Noyb files complaint against Google under GDPR, saying Android Advertising ID can be tracked
Every phone has an Android Advertising ID and it can be used to track your phone’s actions – and tied back to your identity. A privacy advocacy group called Noyb – European Center for Digital Rights has filed a legal complaint with the Austrian Data Protection Agency against Google under Europe’s GDPR law. Noyb stands for None of Your Business – and that’s exactly how activists feel about the use of the Android Advertising ID to track Android users. Noyb was started by Austrian privacy activist Max Schrems who has filed privacy cases against Google and Facebook in the past and is deservedly highly celebrated in the privacy community.
Noyb’s privacy lawyer, Stefano Rossetti succinctly summed up the problem:
“In essence, you buy a new Android phone, but by adding a tracking ID they ship you a tracking device.”
How the Android Advertising ID violates the GDPR
This Android Advertising ID is on by default and does not allow users to opt-out. If you choose not to be targeted by “interest-based ads” that still doesn’t get rid of the Android Advertising ID. Even if it did, that still wouldn’t be a GDPR compliant for Google to go about this. To be compliant under the GDPR, Google is supposed to get opt-in user consent before setting up any sort of tracking ID. Right now, all users can do is have Google change their advertising ID – which may hinder the ability of third party apps to track your Android device, but doesn’t do anything to stop Google from tracking you with the Android Advertising ID.
Rossetti explained:
“It is grotesque: Google claims that if you want them to stop tracking you, you have to agree to new tracking. It is like cancelling a contract only under the condition that you sign a new one. Google´s system seems to structurally deny the exercise of users´ rights.”
Noyb noted that their complaint was partially inspired by an investigation by the Norwegian Consumer Council: Out of control.
Doesn’t Apple have an advertising identifier, just like Google?
Apple also has an Advertising Identifier that could be used by Apple to track users in the same way; however, unlike Google, Apple allows users to change that identifier to all 0s if they wish to preserve their privacy – which is notably different than Google’s method of replacing the unique ID with another unique ID. Still, the Apple Advertising Identifier also isn’t opt-in and it’s possible that we see a separate legal complaint filed soon.
The Noyb complaint calls for Google to permanently delete the advertising ID, let users that were tracked with the Android Advertising ID to view the data collected, and to pay fines. If found to be violating the GDPR, Google could face fines up to 4% of its global turnover – which as of last year amounts to over $5 billion USD.
