PI Comments on Google-Doubleclick Merger to the European Commission

Privacy International

05/11/2007

PI wrote a letter to the head of the European Commission DG COMP calling on Commissioner Kroes to take the merger of these internet advertising giants to the next phase. We argue that the merger could have serious implications for privacy innovation in advertising. Our letter was endorsed by groups from across Europe.

For more information on this merger, please see the excellent resource on EPIC's website.

The letter is available in PDF with footnotes here.

Ms Neelie Kroes
Commissioner
DG COMP
EUROPEAN COMMISSION
Rue de la Loi 200
1049, Bruxelles
November 5, 2007

Dear Commissioner Kroes,

Regarding the acquisition of Doubleclick by Google

We are writing to you regarding your review of the Google and Doubleclick merger and its implications for competition.

We are aware of the substantive contributions you have already received from such organisations as BEUC and from other privacy experts and officials. Please see our concerns as an addition to those valuable contributions.

Background

The online advertising field is currently dynamic and much will likely change in the coming years. Recent reports have shown a growth of 41% in Internet marketing in the UK alone. Spending on online advertising is predicted to double between now and 2011 to $54 billion. Companies are vying to increase their roles in this field. Google's dominance is noticeable, however. According to a report from New Media Age, the regional director for a north-west Europe for a leading hotel change is quoted saying:

"Google remains a solid, reliable volume driver for us. Its dominance is a potential threat to business, however, if it continues to exploit its lone position in the marketplace."

In the UK alone, the Internet Advertising Bureau has reported that Google commands a 43 per cent share of the £2bn marketers spent on online advertising in 2006, up from 35 per cent in 2005. This represents 11.4 per cent of all UK advertising revenues, up from 7.8 per cent in 2005.

Within this domain we have seen some interesting privacy innovations. Some companies offer de-identified profiles, e.g. Microsoft, where your identifiable data is kept distinct from your advertising profile. Others promise that they do not profile their customers using personally identifiable information, e.g. Google. If true, these are indeed promising developments and we hope that further innovations will arise and more privacy friendly mechanisms will emerge as regulators outline legal expectations and companies continue to compete against one another for users' trust. The alternative to this situation -- one that in our view is more likely to arise if the level of competition in online advertising does note remain robust -- would result in an unprecedented level of customer profiling leading to vast data stores held by private companies.

We are at a key moment in time. Consider the case a few years ago when Microsoft announced it intended to provide a centralised "Passport" scheme to users wishing to gain access to Internet services, thus acting as a gatekeeper to the rest of the marketplace. Fortunately because of actions of organisations like the Electronic Privacy Information Center using the regulatory power of the U.S. Federal Trade Commission, this situation was resolved and MS Passport did not become the dominant authentication service on the Internet. Instead, we have since then seen the emergence of multiple identity management systems with federated solutions and intense competition.

We believe that we are again at such a moment where innovation can thrive or will suffer depending on whether one company is permitted to achieve a dominant market position. Consolidation in the online advertising industry has already begun, and fewer and fewer companies will be in a position to enter the market. As the number of competitors and level of competition diminishes, the market leader will have fewer incentives to compete in offering more innovative ways of protecting users' privacy -- or of even maintaining the existing quality of their privacy practices. In an area that is dominated by America Online, Google, Microsoft and Yahoo!, we have seen numerous acquisitions including: AOL's purchase of ADTECH AG, and TACODA; Microsoft's purchase of aQuantive and AdECN Inc.; Yahoo's purchase of Right Media; WPP Group's purchase of 24/7 Real Media; and now Google’s proposed acquisition of DoubleClick. Google has also recently announced plans to work closely with television companies to monitor advertisement viewings.

With consolidation, we fear that we will see larger and larger databases emerge and extensive use of profiling as users are re-identified. As the leading online ad company continues to face stockholder pressure to increase revenues, there is a significant risk that it will try to justify price increases to advertisers by giving them more and more data about their potential customers. As this occurs, we fear that privacy protective advertising services will be pushed out of the marketplace. Instead, personal information will flow and at no point will consumers be asked for their consent.

It is already very difficult for consumers to apprehend how their personal information is being processed. Google and many of the leading companies online have only recently taken to speaking more openly about their current information collection and processing habits, and this is slowly filtering down to consumers. The entire domain of online advertising is in great need of some transparency and accountability to both nurture it and to ensure that consumers are protected. With this merger we are concerned that the exact opposite may occur.

