On December 13, the New Mexico Attorney General announced a settlement with Google to resolve claims regarding children’s privacy, including in the burgeoning EdTech space. The federal lawsuits Balderas v. Tiny Lab Productions, et al. and Balderas v. Google LLC, respectively, alleged COPPA and privacy violations related to collection of children’s information on
Last Monday, Google released its answer to the CCPA: a new “service provider” contract. Given Google’s widely used advertising and analytics technologies, Google’s new contract has the potential to influence how website publishers, advertisers, the Ad Tech industry, and software as a service (SaaS) providers approach compliance with California’s new privacy law.
No “Sales” …
On Monday, France’s Data Protection Agency announced that it levied a €50 million ($56.8 million) fine against Google for violating the EU’s new General Data Protection Regulation (GDPR). The precedent-setting fine by the Commission Nationale de l’Informatique et des Libertés (“CNIL”) is the highest yet imposed since the new law took effect in May 2018.
How Does Google Violate GDPR, According to CNIL?
- Lack of Transparency: GDPR Articles 12-13 require a data controller to provide data subjects with transparent, intelligible, and easily accessible information relating to the scope and purpose of the personal data processing, and the lawful basis for such processing. CNIL asserts that Google fails to meet the required level of transparency based on the following:
- Information is not intelligible: Google’s description of its personal data processing and associated personal data categories is “too generic and vague.”
- Information is not easily accessible: Data subjects must access multiple Google documents or pages and take a number of distinct actions (“5 or 6”) to obtain complete information on the personal data that Google collects for personalization purposes and geo-tracking.
- Lawful basis for processing is unclear: Data subjects may mistakenly view the legal basis for processing by Google as legitimate interests (that does not require consent) rather than individual consent.
- Data retention period is not specified: Google fails to provide information on the period that it retains certain personal data.
- Invalid Consent: Per GDPR Articles 5-7, a data controller relying on consent as the lawful basis for processing of personal data must be able to demonstrate that consent by a data subject is informed, specified, and unambiguous. CNIL claims that Google fails to capture valid consent from data subjects as follows:
- Consent is not “informed”: Google’s data processing description for its advertising personalization services is diluted across several documents and does not clearly describe the scope of processing across multiple Google services, the amount of data processed, and the manner in which the data is combined.
- Consent is not unambiguous: Consent for advertising personalization appears as pre-checked boxes.
What Does This Mean for Other Companies?…
On July 5, bipartisan Attorneys General from 11 states filed an astonishing brief in the Third Circuit Court of Appeals, asking that court to reject the proposed class action settlement in In re Google Inc. Cookie Placement that would give settlement monies to non-profits rather than class members.
The plaintiffs in Google Cookie allege that …
Last week, the U.S. Court of Appeals for the Third Circuit revived several privacy claims against Google pertaining to the Internet company’s practice of side-stepping “cookie blockers” on Microsoft’s Internet Explorer and Apple’s Safari browsers.
The Third Circuit found that Google intentionally circumvented “cookie blockers” on Internet browsers by exploiting loopholes found in the cookie…