Google ad tech breakup bill raises new privacy concerns

A newly proposed law would break up Google’s legacy ad business, but there are concerns from some corners of the ad tech world that the bill could unleash more chaos into the online ad trade by introducing more parties to online ad auctions in ways that could expose data. 

On Thursday, U.S. lawmakers, including Sens. Mike Lee, Amy Klobuchar, Ted Cruz and Richard Blumenthal, co-sponsored the bill that would decouple Google from its ad tech business, which is a platform for buying and selling ads online. There are some core components of the proposed legislation that raised concerns about privacy in online ad marketplaces.

“This could hurt privacy in big ways,” said Zach Edwards, a privacy researcher and advocate at Victory Medium, an analytics agency.

The proposed law is just the latest legal and regulatory challenge to Google’s dominance in the online ad ecosystem. Google also is under an antitrust review, after lawmakers and regulators made a case against the company claiming it abused its market position as both the seller and buyer of online ads. Edwards is pro-regulation that protects privacy and publishers, including advocating for privacy bills for the U.S., like the one in Europe called the General Data Protection Regulation. But the latest bill breaking up Google’s ad business, which was once known as DoubleClick, may have unintended consequences, Edwards said, including possibly exposing more consumer data.

“Google could also potentially respond by breaking the bidstream even further,” Edwards, said in a message to Ad Age, “and I believe this type of legislation pushes them to do it.” (A bidstream is the trail of consumer data that accompanies internet ad impressions.)

The proposed law is called the Digital Advertising Act, and it would apply to online ad companies generating more than $20 billion in ad revenue, acting as intermediaries between advertisers and online publishers. The new law could affect Google, Meta, formerly Facebook, Amazon and other ad tech giants that play on both the buy and sell sides of the ad tech markets.

The legislation comes at a sensitive time, as the whole ad tech industry is trying to develop new tools for facilitating internet ads that rely less on privacy-invasive third-party cookies, and instead use more first-party data, collected with the direct consent of consumers. Google has been working on what it calls the Privacy Sandbox, a series of initiatives that theoretically rely on more anonymous protocols rather than personal data. For instance, Google’s Chrome browser would no longer use cookies to track the activity of web users and instead would collect just a sampling of topics, which would be made available in an application programming interface for ad tech vendors.

Google is in a sensitive position, under scrutiny by lawmakers wary of its market dominance, while also needing to change its platforms to address privacy concerns without unfairly hampering ad tech rivals and publishers. Google generated about $210 billion in ad revenue in 2021, and it is the largest online ad company, making ad money on its own properties such as search and YouTube. It also operates the software that outside publishers use to fill their ad inventory. “Companies like Google and Facebook have been able to exploit their unprecedented troves of detailed user data to obtain vice-grip-like control over digital advertising, amassing power on every side of the market,” Sen. Lee said in his announcement about the new legislation.

A Google spokesperson criticized the proposed law: “Advertising tools from Google and many competitors help American websites and apps fund their content, help businesses grow, and help protect users from privacy risks and misleading ads,” the spokesperson said in an email. “Breaking those tools would hurt publishers and advertisers, lower ad quality, and create new privacy risks. … In short, this is the wrong bill, at the wrong time, aimed at the wrong target.”

The bill suggests there could be some benefits for Google’s ad tech rivals that participate in its online ad auctions. The bill demands transparency in the online ad auctions, giving more information about the bids in the auctions. Edwards, the privacy advocate who speaks on data and other topics, said that, if passed, the law could make the data that Google is trying to safeguard more vulnerable if it’s just unprotected in the bidstream. The more ad tech vendors with access to the bidstream, the more opportunities for leakage.

The bill outlines that the ad tech platform must maintain a “unique and persistent identifier that identifies each unique digital advertising space for sale,” and the ID could track “all bids received."

The bill, at least, attempts to head off abuses of IDs, by codifying that ad tech vendors that use the system are barred from using data from the auctions to identify consumers. One of the longtime concerns of data in bidstream is that it was susceptible to being tied back to people.

Ad tech companies, publishers and advertisers have been looking for more such granular information about the auctions.

“Right now, there is no way of validating and understanding what’s happening inside Google’s ad system,” said one ad tech exec, who spoke on condition of anonymity.