Why does Google require consent from users in order to process ads personalization data?

Question

Recently, Google was fined under the GDPR by France's CNIL data protection authority. The authority found Google's processing of personal data for ads personalization lacked transparency, was inadequately informed to users and did not obtain valid consent. Specifically, CNIL said

Users are not able to fully understand the extent of the processing operations carried out by GOOGLE. But the processing operations are particularly massive and intrusive because of the number of services offered (about twenty), the amount and the nature of the data processed and combined. The restricted committee observes in particular that the purposes of processing are described in a too generic and vague manner, and so are the categories of data processed for these various purposes. Similarly, the information communicated is not clear enough so that the user can understand that the legal basis of processing operations for the ads personalization is the consent, and not the legitimate interest of the company.

Article 6.1 of the GDPR lays out the conditions under which the processing of personal data is lawful. It seems the subparagraphs most relevant to Google's processing of personal data for the purposes of ads personalization are:

6.1.(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

6.1.(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

6.1.(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

It seems that the satisfaction of 6.1.(b) or 6.1.(f) would preclude the need for Google to obtain consent to process personal data. The terms under which Google processes personal data for the use of ads is stated in their Ads Data Processing Terms, with the types of personal data in scope for those terms listed here. If a user registers to Google, personally identifying their searches, are they not also agreeing to these terms, thereby satisfying 6.1.(b)?

Additionally, I don't fully understand why it is not a legitimate interest for Google, an ads-serving company, to process personal data for the purpose of ads personalization?

Answer 1

This is a large question, so I'll only put a spotlight on some misconceptions.

Why can't Google use legitimate interest instead of consent to serve ads?

A data controller such as Google must choose an appropriate legal basis per Art 6(1). But if the legal basis is consent, and the data subject declines or retracts consent, you can't do the processing anyway under legitimate interest instead. It seems that the issue is not that consent was an inappropriate legal basis, but that they decided to use consent and did not collect it properly (see below).

However, Google's analysis that they need consent is likely correct. There is an good argument that a website can show first-party ads under a legitimate interest. Google does so as well. But the consent in question is for ad personalization, i.e. on creating detailed profiles on users in order to show more “relevant” ads. For that purpose, Google's legitimate interest would likely not outweigh the data subject's rights and freedoms (compare Art 6(1)(f)).

Why might consent be invalid?

The GDPR defines consent in Art 4(11) and specifies further requirements in Art 7. The EDPB has issued guidelines 05/2020 and previously WP259 on consent.

A core requirement, in addition to the general Art 5(1)(a) transparency principle, is that consent is specific and informed. The user must be informed about the specific purpose for which consent is being asked, and must be able to control consent individually for each purpose. Additionally, consent requires an affirmative action, consent is never the default.

The EDPB recommends a layered information approach: in the first information layer, at the point where consent is being asked, the proposed processing activities are summarized. Full details (including all information per Art 13) are provided in a second layer that can be reached via a link. Consent will not be informed if the data subject is required to read the entire privacy policy first.

How does the CNIL see Google's approach to consent and transparency?

The CNIL asserts that Google failed at every step of a layered information design and failed to obtain valid consent:

• consent controls were hidden by default, i.e. there was no first information layer
• consent controls were pre-checked, thus requiring opt-out. That's not how you ask for consent (but might have been alright if Google had used legitimate interest instead).
• consent is all-or-nothing and not sufficiently granular
• Google's main information layer is its privacy policy, but it is very general and does not provide sufficiently specific information
• Google only provides specific information spread across further documents, often 5 or 6 levels deep

Could Google rely on Art 6(1)(b) necessity for performance of a contract?

If a data subject enters a contract about Google using their data for ads, yes. Otherwise, no. But in practice, necessity for a contract is very similar to consent because the data subject can freely decide whether or not to enter a contract.

Even when the legal basis is a contract, the data controller still has an obligation to provide transparent information. Depending on the structure of the contract, a layered approach could be used as well. However, the purposes of processing are ultimately given by the contents of the contract.

What about the Ads Data Processing Terms?

These terms are not part of the terms of service or the privacy policy that end users agree to. The ads terms are instead part of their B2B offerings.