CookieLaw Blog July 22, 2014

Google Gets a New Privacy Beating

Google has this week been told by Italy’s data protection regulator that it must get explicit consent from users to track them, particularly for behavioural advertising purposes.

Following on from the recent ‘Right to be Forgotten’ ruling, this new decision could be a heavy blow for Google’s business in Italy.  However it could also have much wider ramifications.

The new decision is the result of an investigation into Google’s privacy practices that was triggered when the company adopted its new unified privacy policy for all services in 2012.  The stated aim at the time was to make privacy practices easier for people to understand.  However several EU regulators thought it had gone too far, and was in effect hiding practices by not giving enough detail.

The Garante has now told Google what changes it needs to make to satisfy the requirements of Italian law at least. 

Although the changes required are quite detailed and prescriptive, they boil down to a couple of key points:

  • It needs to change its policy to make clear that it is collecting personal data for profiling and online behavioural advertising.
  • It will need to gain prior explicit consent from both registered and ‘unauthenticated’ users – particularly for advertising tracking.

This ruling has come hot on the heels of the release of guidance from the Guarante no how to comply with Italy’s cookie law – and it is now clear that they needed to do that before they could make this judgement against Google.

Although it is not clear what this will mean for other Italian websites, the decision about explicit consent for advertising tracking is also consistent with an earlier ruling from the Netherlands.  It would certainly appear that taking both these decisions into account, the online advertising industry may have to review its self-regulation model, which is based on an opt-out rather than the opt-in required by these decisions.

Google has been given 18 months to comply – although there is also an option for appeal – which they will almost certainly do.

Recent Posts


January 13, 2017
Future of EU Cookie Compliance Webinar: ...

GDPR and now the proposed E-Privacy Regulation mean a stricter regime for cookie compliance, web governance and use of online tracking technologies. Join p...

View Article
Recent blog thumbnail
December 14, 2016
Draft EU ePrivacy Regulation Leaked...

A draft of the proposed legislation to replace the outdated EU ePrivacy Directive was leaked on the Politico.eu (PDF) website this week. The proposal is fo...

View Article
Recent blog thumbnail
November 3, 2016
GDPR Compliance Means Cookie Notices Mus...

Are you one of those people that ticked the cookie law box ages ago and not thought about it since? Well the game has changed and now is the time to re-vis...

View Article
Recent blog thumbnail
September 21, 2016
Optanon Acquired by OneTrust...

We are pleased to announce that Optanon, along with parent company Governor Technology, has been acquired by OneTrust....

View Article

Be in the Know

Subscribe to our newsletter