If you do not register a personal account for Google, thereby not giving specific and informed consent for the processing of your personal data, are Google still obliged to obtain consent for the processing of your searches for uses outside the scope of performing the search itself for searches under the scope of the GDPR? For example, the search and subsequent search results clicked could be used by Google to improve future search results, or improve ads personalization.
1 Answer
Whether consent is necessary depends on the specific processing purposes. For example, general usage statistics about search terms or about the usage of the site likely fall under a legitimate interest.
Outside of the GDPR, there can be consent requirements for the use of specific technologies. Per the ePrivacy directive, consent is required for accessing or setting cookies on a user device, unless the cookie is strictly necessary for the service requested by the user (“functional cookie”). This consent requirement also extends to other storage and fingerprinting technologies.
A functional cookie could e.g. be used to store a history of search terms on the user device itself. However, ad personalization is not strictly necessary for the search functionality, so setting cookies (or using similar technologies) for ad personalization requires consent, regardless of whether ad personalization itself would require consent.
To determine whether a processing purpose falls under a legitimate interest, the data controller must weight the interest against the data subject's rights and freedoms. There are no objective guidelines on this, and ultimately a court would have to decide. However, I would assume that the tracking necessary for ad personalization is an inappropriate infringement on the data subject's rights and freedoms, so that ad personalization cannot fall under a legitimate interest. The data controller would have to choose a different legal basis, which effectively only leaves consent.
