Does Google’s U-Turn On Fingerprinting ‘Open New Opportunities’ Or Is It ‘Irresponsible’?

At the end of December, just before the holidays, Google has announced a policy change which caused both cheers and jeers.

As of February 16th, Google said it will no longer ban fingerprints for companies that use its advertising products.

Oh, how times have changed.

From no way to okay

Fingerprinting identifies a device by combining multiple signals into a single digital ID: screen size, browser type, operating system type, battery level, language settings, screen resolution, keyboard plug-ins, IP address, and hundreds of other data points.

In 2019, Justin Schuh, director of Google Chrome engineering, the so-called fingerprints “opaque” technique and highlighted Google’s plans to “more aggressively” block it.

“Unlike cookies, users cannot delete their fingerprints,” Schuh wrote at the time, “and therefore cannot control how their information is collected. We think this subverts user choice and is wrong.”

Fast forward to the present and not “unlike cookies” – actually as well as cookies – Google makes an unexpected turn. (Yeah, yeah, I know, some of you predicted the removal of support for third-party cookiesbut it still surprised me; sue me 😭)

A Google spokesperson explained the fingerprint change to AdExchanger: “We’ve updated our platform policies to reflect new privacy-enhancing technologies that mitigate risk and support the emergence of new channels like Internet-connected TV.”

In other words, rather than banning businesses across the board from using IP addresses (a key component of any device’s fingerprint) for ad targeting and measurement, Google will be less strict about it as long as the data is handled safely and securely.

‘opportunities’

Advertisers and ad trade groups are predictably happy with Google’s talk about fingerprints.

• Jon Halvorson, global vice president of consumer experience and digital commerce at Mondelēz: “This update opens up more opportunities for the ecosystem in an increasingly fragmented and growing space while respecting user privacy.”
• Leigh Freund, president and CEO of the Network Advertising Initiative: “This update opens up new opportunities for us to responsibly enable privacy protection measurement across devices.”
• And Tony Katsur, CEO of the IAB Tech Lab: “This update provides opportunities for the advertising ecosystem to deliver better consumer experiences while mitigating privacy risks.”

You sense a theme here.

Privacy advocates, meanwhile, are a mix of horrified and cynically unsurprised. And privacy representatives are pragmatic as usual.

Google’s policy change doesn’t change reality, said Daniel Rosenzweig, founder of boutique law firm DBR Data Privacy Solutions.

“While allowing IP-based ad targeting appears to signal a shift from previous approaches, the legal basis has not changed much in my view,” Rosenzweig said. “Most privacy laws still classify identifiers used for device fingerprinting, such as an IP address, as personal data.”

The Information Commissioners Office, the UK’s data protection authority, made it even better.

On December 19, a day after Google notified clients of its fingerprint update, ICO’s executive director of regulatory risk, Stephen Almond, posted a post calling the change “irresponsible” and warning businesses that they are “not free to use fingerprints as they please”.

“Like all ad technology,” Almond writes, fingerprinting “must be deployed lawfully and transparently – and if it’s not, the ICO will take action.”

Small print

Which begs the question: Is there even a way to “legally and transparently” deploy fingerprinting?

“In theory, yes,” said Cillian Kieran, CEO and co-founder of privacy startup Ethyca. But “in practice it’s almost impossible.”

And therein lies the rub.

One of the main problems with fingerprinting from a privacy perspective is that people have no way of knowing it’s happening, let alone opting out.

It’s a bit hard to achieve transparency and trust “when the underlying technology is designed to work behind the scenes,” Kieran said.

“Fingerprints are based on opacity; it’s silently collecting data without the user being aware of it,” he said. “Making this process more transparent would require a radical rethinking of how it’s deployed and what the day-to-day user experience is like.”

But the problem with fingerprinting is perhaps even simpler than that, according to Ariella Garcia, chief operating officer of Check My Ads, which is that it’s a loophole in maintaining the status quo of online data collection and ad tracking.

Because if there is transparency and consent, who needs fingerprints?

“If and when people are consciously willing to be tracked, fingerprinting and other probabilistic methods are essentially irrelevant,” Garcia said. “This is inherently a solution to offer and respect informed choice.”

🙏 Thanks for reading – especially at the end of my first full week at work since the holidays. In a few hours it will be me. I’m defeated, but I love getting feedback. As always feel free to drop me a line [email protected] with any comments, suggestions, hot shots or cat videos.