Google, Microsoft, Others May Have Unknowingly Shared Data With Sanctioned Russian Companies
Google, Microsoft, Others May Have Unknowingly Shared Data With Sanctioned Russian Companies
Google may reportedly have provided Sberbank-owned RuTarget with unique mobile phone IDs, IP addresses, location information and details about users’ interests and online activity. Publishers connected to Google may also have been unknowingly involved.
RuTarget, the advertising-technology firm owned by a Russian state bank, had visibility into Google’s user data until late in June.
Senate Intelligence Committee Chairman Mark Warner sent a letter to Google the day after Russia’s invasion of Ukraine. The letter warned Google to look for “exploitation of your platform by Russia and Russian-linked entities.” It also called on the company to audit compliance for its advertising business with regard to economic sanctions.
Google unknowingly allowed RuTarget to access and store data about people who were browsing websites and apps, according to research from digital advertising analysis firm Adalytics. The data was initially reported by ProPublica, a nonprofit newsroom.
Adalytics identified several hundred examples of user matching. Many are examples of the types of user data RuTarget received from Google after the company, and others were added to a U.S. Treasury list of sanctioned companies and people on February 24.
Data sharing between Google and RuTarget stopped four months later on June 23, after it contacted Google about the activity.
About 16 of the vendors — including RuTarget and Yandex — that are eligible to receive CCPA bid requests from Google Ad Manager and Google Ad Exchange appear to be based in Russia.
RuTarget was still listed as a demand-side platform, on Google’s ad Manger Certified Vendors list as of June 30th, 2022.
Microsoft-owned Xandr also appeared to list RuTarget as one of its “third-party partners which may receive Platform Data and other Information (as defined in Xandr’s Platform Privacy Policy) as a result of their partnership with Xandr,” according to Adalytics.
“All companies have a responsibility to ensure that they are not helping to fund or even inadvertently support Vladimir Putin’s invasion of Ukraine,” Senator Mark Warner, the Chair of the U.S. Senate Intelligence Committee, told Adalytics after the firm reached out to him with the findings. “Hearing that an American company may be sharing user data with a Russian company – owned by a sanctioned, state-owned bank no less – is incredibly alarming and frankly disappointing. I urge all companies to examine their business operations from top to bottom to ensure that they are not supporting Putin’s war in any way.”
Media publishers may be unintentionally sharing data with sanctioned Russian ad-tech platforms, because each integrates extensively with Google’s ad-serving platforms, and are indirectly integrated through third parties and vendors eligible to buy or transact through Google.
Adalytics provided this example: if a user, particularly in Europe, visits reuters.com for the first time, they see a consent modal asking the user for permission to collect and share some data. The consent modal is powered by OneTrust, and includes a list of third-party vendors that Reuters is asking for permission to share data with — participants in the Interactive Advertising Bureau’s Transparency & Consent Framework, as well as vendors that work primarily through an integration with Google, listed as Google Vendors.
Other companies through digital tag triggers asked to share data with RuTarget. Some include ESPN.com, dailycaller.com, weather.com, theatlantic.com, transfermarkt.com, Tripadvisor.co.uk, ign.com, and express.co.uk.
(8)
