Jul 04, 2022 16:20:00

Google turns out to have shared user data for months after Russian advertising companies were sanctioned

After Russia's invasion of Ukraine began in February 2022, the United States sanctioned many Russian companies and banned them from trading. However, until June 23, more than a few months after the sanctions began, Google shared user data with RuTarget, an advertising company owned by

Russia 's largest bank, Sberbank, a non-profit news agency in the United States. ProPublica reported.

Is Google sharing data from Americans and Europeans with sanctioned Russian adtech companies?
https://adalytics.io/blog/sanctioned-ad-tech-user-data

Google Let Sberbank-Owned RuTarget Harvest User Data for Months — ProPublica
https://www.propublica.org/article/google-russia-rutarget-sberbank-sanctions-ukraine

ProPublica: Google shared user data with Russia firm
https://www.fastcompany.com/90766295/google-sharing-user-data-russia-propublica

On February 24, 2022, when Russia began its invasion of Ukraine, the U.S. Treasury listed various Russian companies on the list of sanctioned companies, including advertising companies that support the purchase of digital ads for companies and brands. RuTarget was also included. However, according to a survey by digital ad analysis company Adalytics, Google continued to provide user data even after RuTarget was added to the list of sanctioned companies. Adalytics has identified nearly 700 cases where Google shared user data with RuTarget, and it seems that data sharing with RuTarget was finally stopped on June 23 when ProPublica contacted Google about this matter. ..

The survey also shows that Google shared data with RuTarget about users who browsed Ukraine-based websites. These data include unique mobile IDs and IP addresses, location information, details about user interests and online activities, and could be used by the Russian military and intelligence agencies to track people. Is also concerned.

Krzysztof Franaszek, who runs Adalytics, said RuTarget's ability to access and store Google's user data could have serious potential negative consequences. 'As far as we know, RuTarget can take this data and combine it with 20 other data sources to find out where the target is.' 'RuTarget's data partners include the Russian government and If intelligence agencies, cyber criminals were involved, there is a great danger. '

Google spokeswoman Michael Aciman claims that Google blocked RuTarget's use and purchase of advertising products in March 2022, and RuTarget hasn't purchased ads directly via Google since then. However, he admitted that RuTarget was still purchasing data about users and ads before being warned by ProPublica.

'Google is committed to complying with all applicable sanctions and trade compliance laws.' 'We are considering the entity in question and taking steps earlier this year to block the direct use of Google advertising products. In addition, we have taken appropriate enforcement measures, 'said Aciman.

Democratic Senator Mark Warner, chairman of the U.S. Senate Intelligence Committee, warns against 'platform exploitation by Russian-related organizations' in a (PDF file)

letter sent to Google on February 25. I was informed, but I'm disappointed that I didn't break my relationship with RuTarget. 'All companies are responsible for ensuring that Vladimir Putin's invasion of Ukraine is not funded or inadvertently supported. American companies may be sharing user data with Russian companies. Yes, and I'm incredibly worried and frankly disappointed to hear that the company is owned by a sanctioned Russian bank. '

In online advertising, inventory sales and bids are traded on a platform called

Ad Exchange , using a method called real- time bidding (real-time bidding) . In this online advertisement purchase process, data such as mobile ID, IP address, location information, interests of the target user are exchanged between companies, and the advertising company decides how much to bid based on these data. I have decided.

Advertising companies like RuTarget can receive and store these data regardless of whether they actually make a successful bid and create a rich data repository over time. Justin Sherman, a lecturer at Duke University's Graduate School of Public Policy, said that these data exchanged during the online advertising process are largely unregulated and contain no personal information such as names or emails, but very much. He pointed out that it must be highly confidential. 'There is growing interest in how our data ecosystem, and the ecosystem of data brokers and advertisers, provides, sends, and sells highly sensitive information about Americans to foreign businesses. There are also concerns about unauthorized access to that data by foreign institutions. '

A group of lawmakers, including Warner and Senator Ron Wyden, told Google and other ad exchanges in April 2021 that data leaked from the advertising business could be misused by hostile countries and institutions. Please list the domestic and foreign partners who shared the data. ' However, Google refused to list it because it had a 'non-disclosure obligation'. However, Franaszek argues that some companies that share bid data with Google have made their relationship public, and it's ambiguous what Google calls 'non-disclosure obligations.' Google's official page also lists at least 13 real-time advertising auction bidders, saying, 'Google has a list of foreign partners a few months before telling Senators that they have a'non-disclosure obligation'. We published it on our website, 'Franaszek points out.

Websites that shared user data with RuTarget through Google included Reuters and ESPN. The customers listed on RuTarget's website also included international companies such as MasterCard, Hyundai, PayPal, and Pfizer. In response to a ProPublica inquiry, Pfizer replied, 'Investigation has revealed that Pfizer currently has no relationship or record with RuTarget.'