Google Gets a New Privacy Beating

Google has this week been told by Italy’s data protection regulator that it must get explicit consent from users to track them, particularly for behavioural advertising purposes.

Following on from the recent ‘Right to be Forgotten’ ruling, this new decision could be a heavy blow for Google’s business in Italy.  However it could also have much wider ramifications.

The new decision is the result of an investigation into Google’s privacy practices that was triggered when the company adopted its new unified privacy policy for all services in 2012.  The stated aim at the time was to make privacy practices easier for people to understand.  However several EU regulators thought it had gone too far, and was in effect hiding practices by not giving enough detail.

The Garante has now told Google what changes it needs to make to satisfy the requirements of Italian law at least. 

Although the changes required are quite detailed and prescriptive, they boil down to a couple of key points:

• It needs to change its policy to make clear that it is collecting personal data for profiling and online behavioural advertising.
• It will need to gain prior explicit consent from both registered and ‘unauthenticated’ users – particularly for advertising tracking.

This ruling has come hot on the heels of the release of guidance from the Guarante no how to comply with Italy’s cookie law – and it is now clear that they needed to do that before they could make this judgement against Google.

Although it is not clear what this will mean for other Italian websites, the decision about explicit consent for advertising tracking is also consistent with an earlier ruling from the Netherlands.  It would certainly appear that taking both these decisions into account, the online advertising industry may have to review its self-regulation model, which is based on an opt-out rather than the opt-in required by these decisions.

Google has been given 18 months to comply – although there is also an option for appeal – which they will almost certainly do.