The UK’s data protection regulator has criticised Google over its decision to allow advertisers to use technology to track users which is harder to control or block.
The Information Commissioner’s Office (ICO) said Google’s decision was “irresponsible” and accused the company of a U-turn, having previously prohibited the use of so-called fingerprinting technology.
Fingerprinting involves collecting pieces of information about a device’s software and hardware which can be combined to uniquely identify a device and its user – and the ICO has warned that this technology is harder to wipe than clearing cookies or site data from a web browser, meaning users could continue to be identified by advertisers.
Organisations seeking to deploy fingerprinting techniques for advertising will need to demonstrate how they are complying with the requirements of data protection law.
The ICO’s intervention comes after the regulator said Google had told firms which use its advertising products that from February 2025, it will no longer prohibit the use of fingerprinting techniques within its ad products.
Stephen Almond, the ICO’s executive director for regulatory risk, said: “Yesterday, Google announced to organisations that use its advertising products, that from 16 February 2025, it will no longer prohibit them from employing fingerprinting techniques.
“Our response is clear: businesses do not have free rein to use fingerprinting as they please. Like all advertising technology, it must be lawfully and transparently deployed – and if it is not, the ICO will act.
“Fingerprinting involves the collection of pieces of information about a device’s software or hardware, which, when combined, can uniquely identify a particular device and user.
“The ICO’s view is that fingerprinting is not a fair means of tracking users online because it is likely to reduce people’s choice and control over how their information is collected. The change to Google’s policy means that fingerprinting could now replace the functions of third-party cookies.
“We think this change is irresponsible.
“Google itself has previously said that fingerprinting does not meet users’ expectations for privacy, as users cannot easily consent to it as they would cookies.
“This in turn means they cannot control how their information is collected. To quote Google’s own position on fingerprinting from 2019: ‘We think this subverts user choice and is wrong’.”
A Google spokesperson said: “We look forward to further discussions with the ICO about this policy change.
“We know that data signals like IP addresses are already commonly used by others in the industry today, and Google has been using IP responsibly to fight fraud for years.
“Privacy enhancing technologies offer new ways for our partners to succeed on emerging platforms like CTV without compromising on user privacy.
“We continue to give users choice whether to receive personalized ads, and will work across the industry to encourage responsible data use.”
Mr Almond said the ICO would continue to engage with Google on the issue, and said the ICO would remind businesses considering using fingerprinting that they must meet data protection law, and in relation to this specific technology this was a “high bar to meet”.
“Organisations seeking to deploy fingerprinting techniques for advertising will need to demonstrate how they are complying with the requirements of data protection law,” he said.
“These include providing users with transparency, securing freely-given consent, ensuring fair processing and upholding information rights such as the right to erasure.”
