Is Google at Odds with the GDPR? Evaluation of Google's Personal Data Collection on Mobile Operating Systems in Light of the Principles of Purpose Limitation, Data Minimisation, and Accountability

“your activity on other sites and apps”(715): This activity might(716) come from your use of Google services (previously, “Google products”), like from syncing your account with Chrome (previously, “like Chrome Sync”) or your visits to sites and apps that partner with Google (previously, “or from(717) your visits to Sayfa 231 sites and apps that partner with Google”). “Many websites and apps partner with Google to improve their content and services. For example, a website might use our advertising services (like AdSense) or analytics tools (like Google Analytics), or it might embed other content (such as videos from YouTube)”. These services (previously, “products”), MAY(718) (previously, there was no use of “may”) share information about your activity with Google and, depending on your account settings and the products in use (for instance, when a partner uses Google Analytics in conjunction with our advertising services), this data may(719) be associated with your personal information.” Sayfa 232The left text box states in a plain language, clearly, that Google may associate data from advertising services and analytics tools with the data subject’s personal information, depending on his/her account settings. As discussed before in this Chapter, Google employs the use of Web & App Activity in order to collect data. This arrangement is enabled by default. This is why anonymization can be considered as not very effective. It could even be argued that anonymization is basically a façade, holding back the meaning of the word and working against its main objective(720) of being a safeguard, under which circumstances, it cannot be used for the purposes of legitimate interest – meaning that Google may lack a valid ground recognised by law in order to process location data for marketing purposes via Web & App Activity.

This seems to almost be in reminder of, and agree with, the Working Party 29’s statement…

“for tracking(721) and profiling for purposes of direct marketing, behavioural advertisement, data-brokering, location-based advertising or tracking-based digital market research.”(722)…