Google is prioritising “profits over privacy” with its about-face to allow user fingerprinting for advertising purposes, a technology it previously said was “wrong”, privacy advocates have said.

The shift, which takes effect this week, means advertisers using Google’s online ad infrastructure are allowed to create profiles based on a user’s IP address and the characteristics of their software and hardware, and use this for targeting them with ads.

Unlike cookies, which can be cleared or turned on and off by a user, a fingerprint-based profile is largely in the hands of the advertiser.

‘Wrong’

In a 2019 blog post Google said fingerprinting “subverts user choice and is wrong”.

The company changed its policy in December and said it would allow the technique, saying the data was widely collected by other companies.

It said fingerprinting allowed ad targeting at a time when people were accessing the internet via devices such as smart TVs and consoles.

“Privacy-enhancing technologies offer new ways for our partners to succeed on emerging platforms,” the company said, adding that user privacy would not be compromised.

“By allowing fingerprinting, Google has given itself – and the advertising industry it dominates – permission to use a form of tracking that people can’t do much to stop,” said Mozilla distinguished engineer Martin Thomson.

The Electronic Frontier Foundation said the data collected by advertisers could also be exposed to data brokers, surveillance firms and law enforcement.

“By explicitly allowing a tracking technique that they previously described as incompatible with user control, Google highlights its ongoing prioritisation of profits over privacy,” said said EFF technologist Lena Cohen.

In December the UK’s Information Commissioner’s Office (ICO) said it believed fingerprinting was “not a fair means” of tracking users because it is “likely to reduce people’s choice and control over how their information is collected”.

‘Irresponsible’

“We think this change is irresponsible,” said Stephen Almond, the ICO’s executive director of regulatory risk, at the time.

“Google itself has previously said that fingerprinting does not meet users’ expectations for privacy, as users cannot easily consent to it as they would cookies. This in turn means they cannot control how their information is collected.

He said businesses and advertisers who use the technology will have to demonstrate how they are complying with UK data and privacy laws.

“Based on our understanding of how fingerprinting techniques are currently used for advertising this is a high bar to meet,” Almond wrote.

Google said at the time it would continue discussions with data regulators.

The company said it continues to give users the choice whether to receive personalised ads and would encourage responsible data use.