Privacy Concerns Arise Over Google’s New Tracking Tool

The Electronic Privacy and Information Center (EPIC) is requesting that the Federal Trade Commission investigate Alphabet’s (NASDAQ:GOOG) Google over its new tool to track in-store shopping. The privacy advocacy group wants the FTC to “determine whether it adequately protects the privacy of millions of American consumers.” EPIC filed its formal legal complaint on Monday.

Google’s new Store Sales Management program debuted in May. The Google program is intended to help push retail and sales into the modern era. Executives have called the program a “revolutionary” breakthrough in advertisers’ abilities to track consumer behavior.

Store Sales Measurement allows the company to combine credit card and other financial data acquired from data brokers to illustrate what goods and services are being searched for online that later become actual in-person sales. The system could show which online advertisements and other information are helpful in driving consumers to buy offline.

Google says that it has created a completely new, custom-made encryption for the program to keep its users’ data “private, secure, and anonymous.” The anonymized and encrypted transaction data is then automatically matched to the millions of U.S. users of Google and Google-owned services, like Gmail, search, YouTube and maps. Google claims its anonymization feature masks names, credit card numbers, location, and other potentially private data. Google said this approach prevents it from accessing the credit or debit card data for individuals.

The privacy organization is asking the government to review the algorithm itself. Because the algorithm that Google uses is secret, there is no way to determine how well customers’ privacy is being protected. The organization points out that purchases can indicate medical conditions, religious beliefs and other intimate information.

Google has claimed having access to 70 percent of U.S. customers credit or debit card records. Users’ data is being collected not just by Google directly, but is also taken from retailers and other outlets. Google would not disclose which companies were providing it with the transaction records. Without the sources being named, it is difficult for privacy-minded consumers to know whether or where their data is being used.

It seems practically impossible for consumers to avoid this potential tracking. EPIC says in its filing that “there appears to be no mechanism by which Google users can opt out of purchase tracking other than by disabling location tracking entirely.” EPIC also notes that “there does not appear to be a way to prevent Google from matching user data to credit card transaction data held by a third party.” None of the opt-out descriptions specifically describes credit card data.