Google Hit For Sharing Data With Sanctioned Russian Ad Firm

Google was sharing user data with a sanctioned state-owned Russian ad company until ProPublica alerted the Silicon Valley giant last month.

Photo Insert: Google may have exchanged data such as unique mobile phone IDs, IP addresses, location data, and information about users' interests and online activities.

The shared data may have included sensitive location info and mobile IDs of people browsing websites and apps based in Ukraine, Craig Silverman reported for the Dispatches newsletter of ProPublica.

According to Silverman, the report was largely based on data collected and analyzed by digital marketing researcher Krzysztof Franaszek.

RuTarget (also known as Segmento) is owned by Sberbank, a Russian state bank characterized by the US Treasury as "uniquely important" to the country's economy when sanctions were imposed.

RuTarget sells advertising to businesses and agencies, and it is a Google partner. RuTarget's capacity to obtain and keep user data from Google, according to Franaszek, could open the door to major potential abuse.

In a statement to ProPublica, Sen. Mark Warner, a Virginia Democrat, called Google’s failure to sever its relationship with RuTarget alarming. “All companies have a responsibility to ensure that they are not helping to fund or even inadvertently support Vladimir Putin’s invasion of Ukraine.

Hearing that an American company may be sharing user data with a Russian company — owned by a sanctioned, state-owned bank no less — is incredibly alarming and frankly disappointing,” he said.

Google halted all ads in Russia and its engagement with Russian advertisers following Russia's February invasion of Ukraine. The US then imposed full blocking sanctions on Sberbank and RuTarget. Despite this, RuTarget was able to continue accessing user data via Google.

RuTarget was able to pull data because it was a Google partner. And Google neglected to disable this access following the February invasion. It's the kind of threat to privacy and national security that a group of US senators warned about last year.

They urged Google and other major ad exchanges to provide a list of all foreign-owned corporations with whom they share bidstream data. Google denied this on the grounds of "non-disclosure obligations."

Adalytics, a digital ad analysis firm, documented RuTarget extracting user data nearly 700 times, including information about users accessing Ukrainian websites.

Google may have exchanged data such as unique mobile phone IDs, IP addresses, location data, and information about users' interests and online activities. As part of the digital ad buying process, these "bidstream" data are transmitted between publishers and purchasers, with Google acting as the ad exchange in the midst.

WEEKLY FEATURE : MVP Group Keeps Lights On During Pandemic