Google may have been sharing potentially sensitive user data with a sanctioned ad tech company owned by Russia’s largest state bank until as recently as June 23, according to a ProPublica report. This comes just four months after the Senate Intelligence Committee warned the tech giant to stay alert for possible exploitation by Russia and Russia-linked entities following the Russian invasion of Ukraine.
Google allowed RuTarget, a Russian company that helps brands and agencies buy digital ads, to access and store data about people browsing websites and apps in Ukraine and other parts of the world, according to research and data from digital ad analysis firm Adalytics. Its findings showed close to 700 instances of RuTarget receiving user data from Google despite the ad tech company being added to the U.S. Treasury’s list of sanctioned entities on Feb. 24. According to ProPublica, the data sharing between the two wouldn’t stop until June 23, the day the publication reached out to Google for comment.
RuTarget is owned by Sberbank, a Russian state bank that, according to the Treasury and ProPublica, is “uniquely important” to the country’s economy. On April 6, Sberbank was added to the U.S. Treasury’s list of Russian entities and people imposed with full blocking sanctions.
The analysis showed that Google shared data about users browsing websites based in Ukraine. This is of concern because critical information such as unique mobile phone IDs, IP addresses, location information, and details about users’ interests and online activity could be used by the Russian government to track people or locations of interest.
A Google spokesperson told ProPublica that the company had blocked RuTarget from using its services back in March. However, Google did acknowledge that user and ad buying data from Google was still being received before being alerted by ProPublica and Adalytics. Google did not immediately respond to Mashable’s request for comment.
One of the biggest concerns from the findings and from legislators is the data from global internet users that gets passed around to companies within the digital ad buying process. This treasure trove of user data, called bidstream data, is used as part of a half a trillion dollar digital ad industry that is dominated by Google, ProPublica says.
ProPublica says that this data is auctioned off in real-time when users visit a site, whereupon entering “within milliseconds, data collected about this user is shared with potential ad buyers to help them decide whether to bid to show an ad to the user.” Ad buying companies like RuTarget, regardless if they bid or not, can receive and store this bidstream data. And since Google operates the world’s largest ad-buying exchange, the more RuTarget connects with ad exchanges like Google’s, the more data and information it can collect.
The findings of the relationship between RuTarget and Google come at a time of increased scrutiny of tech companies from legislators concerned with how tech companies are handling our personal data.
The user data shared by Google to RuTarget and other ad buyers comes from millions of websites and apps that rely on the company for advertising revenue, ProPublica added. Most notably, information from major publishers like ESPN and Reuters was accessible to RuTarget “as a recipient of user data in cookie consent popups shown to users browsing their sites from the EU and other jurisdictions with data privacy laws requiring such disclosures.”
ProPublica and Adalytics findings are troubling, to say the least. The average consumer probably wouldn’t like the idea that up until a few weeks ago their information was being shared with a sanctioned Russian ad company. At the time of this writing, Google is currently in the midst of a class-action lawsuit that alleges the company “does not tell Account Holders which companies are bidding on, and therefore accessing, their personal information.”
