Publishers rebuke Google's interpretation of EU privacy law

Google is forcing media firms that generate revenue from its advertising services to accept unreasonable responsibilities under a new European privacy law, four major publisher trade groups told the Alphabet Inc unit late Sunday in a letter seen by Reuters.

The dispute reflects differing interpretations of the European Union’s General Data Protection Regulation (GDPR), which imposes a range of new requirements on how companies collect and process personal information about EU users.

The law comes into effect May 25, and over the past several weeks many companies have begun to detail how they will comply.

Google is the biggest vendor of the software and services that many newspapers and digital media firms use to sell ads on their websites and mobile apps.

As part of its plans for GDPR, Google would offload to publishers the burden of getting user consent for the data collection that is at the core of how Google’s ad-serving business operates.

The company has also irked publishers by saying that rather than being a “processor” of data as defined by GDPR, it wants to be a “controller,” giving it more ability to use information such as reader data for its own purposes.
“Your proposal severely falls short on many levels,” publisher groups wrote to Google Chief Executive Sundar Pichai, adding that it “would undermine the fundamental purposes of the GDPR and the efforts of publishers to comply with the letter and spirit of the law.”

Signing the five-page letter, which ends on several questions to Google, were Digital Content Next, European Publishers Council, News Media Alliance and News Media Association.

They represent about 4,000 newspapers and media companies, primarily in Europe and North America, including Axel Springer, Telegraph Media Group, New York Times Co, Associated Press and Thomson Reuters.

Google said Monday it was committed to complying with the “significant new obligations for the ecosystem” under GDPR.

“We appreciate that there is a lot of confusion around the requirements of GDPR, so we are looking to help our publishers as much as we can,” spokeswoman Suzanne Blackburn told Reuters. “We published more information in our Help Center last week to help our partners understand what we’re providing and the steps they need to take to comply with GDPR.”

Publishers could in principle move to rival services if they do not like Google’s terms. But Google’s network is unrivalled in size and can often generate more revenue for publishers than rival networks can.

Publishers said Google’s requirement that publishers obtain consent on behalf of Google and its business partners in the ad-serving sector could enable the search giant to dictate what constitutes consent and which other ad services a publisher can use.

They note that GDPR does permit tracking of users without their permission for certain reasons, including serving “a legitimate interest” such as combating account fraud or measuring marketing efforts. Yet Google is insisting on affirmative consent in all cases.

GDPR violations can carry hefty fines, and publishers wrote that Google’s terms could multiply their exposure to “potentially ruinous” judgements by leaving them liable for misuse by Google and its partners.

Spokeswoman Blackburn said Google is a controller under GDPR “because we make decisions on data processing to help publishers optimise ad revenue,” but the company notes that the “designation does not give us any additional rights to data” than afforded by its publisher contracts.

The company already requires publishers to obtain “certain consents” from European users and that it is “updating those requirements in line with the GDPR,” Google said.

Google said it is providing optional tools to help publishers meet the requirements.

Jason Kint, CEO of Digital Content Next, said the statements show that at a time of heightened awareness about online privacy, “these big tech behemoths are focused on protecting their massive collection of personal data rather than aligning with the spirit of these new rules and raising the bar on consumer trust”.

Smaller players in the digital advertising supply chain say they are concerned that Google could limit working with them if publishers have not obtained consent on their behalf.

“What’s concerning is when they push publishers to interpret GDPR only the way Google interprets it,” said Joshua Koran, managing director at technology firm Sizmek, which works closely with advertisers.