Google fined $22.5m by US regulator after it "misrepresented privacy assurances" to web users

The company is accused of placing tracking 'cookies', or small text files that record users' online activity, on the devices of those users in order to serve them with targeted advertising. In addition to the monetary penalty, the settlement agreement also requires Google to disable any cookies it has already placed on users' devices in breach of its previous agreement with the FTC.

Safari is Apple's own web browser and is set to block third-party cookies without any action from users. Although it produces versions for other computers, it is primarily used by owners of Macs, iPhones and iPads.

"The record setting penalty in this matter send a clear message to all companies under an FTC privacy order," FTC chairman Jon Leibowitz said. "No matter how big or small, all companies must abide by FTC orders against them and keep their privacy promises to consumers, or they will end up paying many times what it would have cost to comply in the first place."

The US consumer protection regulator said that Google, which generates billions of dollars per year from selling online advertising and targeted advertising services, placed a certain advertising tracking cookie on the devices of Safari users who visited sites within its 'DoubleClick' advertising network over the course of several months between 2011 and 2012. It did so despite having previously told these users that they would not have to take action to block these cookies as Safari's default privacy settings "effectively accomplished the same thing" as opting out, the FTC said.

Google reached a settlement with the FTC in October 2011 which, among other things, prevented it from "misrepresenting the extent to which consumers can exercise control over the collection of their information", the FTC said. Its actions in this case violated this settlement, which related to Google's now defunct social networking service Google Buzz, according to dissenting Commissioner J Thomas Rosch.

"There is no question in my mind that there is 'reason to believe' that Google is in contempt of a prior Commission order", Rosch stated. "This is not the first time the Commission has charged Google with engaging in deceptive conduct," he added.

In light of Commissioner Rosch's comments, privacy law expert Marc Dautlich of Pinsent Masons, the law firm behind Out-Law.com noted that "At this point it remains unclear how Google has emerged without having to accept responsibility for this apparent misrepresentation." 

According to press reports, the 'record' fine would amount to nothing more than a "slap on the wrists" for the company, technology law expert Luke Scanlon of Pinsent Masons added.

"This highlights that there is a disconnect between the amount of time and effort spent on debating the scope of data protection laws and the consequences of a breach," he said. "This is particularly the case in the UK, where the Information Commissioner's Office's powers to issue monetary penalties are capped at £500,000."

Google claimed that its actions were unintentional, resulting from a change to the browser of which it had been unaware. It claimed that it stopped tracking Safari users and showing them personalised advertising once the issue was brought to its attention, according to the settlement, under the terms of which it has not accepted responsibility for the breach.

One FTC Commissioner, J. Thomas Rosch, dissented with the majority view of the FTC, branding its decision to accept Google's denial of liability as "inexplicable".

"It arguably cannot be concluded that the consent decree is in the public interest if it contains a denial of liability," he said.