The merger

Google's purchase of Doubleclick is particularly worrying because it is a significant consolidation in this domain and we worry that this very competition to provide high-quality privacy practices will dissipate. Google's dominant position in the search marketplace will be compounded by Doubleclick's dominant position in online profiling, leading to a potentially abusive situation for the protection of privacy. If the merger is approved, then Google's dominant service will transform radically from one with a search advertising function into one that collects both searches and browsing habits of users. And given the tremendous market share that the combined company would hold post-merger, it would be nearly impossible for consumers to avoid having their online activities tracked, and nearly impossible for competing ad service providers with stronger privacy protections to impose any competitive constraints on Google’s practices in this area.

Privacy innovation could suffer under the merger as the two largest online databases come together. Other companies will have to compete against this massive entity and we worry it will lead to a race to the bottom for privacy protection.

Already privacy assurances are hard to come by. Little is actually known about how all these companies protect their customers' data, even though they must do so in accordance with European privacy laws. Google was indeed the first company to disclose publicly their intention to anonymise search criteria after 18 months but we are still uncertain as to how this will actually work in practice. Although retention periods are a serious affair for privacy practice, the actual use of that data for that period of time is of paramount interest. We know little about how firms make use of this data.

Google promises that it does not yet create online user profiles, but it is purchasing a firm that is renowned for the depth and extent of its online user profiles. We need strong and enforceable assurances that profiles will not be developed and enhanced through this merger.

Privacy innovation

Google has promised the U.S. Congress that it is investigating new techniques to promote privacy despite this merger. But as we know little about how Google currently operates how can we be certain that they did not promise these innovations just to get approval for the merger? If privacy innovation is going to be threatened by this merger, we need strong assurances that Google will abide by privacy law and will do so in an open and transparent manner. Otherwise we will be left with a situation where two of the largest online databases will be merging without any assurances that this dominant data source will not be abused.

So little is actually known about internet advertising and how it is provided. The Article 29 Working Party has stated its intent to release guidelines for search engines in the coming months, and this will go some way in clarifying expectations. Confidence in the enforcement of these guidelines, however, will take much more time to emerge. And how these guidelines extend to internet advertising will take even longer to assess.

Although we are excited by the promise of privacy innovation, we worry that this innovation will not continue if the merger is approved. Companies often promise technological measures to protect privacy when they fear regulatory interventions. Once the threat of regulatory action disappears, so do all the promises. So we may be left in a situation months from now where competitors can no longer innovate to protect privacy because of the 'race to the bottom' to datamine personal information for all the possible gains, and Google will cease to innovate because the merger was approved without strong privacy requirements and only some promises.

As a result, at the very least we would like to see that as a condition of the merger, Google must undertake meaningful commitments to ensure that consumers continue to benefit from strong competition in the quality of privacy practices.

We conclude with a quotation from U.S. Senator Herbert Kohl, the chairman of the recent Senate hearing on this matter. Of course he was referring to U.S. law but the conclusions are worthy for consideration under EU competition law:

"Some commentators believe that antitrust policymakers should not be concerned with these fundamental issues of privacy, and merely be content to limit their review to traditional questions of effects on advertising rates. We disagree. The antitrust laws were written more than a century ago out of a concern with the effects of undue concentrations of economic power for our society as a whole, and not just merely their effects on consumers' pocketbooks. No one concerned with antitrust policy should stand idly by if industry consolidation jeopardizes the vital privacy interests of our citizens so essential to our democracy."

With this lack of information about current and future practice across an entire industry, we hope that you can uncover more about this troubling situation. We therefore hope that you will take Google-Doubleclick merger deal to Phase II review.

Yours sincerely,

Simon Davies, Director

Gus Hosein, Senior Fellow

Supporting Organisations

Associazione per la Libertà nella Comunicazione Elettronica Interattiva (Italy)

Digital Rights (Denmark)

Digital Rights Ireland

Electronic Frontier Finland

European Digital Rights (EU)

IRIS - Imaginons un réseau Internet solidaire (France)

Netzwerk Neue Medien (Germany)

<< Back

Email us at privacyint@privacy.org.
Call on +44 (0)208.123.7933.
Privacy Policy - About PI - Support PI