Google Customer Match: without consent, dubious from a privacy viewpoint

Widely used and valuable: Google Customer Match. But privacy law will often require consent. Where consent is required and has not been obtained, Google Customer Match is unlawful.

Google Customer Match. A useful system for reaching your own customers through Google. It shows an advertiser’s ads to that advertiser’s own customers when they type a search query related to the advertiser’s products. Provided, that is, that they hold a Google account. Those customers are already customers, so they are likely to feel less hesitant than non-customers about entering into a new agreement with the advertiser.

Besides, the advertiser can make a tailor-made offer that suits the customer perfectly: after all, he knows his customers. In short: many advantages. Rumour has it that conversion rates are excellent. All understandable. And splendid, of course, but there is one drawback: to make this work, Google has to be given access to the customers’ email addresses. And that is a sensitive matter. Where privacy is concerned, Google is hardly a saint.

How does it work?

An advertiser uploads his customers’ email addresses to Google. It could be all of them or a selection; that depends on the purpose of the upload. Google checks which of the uploaded email addresses belong to holders of a Google or YouTube account. The advertiser manages the file, which is hosted by Google. He can add email addresses and other data to it, or delete addresses from it.

The advertiser then shows tailor-made ads, through Google AdWords campaigns, to those of his customers who also hold a Google account. That means that when one of them searches on Google using a word (an adword) the advertiser has ‘claimed’ (the word he pays the most for), they are shown ads that have been selected for them.

If the advertiser deletes email addresses from the list, Google deletes the data indicating that those people are customers of this advertiser.

Another option is for Google to analyse the uploaded file. The aim is to find characteristics that the people in the file have in common, and that are also specific to that file. The reasoning: this is a customer file, so people who are not customers but who do share those characteristics are more likely to become customers than people who do not. The advertiser can then target his AdWords campaigns at those non-customers. These are the look-alike audiences.

The look-alike audiences remain Google’s property. Google uses the file only to send the advertiser’s ads to the people in it, if the advertiser so instructs. This blog is not about look-alike audiences. The only question there is whether adding the label ’look-alike of advertiser X’s customers’ amounts to an invasion of customer privacy. That does not readily appear to be so.

The AdWords campaigns are a different matter.

What is the problem?

First of all, the division of roles. Who is responsible for what? In privacy law, the controller is the party answerable to the people in the file (the customers) for the correct and proper handling of their data. For each operation (uploading, selecting, adding, storing, serving ads) it has to be determined who the controller is.

The advertiser is the controller for the upload to Google. He has to make sure that he is permitted to carry it out. Next, those uploaded customers who also hold a Google account are tracked on Google, in order to see which search terms they enter. If that is a search term the advertiser has claimed, Google shows the customer an ad selected by the advertiser.

Who is the controller for that tracking and for the serving of ads through AdWords? Google is instructed to do this by the advertiser. One could say that the advertiser is solely responsible, and that Google merely acts on the advertiser’s behalf, much as a direct mail house handling printed post simply carries out the advertiser’s wishes. It is questionable, though, whether Google can really play its role down in that way.

I would say that Google’s role is larger than that of a mail house. In the system Google has set up (over which advertisers have no influence whatsoever) the advertiser directs only the choice of adwords and the selection from his customer base. Every other element of the process, the tracking, the bidding, deciding who gets to see which ads and in what order, and so on, is Google’s doing. It is not then a fair assessment to say that Google is merely doing things for these advertisers and that Google itself, like some inanimate tool, is no more than the party carrying them out. Google has an independent position. That makes Google a joint controller alongside the advertiser.

The customer has a relationship with the advertiser. He gave the advertiser his data, and he may have had various reasons for doing so, for instance in order to enter into a contract. In principle the advertiser may use the customer’s data to send the customer ads. The customer understands that third parties may obtain his data so that he can be sent the advertiser’s ads: an email platform, a mail house for printed post, an external call centre. All of them acting on the advertiser’s instructions. But does he understand Google in the same way?

Google, which receives his data (his email address and the fact that he is a customer of the advertiser) in order to show him the advertiser’s ads? That is not self-evident. Particularly where the advertiser has only limited control over what Google does. And Google is itself a joint controller. That makes Google, in relation to the customer, not a powerless extension of the advertiser but an outsider, a third party receiving the customer’s data. That has consequences.

At the very least, when collecting customer data the advertiser should state in his privacy statement that he will be providing certain data to Google. Google says as much in its own terms and conditions. Google’s customer (the advertiser) will have to make clear, when setting out the purposes for which email addresses are used, that those addresses may be passed to social media platforms so that customers can be recognised there as the advertiser’s customers and served with relevant information on that basis.

Is that enough? Or should the advertiser first obtain the customer’s consent before sharing his email address with Google? I tend to think so. The fact is that the advertiser, whose customer this is, is ‘keeping an eye’ on the customer through Google. To do so, his data is shared with Google.

That the advertiser keeps an eye on the customer as he browses the advertiser’s website comes as no surprise to that customer. He may well have consented to it through a cookie. And he knows that Google keeps an eye on him too (these are, after all, customers who hold a Google account). But that the advertiser is tracking him through Google is not something he has to expect. Customers can experience that as an invasion of their privacy. In that case merely informing them does not suffice, and consent has to be obtained.

Moreover, providing data to Google as such, whether Google is a controller or just a powerless tool, is not acceptable to everyone. Until the new arrangement on data transfers to the US, the Court of Justice of the European Union did not think it acceptable either (given the lack of respect for privacy on the part of the US government). That too may make consent necessary before data is provided to Google.

Advertisers who fail to inform their customers and, where required, to obtain consent for Google Customer Match are acting unlawfully. Google may well be acting unlawfully too. To head that off, Google states in its terms and conditions that where consent is needed, it is for the advertiser to obtain it. With that, Google puts the ball in the advertiser’s court. But that does not necessarily let Google off the hook. First, because Google is a controller in its own right. And second, because a party such as Google cannot keep pleading ignorance if it turns out that most of the advertisers using Google Customer Match are doing so unlawfully. That head-in-the-sand strategy will not hold for long.