (Gmail): a user's e-mail history, with default settings set to retain e-mails "forever";
  6. Google Calendar: a user's schedule as inputted by the user;
  7. Google Orkut: social networking tool storing personal information such as name, location, relationship status, etc.;
  8. Google Reader: which ATOM/RSS feeds a user reads;
  9. Google Video/YouTube: videos watched by user;
  10. Google Checkout: credit card/payment information for use on other sites.

Google stores its users' search terms in connection with their Internet Protocol (IP) address, a unique string of numbers that identifies each individual computer connected to the Internet. When a user enters a search term into Google's search engine, Google's servers automatically log the user's web request, IP address, browser type, browser language, the date and time of the request and one or more cookies that may uniquely identify the user's browser. As a user's Web request includes the requested search term, Google's logs link a user's personally-identifiable IP address with their search terms. A January 2006 poll of 1,000 Google users found that 89% of respondents think their search terms are kept private, and 77% believed that Google searches do not reveal their personal identities. These numbers indicate that Google's practices violate the public's expectation of privacy with respect to the collection and use of search history data. Though Google tracks its users' search activity in connection with their IP address, Google does not currently use this data to engage in behavioral targeting.

DoubleClick's Business Practices

DoubleClick is a leading provider of Internet-based advertising. The company places advertising messages on Web sites. DoubleClick reaches an estimated 80 to 85 percent of the users of Internet. Its customers include Time Warner's AOL and Viacom's MTV Networks.

DoubleClick tracks the individual Internet users who receive ads served through DoubleClick. When a user is first "served" an ad, DoubleClick assigns the user a unique number and records that number in a "cookie" file stored on the user's computer. As that user subsequently visits other Web sites on which DoubleClick serves ads, he or she is identified and recorded as having viewed each ad. DoubleClick stores a user's history for two years. Using the unique numbers contained in cookies, DoubleClick's "DART" (Dynamic, Advertising, Reporting, and Targeting) technology enables advertisers to target and deliver ads to Web users based on pre-selected criteria.

Google and Privacy

According to comScore, three out of every 10 (30.1 percent) of U.S. Internet users streamed video from YouTube.com, recently acquired by Google, in March 2007 alone. YouTube Chief Marketing Officer Suzie Reider recently revealed that YouTube will expand the amount of user demographic data it retains later this year. Reider stated, "We'll never have had [sic] that much data about that much content. [. . .] By Q3 we'll have a tremendous amount of metrics and data around every video. There's lots you can glean from looking at who's looking at what. It's a real-time focus group that happens all day, every day." (quote from AdAge).

European Review of Google Merger

On May 16, 2007, the European Union's Article 29 Data Protection Working Party launched an investigation into Google's privacy practices. In a letter (pdf) to Google, chair of the Article 29 Working Party, Peter Schaar asked whether the company has "fulfilled all the necessary requirements" to abide by EU privacy rules. Mr. Schaar explained, "As you are aware, server logs are information that can be linked to an identified or identifiable natural person and can, therefore, be considered personal data in the meaning of Data Protection Directive 95/46/EC. For that reason, their collection and storage must respect data protection rules." EU Directive 95/46/EC states that individuals' personal information can only be collected for "specified, explicit and legitimate purposes." Information that is collected can only be kept in identifiable form for as long as is "necessary for the purposes for which the data were collected or for which they are further processed."

Earlier this year, Google announced that it was changing its privacy policy, and would maintain user-specific information from Web searches for a period of 18 to 24 months. Google previously stored this information for as long as it was useful. After the 18- to 24-month period, the company claims that it will obscure the data, making it more difficult to identify individuals. This change "does not seem to meet the requirements of the European legal data protection framework," Mr. Schaar wrote. The Working Party requested a detailed explanation from Google as to 1) "why this long storage period was chosen" for the server logs, 2) "the purposes for which server logs need to be kept," and 3) "Google's legal justification for the storage of server logs in general." Also, the Working Party questioned whether the 30-year lifetime of the "Google cookie," which tracks users, "goes beyond what seems to be 'strictly necessary' for the provision of the service."

Mr. Schaar pointed to the "Resolution on Privacy Protection and Search Engines," (pdf) which urged data minimization and addressed several issues with regard to server logs and the detailed profiling of users. "The Article 29 Working Party fully supports this Resolution and would appreciate the detailed views of Google on the steps which it has taken to fully implement its recommendations." The Working Party will discuss the investigation into Google's privacy practices at its meeting in June and requested that the company respond before then. European Justice Commissioner Franco Frattini is backing the investigation.

In a September 26, 2007 letter to the European Commissioner for Competition, the Data Protection Commissioner of the German federal state of Schleswig-Holstein urged the rejection of the proposed Google-DoubleClick merger. "At present we have to assume that in the event of a takeover of DoubleClick the databases of that company will be integrated into those of Google, with the result that fundamental provisions of the European Data Protection Directive will be violated," said Thilo Weichert.

The European Parliament will hold a hearing on the proposed Google-DoubleClick merger on January 21, 2008. EPIC has been invited to testify.

FTC Review of EPIC Microsoft Passport Complaint (2001 - 2002)

On July 26, 2001, EPIC and twelve organizations submitted a complaint (pdf) to the FTC, detailing serious privacy implications of Microsoft Windows XP and Microsoft Passport. The complaint alleged that Microsoft “has engaged, and is engaging, in unfair and deceptive trade practices intended to profile, track, and monitor millions of Internet users,” and that the company's collection and use of personal information violated Section 5 of the Federal Trade Commission Act.

