Google appeals $1.7BN EU AdSense antitrust fine

Like clockwork, Google has filed a legal appeal against the €1.49 billion ($1.7BN) antitrust penalty the European Commission slapped on its search ad brokering business three months ago.

The Telegraph reported late yesterday that the appeal had been lodged in the General Court of the European Union in Brussels.

A Google spokesperson confirmed the appeal has been filed but declined to comment further.

Reached for comment, a Commission spokesperson told us: “The Commission will defend its decision in Court.”

The AdSense antitrust decision is the third fine for Google under the Commission’s current antitrust chief, Margrethe Vestager — who also issued a $5BN penalty for anti-competitive behaviors attached to Android last summer; following a $2.7BN fine for Google Shopping antitrust violations, in mid 2017.

Google is appealing both earlier penalties but has also made changes to how it operates Google Shopping and Android in Europe in the meanwhile, to avoid the risk of further punitive penalties.

In the case of AdSense, the Commission found that between 2006 and 2016 Google included restrictive clauses in its contracts with major sites that use its ad platform which Vestager said could only be seen as intending to keep rivals out of the market.

Restrictions had included exclusivity provisions and premium ad placement requirements that gave Google’s ads priority and plumb positioning on “the most visible and most profitable parts of the page”. Another illegal clause put controls on how partner websites could display rival search ads.

The restrictions were only removed by Google when the Commission issued its formal statement of objections in 2016 — signalling the start of serious scrutiny.

As well as going on to fine Google €1.49BN for AdSense antitrust breaches, the Commission’s enforcement decision requires that Google does not include any other restriction “with an equivalent effect” in its contracts, as well as stipulating that it must not reinstate the earlier abusive clauses.

House Democrats release more than 3,500 Russian Facebook ads

Democrats from the House Intelligence Committee have released thousands of ads that were run on Facebook by the Russia-based Internet Research Agency.

The Democrats said they’ve released a total of 3,519 ads today from 2015, 2016 and 2017. This doesn’t include 80,000 pieces of organic content shared on Facebook by the IRA, which the Democrats plan to release later.

What remains unclear is the impact that these ads actually had on public opinion, but the Democrats note that they were seen by more than 11.4 million Americans.

You can find all the ads here, though it’ll take some time just to download them. As has been noted about earlier (smaller) releases of IRA ads, they aren’t all nakedly pro-Trump, but instead express a dizzying array of opinions and arguments, targeted at a wide range of users.

“Russia sought to weaponize social media to drive a wedge between Americans, and in an attempt to sway the 2016 election,” tweeted Adam Schiff, who is the Democrats’ ranking member on the House Intelligence Committee. “They created fake accounts, pages and communities to push divisive online content and videos, and to mobilize real Americans,”

Russia sought to divide us by our race, our country of origin, our religion, and our politics. They attempted to hijack legitimate events meant to do good – teaching self-defense, providing legal aid – as well as those events meant to widen a rift.

Here’s just some examples: pic.twitter.com/YMX2FTgPGU

— Adam Schiff (@RepAdamSchiff) May 10, 2018

He added, “By exposing these Russian-created Facebook advertisements, we hope to better protect legitimate political expression and safeguard Americans from having the information they seek polluted by foreign adversaries. Sunlight is always the best disinfectant.

In conjunction with this release, Facebook published a post acknowledging that it was “too slow to spot this type of information operations interference” in the 2016 election, and outlining the steps (like creating a public database of political ads) that it’s taking to prevent this in the future.

“This will never be a solved problem because we’re up against determined, creative and well-funded adversaries,” Facebook said. “But we are making steady progress.”

Google is banning Irish abortion referendum ads ahead of vote

Google is suspending adverts related to a referendum in Ireland on whether or not to overturn a constitutional clause banning abortion. The vote is due to take place in a little over two weeks time.

“Following our update around election integrity efforts globally, we have decided to pause all ads related to the Irish referendum on the eighth amendment,” a Google spokesperson told us.

The spokesperson said enforcement of the policy — which will cover referendum adverts that appear alongside Google search results and on its video sharing platform YouTube — will begin in the next 24 hours, with the pause remaining in effect through the referendum, with the vote due to take place on May 25.

The move follows an announcement by Facebook yesterday saying it had stopped accepting referendum related ads paid for by foreign entities. However Google is going further and pausing all ads targeting the vote.

Given the sensitivity of the issue a blanket ban is likely the least controversial option for the company, as well as also the simplest to implement — whereas Facebook has said it has been liaising with local groups for some time, and has created a dedicated channel where ads that might be breaking its ban on foreign buyers can be reported by the groups, generating reports that Facebook will need to review and act on quickly.

Given how close the vote now is both tech giants have been accused of acting too late to prevent foreign interests from using their platforms to exploit a loophole in Irish law to get around a ban on foreign donations to political campaigns by pouring money into unregulated digital advertising instead.

Speaking to the Guardian, a technology spokesperson for Ireland’s opposition party Fianna Fáil, described Google’s decision to ban the adverts as “too late in the day”.

“Fake news has already had a corrosive impact on the referendum debate on social media,” James Lawless TD told it, adding that the referendum campaign had made it clear Ireland needs legislation to restrict the activities of Internet companies’ ad products “in the same way that steps were taken in the past to regulate political advertising on traditional forms of print and broadcast media”.

We’ve asked Google why it’s only taken the decision to suspend referendum ad buys now, and why it did not act months earlier — given the Irish government announced its intention to hold a 2018 referendum on repealing the Eighth Amendment in mid 2017 — and will update this post with any response.

