Three U.S. online civil rights groups have filed a complaint asking the U.S. Federal Trade Commission (FTC) to block Google Inc.'s planned US$3.1 billion acquisition of DoubleClick Inc. unless the company agrees to stop tracking its users.
The complaint, filed Friday by the Electronic Privacy Information Center (EPIC), the Center for Digital Democracy (CDD), and the U.S. Public Interest Research Group (US PIRG), calls upon the FTC to block the merger unless it obtains guarantees from Google and DoubleClick that they will protect Internet users' privacy.
Those guarantees include a promise to destroy all cookies and other persistent identifiers resulting from Internet searches that are or could be personally identifiable once a user terminates a session with Google.
Such a move would seriously affect many of the services Google offers, which are built on storing the entire search or transaction history of its users.
"We are troubled by the fact that search histories are maintained after the session expires," said EPIC Executive Director Marc Rotenberg.
That's not the way people expect things to work, he added.
Asking users' permission to track their searches would not make things better, according to Rotenberg. "This is not something that turns on consent," he said. "The retention of the data is the bad practice."
Google amasses data about the search and surfing habits of millions of Internet users, tracking what they look at, what they write and even what they buy in order to serve relevant advertising. DoubleClick follows Web surfers' activities through cookies attached to the banner ads it serves up, exchanging information with advertisers to help them better target their messages.
The collection of such personal information poses far-reaching privacy concerns that the Commission should address, the three advocacy groups said.
"Neither Google nor DoubleClick have taken adequate steps to safeguard the personal data that is collected. Moreover, the proposed acquisition will create unique risks to privacy and will violate previously agreed standards for the conduct of online advertising," the groups wrote in the complaint, filed with the FTC on Friday.
Those standards include the Organization for Economic Cooperation and Development (OECD) Privacy Guidelines.
The three groups called on the FTC to investigate what effect a Google-DoubleClick merger will have on Google's ability to track and profile Internet users' activities.
They also want the FTC to order DoubleClick to remove cookies and other identifiers identifying individual users from any records it transfers to Google, unless the company has previously obtained explicit consent from those the data relates to, including giving users the right to first inspect, delete and modify the data.
Other demands include ordering Google to explain publicly how it plans to comply with privacy standards such as the OECD Privacy Guidelines, ordering the company to provide reasonable access to personally identifiable data it holds to the subject of that data, and establishing a meaningful data destruction policy.
EPIC campaigns for Internet users' right to privacy, the CDD for a more open and diverse Internet, and the US PIRG for fair marketplace practices.
EPIC's Rotenberg is optimistic that the FTC will take action. "They have responded to similar cases before," he said.
Google's Global Privacy Counsel Peter Fleischer thought such action unlikely, however.
"Google believes the complaint is unsupported by the facts or the law," he said. "When we have a chance to explain to the FTC why we keep this information, I think there is zero chance that the FTC will order us to delete it at the end of a session."
Google, like other Web site operators, keeps logs of page requests in order to detect patterns and protect its servers from attack, Fleischer said. "An order to delete these would leave us vulnerable to security attacks, and that cannot be good for our users' privacy," he added.