Case:

Google Links Online Search Data and Offline Purchase Data

Data from the U.S. Census Bureau reveal that in the first quarter of 2018, 90 percent of retail purchases took place offline (physically at brick-and-mortar stores), and 9.5 percent took place online through retail e-commerce. Data for Canada indicate approximately 8 percent of sales were online in 2018. These figures indicate that the vast majority of retail sales are difficult to link to online advertising. These findings present a problem for Google (and Facebook), which must convince advertisers that online ads are effective. Google must also respond to Facebooks partnership with Square and Marketo, which enabled Facebook to track consumer store visits and some transactions. This partnership was a reaction to Googles store visit metrics, which had been part of the firms AdWords product since 2014.

Google understands that to attract digital advertising dollars from advertisers who are still primarily spending on television ads, the company must prove that digital ads work. Google must therefore identify customers by analyzing their search histories, the ads they clicked on, and, ultimately, the items they purchased at brick-and-mortar stores. (It is important to note that Google is not the only company performing these analyses. Facebook, for example, also performs these analyses.)

For years, Google has been analyzing location data from Google Maps in an effort to prove that knowledge of peoples physical locations can link the physical and digital worlds. This location tracking ability has enabled Google to inform retailers whether people who viewed an ad for a

lawn mower later visited or passed by a Home Depot store. Users can block their location data by adjusting the settings on their smartphones, but privacy experts contend that few users actually do so.

In addition to location data from Google Maps, Google has been analyzing users Web browsing and search histories, using data from Google apps such as YouTube, G mail, and the Google Play store. All of these data items are linked to the real identities of users when they log into Googles services.

Princeton University researchers used software called OpenWPM to survey the Internets 1 million most popular websites in order to find evidence of tracking code on each website. OpenWPM automatically visits websites using the Firefox browser, and it logs any tracking code that it finds. The researchers found Google code on a majority of these sites. For example, they found Google Analytics, a product used to collect data on visitors to websites that integrates with Googles ad-targeting systems, on almost 70 percent of the websites. They also found DoubleClick, a dedicated ad-serving system from Google, on almost 50 percent of the websites. Perhaps the key finding was that the five most common tracking tools are all owned by Google.

Online publishers use tracking code from Google, Facebook, and many other companies to help target their advertising. When a companys tracking code is embedded on multiple websites, then the company can construct detailed profiles on individuals as they browse the Web, assigning them unique identifiers so they can be recognized. Privacy advocates argue that this practice needs to be scrutinized more carefully.

Compounding this issue, new credit card data enable Google to integrate these data sources to real-world purchase records. Google is now using billions of credit card transaction records to prove that its online ads are prompting people to make purchases, even when the transactions occur offline in physical stores. This process gives Google a clearer method to analyze purchases than simply using location data. Furthermore, Google can now analyze purchase activity even when consumers deactivate location tracking on their smartphones.

Today, Google can determine the number of purchases generated by digital ad campaigns, a goal that marketing experts describe as the holy grail of online advertising. For example, Google can inform a company such as Sephora how many shoppers viewed an ad for eyeliner and then later visited a Sephora store and made a purchase. Advertisers can access this information with a new product called Google Attribution. They can identify which clicks and keywords had the largest impact on a consumers purchasing decision.

Not surprisingly, Googles enhanced analytic tools have led to complaints about how the company uses personal information. Privacy advocates note that few people understand that their purchases are being analyzed in this way. Google responds that it has taken steps to protect the personal information of its users. In fact, the company claims to have developed a new, custom encryption technology that ensures that users data remain private, secure, and anonymous.

Google further maintains that it is using patent-pending mathematical formulas to protect the privacy of consumers when it matches one of its users with a shopper who makes a purchase in a brick-and-mortar store. These formulas convert peoples names and other purchase information, including the time stamp, location, and the amount of the purchase, into anonymous strings of numbers, a process called encryption. These formulas make it impossible for Google to know the identity of the real-world shoppers and for the retailers to know the identities of Googles users. The retailers know only that a certain number of matches have been made. Google calls this process double-blind encryption.

Google has declined to explain how its new system works or to identify which companies are analyzing records of credit and debit cards on Googles behalf. Google states that it does not handle the records directly. It acknowledges, however, that its undisclosed partner companies had access to 70 percent of all transactions made with credit and debit cards in the United States.

Google does contend that all users who signed into Googles services consented to Googles sharing their data with third parties. However, Google would not disclose how merchants have obtained consent from consumers to share their credit card information. The company claims that it requires its partners to use only personal data that they have the rights to use. However, it would not say whether that meant that consumers had explicitly consented.

In the past, Google has obtained purchase data for a more limited set of consumers who participate in store loyalty programs. Those consumers are more heavily tracked by retailers, and they often give consent to share their data with third parties as a condition of signing up for the loyalty program.

Marc Rotenberg, executive director of the Electronic Privacy Information Center, notes that as companies are becoming increasingly intrusive in terms of their data collection, they are also becoming more secretive as to how they gather and use those data. He urged government regulators and the U.S. Congress to demand answers about how Google and other technology companies are collecting and using data from their users.

Paul Stephens of Privacy Rights Clearinghouse, a consumer advocacy group, has asserted that a marketing organization can identify an individual by examining only a few pieces of data. He expressed scepticism that Googles system for guarding the identities of users will stand up to the efforts of hackers who in the past have successfully stripped away privacy protections created by other companies after they experienced data breaches. He maintains that it is extremely difficult to keep data anonymous.

Questions:

1) The case study shows that Google is linking Online Search Data and Offline Purchase Data. Is this a legal and/or ethical practice? Why or why not? Please justify your answer

2) Does the sharing of consumers credit card information by retail merchants infringes customer privacy? Why or why not? Please justify your answer

3) Discuss how organizations that want to link Online Search Data and Offline Purchase Data ensure that they do so ethically and legally?