As a response to Google’s announced ad policy change for publishers on April 26, created in accordance with the European Union’s General Data Protection Regulation (GDPR) that goes into effect May 25, four publishing trade groups released a letter addressed to Sundar Pichai, Google CEO, that criticizes the demands placed on publishers as well as the lack of information provided by the company in their policy change.
Top executives from Digital Content Next, European Publishers Council, News Media Alliance and News Media Association, representing publishers like Hearst, Condé Nast and National Geographic, expressed the concerns they share about the regulations placed on publishers who wish to continue using Google’s advertising services in the European Union. The three areas highlighted in the letter that pose the most concern and create uncertainty for the trade groups are Google’s Controller Terms, responsibility of obtaining legal consent, and the complete placement of liability of said consent on the publisher and not on Google.
While the letter includes a variety of grievances, most can be related back to this initial one posed in the third paragraph of the letter:
As the major provider of digital advertising services to publishers, we find it especially troubling that you would wait until the last-minute before the GDPR comes into force to announce these terms as publishers have now little time to assess the legality or fairness of your proposal and how best to consider its impact on their own GDPR compliance plans which have been underway for a long time.
Such assessments from publishers include the dissatisfaction with the company’s insistence that publishers must share any customer data with Google and are responsible for getting consent from users for this data on Google’s behalf, without disclosing how the company plans on using the information.
“Placing the full burden of obtaining new consent on the publisher is untenable without providing the publisher with the specific information needed to provide sufficient transparency or to obtain the requisite specific, granular, and informed consent under the GDPR,” the groups say in the letter. They go on to demand that in order for them to abide by these rules, Google must provide publishers with “detailed information for each use of the personal data for which you want publishers to ask for legally valid consent and model language to obtain consent for your activities.”
Furthermore, the fines placed on publishers who are unable to obtain consent on Google’s behalf stand universally at the price of $25 million or four percent of global turnover for the previous financial year, whichever is the higher amount.
“Given that your now-changed terms are incorporated by reference into many contracts under which publishers indemnify Google, these terms could result in publishers indemnifying Google for potentially ruinous fines,” reads the letter. The groups state after this that the “take it or leave it” approach within Google’s proposal is disproportionate and should be taken on in a case-by-case basis with each publisher.
The letter concludes with a series of questions from the trade publishers that are meant to clear up some of the previously addressed uncertainties from the company’s ad policy change. Questions include:
- What specific activities does Google undertake that would make it a “controller” under the GDPR?
- With regard to any of Google’s services used by publishers, will you be explicit about the purposes for which Google requires consent from end users?
- How would a publisher use your services to serve advertising without triggering the need for obtaining consumer consent?
