Impotence, substance abuse, brain tumors? New docs reveal ultra-creepy Google ad tracking

Google and other online advertising platforms engage in disturbing privacy violations through the categories they use to target internet users, according to a new filing that reveals just how creepy this data collection can get.

Google and other online ad companies use intimate personal information like political beliefs, religion, sexual orientation, and even diseases and disabilities to target users for advertising, according to new evidence filed by digital rights organizations in Poland, Ireland and the UK. Their complaint takes aim at real-time bidding (RTB), online ad auctions in which highly sensitive information about users gleaned from their browsing history is traded by thousands of third-party companies which use these behavioral profiles to target ads.

“Incontinence,” “special needs kids,” and “gay life” are just a few of the categories on the Internet Advertising Bureau’s list that could infringe on Article 9 of the GDPR, the EU privacy law which bars the use of such sensitive data without explicit consent from users. Since most internet users have no idea these tags are being attached to them, let alone bought and sold by companies they’ve never heard of, this kind of invasive profiling clearly runs afoul of the law, the group says.

Google’s categories are even more invasive: “AIDS & HIV,” “debt collection & repossession,” and “drug and alcohol treatment” are just a few on a list that runs to 53 pages. “’Special category’ personal data like this enjoys special protections in the GDPR. I believe this raises the stakes of our complaint,” said Johnny Ryan of no-track browser Brave, one of the complainants.

Ad auction companies broadcast an average UK internet user’s intimate data profile about 164 times per day, according to the New Economics Foundation. Ryan believes if the industry just made some “minor changes,” excluding sensitive data points that are not actually necessary for ad targeting, it could comply with the GDPR without significantly altering its business model.

“Hugely detailed and invasive profiles are routinely and casually built and traded as part of today’s real-time bidding system, and this practice is treated though it’s a simple fact of life online. It isn’t: and it both needs to and can stop,” said Michael Veale of University College London, another complainant.

Poland is the latest country to sign on to the complaint, with digital rights organization Panoptykon joining the digital rights groups from the UK and Ireland which opened the original case against the ad exchanges last fall.

In response to a TechCrunch article republishing the category lists, Google released a statement claiming they prohibit advertisers from targeting based on “sensitive categories such as race, sexual orientation, health conditions, pregnancy status, etc.” They do not explain why multiple categories under each of those headers can be found on their “Publisher Verticals” list.