Consumer rights groups in Europe have filed a new series of privacy complaints against Google — accusing the advertising giant of deceptive design around the account creation process that they say steers users into agreeing to extensive and invasive processing of their data.
The tech giant profiles account holders for ad targeting purposes — apparently relying on user consent as its legal basis. But the EU’s flagship data protection law, the General Data Protection Regulation (GDPR), states in a requirement for privacy by design and default, as well as setting clear conditions around how consent must be gathered for it to be lawful.
Hence the consumer groups’ problem — it feels deceptive design by Google is tricking users into accepting its tracking.
They argue the design choices the tech giant deploys around account creation make it far easier for users to agree to Google’s processing of their information to target them with “personalised” ads than to deny consent to its profiling of them for advertising based on behaviour.
The complaints highlight how more privacy-friendly options — described by Google as “manual personalization” — require users to take five steps and ten clicks (“grappling with information that is unclear, incomplete, and misleading,” as they put it); whereas it offers a one-click “Express personalisation” option that activates all the tracking, making it terrible for privacy.
They also point out that Google does not provide consumers with the option to turn all tracking “off” in one click, further noting that Google requires account creation to use certain of its own products, such as when setting up an Android smartphone.