After the German competition authority raised objections to the conditions of processing personal data back in January, Google has agreed to give users more choice in how the company uses their personal data, the Federal Cartel Office (BKartA) said. Google must now obtain the user’s permission to combine personal data from different sources and use it across the board.
The FCO’s statement confirms that Google will be forced to reverse its privacy-defying decision from January 2012, which consolidated more than 60 separate privacy notices for its products into a single, comprehensive policy. At the time, Google argued that enforcing multiple privacy policies and merging user information would lead to this “a simpler, more intuitive Google interface”. In fact, this move allowed the company to collect much more personal data, expand its user profiling capabilities, and improve ad targeting.
“In the future, Google must give its users the opportunity to give their free, specific, informed and unambiguous consent to the processing of their data by all services.” To this end, Google must offer appropriate options for data merging.”said the FCO, adding that the design of the new “Selection dialogs” should not aim to manipulate users.
The Federal Cartel Office has been investigating Google’s practices to protect personal data since May 2021. The investigation intensified in 2022 after the ministry confirmed that Google could potentially be subject to updated domestic competition rules aimed at tech giants. The regulator said that Google “is of utmost importance for competition in various markets”in accordance with German competition law.
The Federal Cartel Office’s preliminary ruling on Google’s data conditions was that users “did not have sufficient opportunity to choose whether and to what extent they consented to this extensive cross-service processing of their data” – while the options provided by Google were found not to be sufficiently transparent and “too general”.
According to the regulator, Google could “Make the use of services dependent on users’ consent to the processing of their data without providing them with sufficient choice.” The Federal Cartel Office also fears that Google could gain a strategic advantage over competitors who do not have the same comprehensive options for aggregating personal data.
The EU Digital Markets Act (DMA) recently came into force, which provides for restrictions on the aggregation of user data without the user’s consent at a European level that corresponds to German law. Under the new law, Google was recognized as a gatekeeper along with other tech giants after Google Maps, Google Play, Google Shopping, Google Ads Services, Google Chrome, Google Android, Google Search and YouTube were added to the list of so-called gatekeepers. called “Core Platform Services”. Gatekeeper companies have a six-month deadline to bring their operations into compliance with the DMA, meaning major operational changes from companies like Google likely won’t begin until March 2024.
The German regulator explained that due to the entry into force of the European DMA, Google’s obligations to the FCO only apply to products that are not covered by the DMA, which means they cover more than 25 other Google services, including Gmail, Google News , Assistant, Contacts and Google TV.
When asked by journalists what it will look like “Free, specific, informed and unambiguous consent” An FCO spokesman said this “The next step from the side Google will present an implementation plan [новых требований] in the next three months”.
Based on the progress of the Federal Cartel Office’s lawsuit against Meta, some assumptions can now be made✴ – In June, the department announced that Meta✴ will launch a new account center that will give users more choices when combining their personal information. It should be noted that not all users are satisfied with such strict restrictions from regulators, since cross-profiling gave them the opportunity to publish “seamlessly” to other meta-services✴ and they were happy that Meta✴ combined their data for ad targeting.
In accordance with the General Data Protection Regulation (GDPR), Meta✴ There is currently no legal basis for processing the data of its users for targeted advertising. The company originally wanted to obtain consent from EU users to process ads, but recent press reports suggest that Meta✴ has decided to publish its products in the EU on a subscription basis, thereby removing them from the scope of the GDPR.