EPIC, ICCL Enforce Complaint In re Google’s RTB

Summary

On January 16, EPIC and ICCL Enforce filed a complaint with the Federal Trade Commission, alleging that Google’s RTB violates the Protecting Americans’ Data from Foreign Adversaries Act (PADFAA) and the FTC Act. The complaint targets a major part of Google’s business: Google’s Real-Time Bidding (RTB) system which dominates online advertising and operates on 33.7 million websites, 92% of Android apps, and 77% of iOS apps. Much of Google’s $237.9 billion advertising revenue is RTB. Today’s complaint reveals that Google has known for at least a decade that its RTB technology broadcasts sensitive data without any security, according to internal Google discussions highlighted in today’s complaint.

Background

Google LLC provides a range of services in the technology market —with a significant portion of its business concentrated on online advertising. Google dominates the RTB market. The Department of Justice estimates that Google’s RTB business has 87% of the U.S. publisher ad serving market and has 88% of the ad buyer market. Google RTB operates on 35.4 million websites, 91% of Android apps, and 75% of iOS apps. In the digital ad ecosystem, Google is a data broker because it transfers individuals’ data that Google did not collect directly from those individuals.

Google’s RTB system collects troves of personally identifiable sensitive data about United States individuals from other businesses. That data reveals Americans’ employment with the military and intelligence community, locations, political views, financial problems, health, sexuality, ethnicity, and online behavior. Google’s RTB system then makes this data accessible to foreign adversary countries, both directly and indirectly. As this complaint will show, the movements and vulnerabilities of America’s national security decision makers, active military personnel, defense logistics workers, and even judges are available to foreign adversaries as a result. This exposes America’s most sensitive institutions and industries to hacking, blackmail, and compromise by foreign and non-state actors.

EPIC and ICCL Enforce’s Interest

EPIC has long called on the FTC to impose data minimization requirements to protect consumers’ privacy. EPIC has also backed strict prohibitions on the sale of personal information, including in recent comments on the Consumer Financial Protection Bureau’s data brokers rulemaking.

Enforce is a unit of the Irish Council for Civil Liberties (“ICCL”), Ireland’s oldest independent human rights body. ICCL has been at the forefront of every major rights advance in Irish society for over 40 years. Enforce advocates, investigates, and litigates, to defend human rights and civil liberties in the digital domain. Enforce has researched and litigated against the RTB security hazard for several years.