Google Should Disclose More Information, Protect Consumer Privacy Prior to DoubleClick Merger

Privacy Concerns Spark CPB Request to Delay Merger of Google with DoubleClick Ad Company

"People may not realize it, but Google already collects and retains an enormous amount of personal data about the specific websites and advertisements that are visited by millions of people," said Mindy Bockstein Chairperson and Executive Director of the CPB. The CPB is a New York State agency and part of Gov. Eliot Spitzer's administration.

The personal profiles now stored in Google's massive database could be merged with the information now being collected by DoubleClick, a company that keeps track of people who look at the online advertisements. By merging, Google would gather even more information, creating more detailed profiles about millions of people and their use of the Internet.

"If this information is misused or falls into the wrong hands, this data collection could seriously harm the privacy rights of consumers," said Chairperson Bockstein.

The CPB is urging the FTC to require Google to make full and public disclosure of its current data collection practices and contemplated data collection practices post-merger. Google should also establish a publicly disclosed, clear and conspicuous data collection policy, including:

• a plan to protect Google's database from cyberthieves;
• consumer access to the personally-identifiable information in Google's database and the ability to delete or edit inaccurate information;
• an opt-out mechanism that would allow an Internet user to prevent Google from tracking and storing information about the websites visited by an individual computer user; and,
• remedies in the event of a data breach or failure to comply with a consumer’s opt-out request.

The CPB is joining other consumer advocates in calling for FTC action on issues related to Internet tracking and data collection by Google.

In her letter to the FTC, Chairperson Bockstein wrote, "Your intervention is necessary to ensure that safeguards are in place to protect personal data and avoid the chilling effect that unrestrained data collection could have on the Internet. This would likely occur if consumers become mistrustful of using the Internet for fear of identity theft, the dissemination of incorrect information, and embarrassment, for example."

"The issue of information privacy has become a critical one for the New York State CPB in its mission to protect our consumers," wrote Chairperson Bockstein.

Earlier this year, the CPB put forth a legislative recommendation regarding Information Brokers that would provide new privacy protections for New York State consumers. The proposal would place restrictions on businesses that have been created for the sole purpose of collecting, analyzing, and selling personal information and which have generated large electronic databases containing this data.

Among other provisions, the proposal authorizes consumers to opt-out of inclusion in the database by having their names placed on an “exclusion list” or by advising an information broker directly. The measure further provides that, upon a consumer’s request, an information broker must disclose the consumer’s personal information retained in their database and requires them to establish appropriate safeguards to ensure security and confidentiality of the data subject’s records.

The bill authorizes the CPB to bring enforcement actions for violations of these restrictions, including injunctions and civil penalties, and provides for private actions. The CPB encourages consumers to voice their concerns about the Google/DoubleClick merger and its potential impact on their privacy by using a model letter available on its website at: www.nysconsumer.gov.