UK’s ICO Labels Google ‘Irresponsible’ For Tracking Change

Alphabet’s Google is at the centre of another privacy row, after the UK data protection watchdog stepped in over a policy change for tracking users across different websites and platforms.

This week Google announced in a support document that from February 2025, organisations (aka advertisers) that use Google’s advertising products, will be allowed to track customers’ digital “fingerprints”.

But the UK’s Information Commissioner’s Office (ICO) slammed the move, labelling Google as “irresponsible” and has threatened to intervene, if the change is not “lawfully and transparently deployed.”

Digital fingerprints

The ICO made clear its concern about Google’s change in a blog post by Stephen Almond, the ICO’s executive director of regulatory risk.

“Yesterday, Google announced to organisations that use its advertising products, that from 16 February 2025, it will no longer prohibit them from employing fingerprinting techniques,” Almond wrote. “Our response is clear: businesses do not have free rein to use fingerprinting as they please. Like all advertising technology, it must be lawfully and transparently deployed – and if it is not, the ICO will act.”

Almond noted that digital fingerprinting involves the collection of pieces of information about a device’s software or hardware, which, when combined, can uniquely identify a particular device and user.

The UK watchdog is concerned because fingerprinting is harder to detect and block, and users cannot consent as easily as they do with those annoying Cookie windows that pop up when browsing the web.

“The ICO’s view is that fingerprinting is not a fair means of tracking users online because it is likely to reduce people’s choice and control over how their information is collected” Almond wrote. “The change to Google’s policy means that fingerprinting could now replace the functions of third-party cookies.”

“We think this change is irresponsible. Google itself has previously said that fingerprinting does not meet users’ expectations for privacy, as users cannot easily consent to it as they would cookies,” Almond noted. “This in turn means they cannot control how their information is collected. To quote Google’s own position on fingerprinting from 2019: ‘We think this subverts user choice and is wrong.’”

February 2025

“We are continuing to engage with Google on this U-turn in its position and the departure it represents from our expectation of a privacy-friendly internet,” wrote Almond. “When the new policy comes into force on 16 February 2025, organisations using Google’s advertising technology will be able to deploy fingerprinting without being in breach of Google’s own policies. Given Google’s position and scale in the online advertising ecosystem, this is significant.”

Almond warned businesses/advertisers that they must give users fair choices over whether to be tracked before using fingerprinting technology, including obtaining consent from their users where necessary.

“Organisations seeking to deploy fingerprinting techniques for advertising will need to demonstrate how they are complying with the requirements of data protection law,” Almond warned. “These include providing users with transparency, securing freely-given consent, ensuring fair processing and upholding information rights such as the right to erasure.”

“Based on our understanding of how fingerprinting techniques are currently used for advertising this is a high bar to meet,” he added. “Businesses should not consider fingerprinting a simple solution to the loss of third-party cookies and other cross-site tracking signals.”

Google response

Google had cited the following reason for allowing the tracking of digital fingerprint, as it will enable advertisers and brands to better reach desired audiences on smart TVs, streaming services and internet-linked games consoles.

This is a fast-growing advertising area known as connected TV (CTV).

Google also claimed there had been advances in technology that enhance customer privacy.

A spokesperson for Google was quoted by the Guardian newspaper as saying: “Privacy-enhancing technologies offer new ways for our partners to succeed on emerging platforms like CTV without compromising on user privacy.

“We continue to give users choice whether to receive personalised ads, and will work across the industry to encourage responsible data use,” the spokesperson was quoted as saying.

Third-party cookies

Google’s change of policy for digital fingerprints comes after years of controversy surrounding Chrome’s use of third-party tracking cookies.

Advertisers are of course Google’s largest source of revenue, and had previously made their feelings known that removing third-party cookies from Chrome would limit their ability to deliver personalise ads, leaving them dependent on Google’s own user databases.

It should be noted that rival browsers such as Mozilla’s Firefox and Apple’s Safari have already blocked third-party cookies.

After years of engaging with the UK’s CMA over the issue, Google in July 2024 suddenly cancelled its ‘Privacy Sandbox’ plan to phase-out of third-party cookies on the Chrome browser, because it would require “significant work by many participants and would impact publishers, advertisers and virtually anyone involved in online advertising.”

The CMA however in September 2024 said that “concerns remain” over Google’s cookie change for Chrome.