After Microsoft announced a series of changes to Windows XP and Passport in response to the complaint, EPIC et al. submitted a supplement (pdf) to the FTC further detailing specific ways Microsoft XP and Passport would harm consumer interests.

The privacy and security risks outlined in the complaint were: facilitation of online profiling through a sign on requirement into Passport in order to view web content; covert sharing of consumer's personal information within the MSN network; an increase in the amount of unsolicited commercial e-mail from the sharing of e-mail addresses within the MSN network (with no option for the consumer to opt-out of such a system); and Microsoft's failure to establish adequate security standards to ensure that personal information held by Microsoft, such as credit card data, were protected from disclosure to a third party.

In August 2002, the FTC announced a settlement in its privacy enforcement action against Microsoft. The settlement required that Microsoft establish a comprehensive information security program for Passport, and prohibited any misrepresentation of its practices regarding information collection and usage.

The agreement was significant because the FTC did not uncover any security breaches, but acted nonetheless based on the potential for a security problem. This action demonstrated that the FTC has the authority to protect online privacy, and that the commission will hold companies to a very high standard in their representations to consumers about privacy policies. Since the FTC settlement of the EPIC complaint against Passport, industry groups have moved toward decentralized
identity systems that are more robust, provide more security, and are better for privacy. For more information, see EPIC's page on Microsoft Passport Investigation Docket.

FTC Review of EPIC ChoicePoint Complaint (2004-2006)

In December 2004, EPIC filed a complaint with the Federal Trade Commission against databroker ChoicePoint. EPIC urged the agency to investigate the compilation and sale of personal dossiers by data brokers such as ChoicePoint. EPIC argued that the dossiers may constitute "consumer reports" for purposes of the Fair Credit Reporting Act, thus subjecting both the information seller and the buyer to regulation under the Act. Furthermore, EPIC argued that it is incumbent upon the Commission to analyze whether the sale of these dossiers circumvents the Act, giving businesses, private investigators, and law enforcement access to data that previously had been subjected to Fair Information Practices.

In February 2005, EPIC supplemented the ChoicePoint complaint and raised three additional issues relevant to the rise of commercial databrokers. First, an article written by Robert O'Harrow Jr. of the Washington Post quoted ChoicePoint representatives saying that the company acts like an "intelligence agency" and that the data industry should be subject to new regulations because of how personal information is being used. O'Harrow's article demonstrated the reliance on commercial data brokers for decision-making, and the growing importance that the brokers' data be accurate and their practices accountable to the public. Second, the letter included a dialogue from Declan McCullagh's Politechbot.com mailing list concerning the December 2004 complaint. A list message from a private investigator who uses ChoicePoint noted that the company maintains an audit trail of clients who access personal information. The EPIC supplement points out that law enforcement users are not subject to the audit trails, and that EPIC is unaware of a single case where a commercial databroker has turned in a user for prosecution as a result of an audit showing prohibited use of the service. Last, the EPIC supplement included a transcript of a recent television broadcast, "Someone's Watching," that aired on Dec. 18, 2004, on the Discovery Times Channel. The broadcast shows two private investigators using a commercial databroker to access a stranger's Social Security Number, employment details, and other information without any legal justification.

In 2005, based on the EPIC complaint, the FTC alleged (pdf) that ChoicePoint did not have reasonable procedures to screen and verify prospective businesses for lawful purposes and as a result compromised the personal financial records of more than 163,000 customers in its database. Because of this breach, the FTC alleged that ChoicePoint violated the Fair Credit Reporting Act by furnishing the financial records to subscribers that did not have a permissible purpose to obtain them. The FTC additionally alleged that ChoicePoint engaged in unfair or deceptive practices in violation of Section 5 of the Federal Trade Commission Act.

In January 2006, the FTC announced a settlement (pdf) with ChoicePoint, requiring the company to pay $10 million in civil penalties and provide $5 millions for consumer redress. It is the largest civil penalty in FTC history. ChoicePoint was also required to verify, "(1) the business identity of the subscriber, and (2) that the subscriber is a legitimate business engaged in the business certified and has a permissible purpose for obtaining consumer reports." The FTC also required ChoicePoint to establish, implement, and maintain "a comprehensive information security program that is reasonably designed to protect the security, confidentiality, and integrity of the personal information it collects from or about consumers."

Additional Parties to the Complaint

Center for Digital Democracy
The Center for Digital Democracy (CDD) is a nonprofit organization working to ensure that the digital media systems serve the public interest. CDD is committed to preserving the openness and diversity of the Internet in the broadband era, and to realizing the full potential of digital communications through the development and encouragement of noncommercial, public interest programming. For more information on CDD's position on the Google/DoubleClick merger, visit CDD's Jeff Chester's blog entries on the subject.

U.S. Public Interest Research Group
The U.S. Public Research Group (U.S. PIRG) serves as both the federal advocacy office for and the federation of non-profit, non-partisan state Public Interest Research Groups, with over one million members nationwide. U.S. PIRG is a strong supporter of fair, competitive marketplace practices, including compliance with the OECD Guidelines for the Protection of Privacy.

Resources

Editorials on Google

News Items