The commercial interests of large technology companies often come at the cost of user privacy. By examining Google’s official privacy policies, we can understand how the company collects, processes, and utilizes personal information to build advertising profiles for hundreds of millions of users.
Google partners with over two million non-Google websites and apps to display ads. To facilitate this, the company stores server logs that typically include web requests, IP addresses, browser types and languages, timestamps, and cookies that may uniquely identify a user’s browser. While Google anonymizes this log data by removing parts of the IP address after nine months and cookie information after 18 months, the data is actively used beforehand. Cookies play a central role in making advertising effective, and in environments where cookies are unavailable, such as mobile applications, Google uses similar tracking technologies. They may also link mobile advertising identifiers to cookies on the same device to coordinate ads across apps and browsers.
Location tracking is a significant component of this data collection. Google may use IP addresses to identify a user’s general location, or receive precise location data from mobile devices. Websites and apps that users interact with may also send location information to Google. Furthermore, advertising can be selected based on device characteristics, such as the device model, browser type, or even sensors like the accelerometer.
Google also acts as a data processor for trusted businesses, meaning these entities process information on Google’s behalf. The scope of data collection extends across all Google products, including YouTube and Hangouts. For example, Google Voice stores, processes, and maintains call history, voicemail greetings and messages, SMS messages, recorded conversations, and other data.
All of this collected information is aggregated into an ad profile used to increase advertising efficiency. If ad personalization is turned off, Google states it will not collect or use information to create an ad profile or personalize ads. However, reports have indicated that corporations may continue collecting location data even when users explicitly turn off tracking services, highlighting the ongoing challenges users face in protecting their personal information. These findings are drawn from Google’s official policies on ads, privacy frameworks, partner sites, cookies, pattern recognition, voice, and terms of service.