In a public policy blog post earlier this month, the company’s policy SVP Kent Walker talked up the steps the company is taking to (as he put it) “support… election integrity through greater advertising transparency”, saying it’s rolling out new policies for U.S. election ads across its platforms, including requiring additional verification for election ad buyers, such as confirmation that an advertiser is a U.S. citizen or lawful permanent resident.

However this U.S.-first focus leaves other regions vulnerable to election fiddlers — hence Google deciding to suspend ad buys around the Irish vote, albeit tardily.

The company has also previously said it will implement a system of disclosures for ad buyers to make it clear to users who paid for the ad, and that it will be publishing a Transparency Report this summer breaking out election ad purchases. It also says it’s building a searchable library for election ads.

Although it’s not clear when any of these features will be rolled out across all regions where Google ads are served.

Facebook has also announced a raft of similar transparency steps related to political ads in recent years — responding to political pressure and scrutiny following revelations about the extent of Kremlin-backed online disinformation campaigns that had targeted the 2016 US presidential election.

Facebook stops accepting foreign-funded ads about Ireland’s abortion vote

Facebook has announced it has stopped accepting ads paid for by foreign entities that are related to a referendum vote in Ireland later this month, saying it’s acting to try to prevent outsiders from attempting to skew the vote. The referendum will decide whether to repeal or retain Ireland’s constitutional ban on abortion.

“Concerns have been raised about organisations and individuals based outside of Ireland trying to influence the outcome of the referendum on the Eighth Amendment to the Constitution of Ireland by buying ads on Facebook. This is an issue we have been thinking about for some time,” the company writes today on its Dublin blog.

“Today, as part of our efforts to help protect the integrity of elections and referendums from undue influence, we will begin rejecting ads related to the referendum if they are being run by advertisers based outside of Ireland.”

Facebook says it’s stopping foreign-funded ads because additional ad transparency and election integrity tools it has in the works — and is intending to roll out more widely, across its platform — will not be ready in time for Ireland’s Eighth Amendment vote, which will take place on May 25.

“What we are now doing for the referendum on the Eighth Amendment will allow us to operate as though these tools, which are not yet fully available, were in place today with respect to foreign referendum-related advertising. We feel the spirit of this approach is also consistent with the Irish electoral law that prohibits campaigns from accepting foreign donations,” Facebook writes.

“This change will apply to ads we determine to be coming from foreign entities which are attempting to influence the outcome of the vote on May 25. We do not intend to block campaigns and advocacy organisations in Ireland from using service providers outside of Ireland,” it adds.

The social media’s ad platform has been under increasing political scrutiny since revelations emerged about the extent of Kremlin-backed disinformation campaigns during the 2016 US presidential election. And last year Facebook admitted Kremlin-backed content — including, but not limited to, Facebook ads — may have reached as many as 126 million people during the election period.

Concerns have also been raised about the role of its platform during the UK’s 2016 referendum on EU membership — with an investigation into social media and campaign spending ongoing by the UK’s Electoral Commission, and another — by the UK’s data watchdog, the ICO — also looking more broadly at the use of data analytics for political purposes.

At the same time, a major Facebook data privacy scandal that erupted in March, after fresh details were published about the use of user data by a controversial political consultancy called Cambridge Analytica, has further dialed up the pressure on the company as lawmakers have turned their attention to the messy intersections of social media and politics.

Of course Facebook is by no means the only place online where all sorts of foreign agents have been caught seeking to influence opinions. But the Cambridge Analytica scandal has illustrated the powerful lure of the platform’s reach (and data holdings), as well as underlining how lax Facebook has historically been in controlling the messages people are paying it to target at its users.

In Ireland, the company had already fast-tracked the rollout of its ‘view ads’ ad transparency tool — ahead of a wider global rollout planned for this summer.

And last month policy staffers told a local parliamentary committee that the tool would help eliminate “foreign interference” in the upcoming referendum.

Although clearly Facebook has decided that an additional stop-gap measure — i.e. of rejecting foreign funded ads — was also needed given the timing (and indeed the sensitivity) — of the Eighth Amendment vote.

Last month Facebook also trailed plans to require advertisers that run popular Pages and/or are trying to run ads with political messages to verify their identity and location. But those advertiser verification steps do not appear to be ready in time for Ireland’s referendum. (Nor indeed were they in place for local elections in the UK earlier this month — although in a referendum the risks to democracy from a skewed vote are arguably higher, given there’s no established process for a re-vote in a few years’ time.)

The simpler-to-implement ‘view ads’ tool launched in Ireland on April 25, according to Facebook, which makes it the second market after Canada — where it began testing the feature.

The company claims the tool “enables Irish Facebook users to see all of the ads any advertiser is running on Facebook in Ireland at the same time” — though clearly ad visibility is not enough of a barrier against election fiddling on its own.

Facebook also says it will be using machine learning technology to help it identify ads that “should no longer be running”. And it’s supplementing these AI checks with human review, saying it’s built relationships with “political parties, groups representing both sides of the campaign and with the Transparent Referendum Initiative” — and is asking them to notify it if they have concerns about ad campaigns so it can assess and act on their reports, having established a dedicated reporting channel for this purpose.

Last month it also says it hosted an information session about its advertising and content policies for referendum campaign groups.

“We understand the sensitivity of this campaign and will be working hard to ensure neutrality at all stages. We are an open platform for people to express ideas and views on both sides of a debate. Our goal is simple: to help ensure a free, fair and transparent vote on this important issue,” it adds.

In addition to view ads and the decision to stop accepting foreign-funded referendum ads, Facebook says it is deploying its “Election Integrity Artificial Intelligence” for the vote in Ireland, as part of its efforts to identify fake accounts, misinformation and/or foreign interference — describing its approach as similar to what it did in advance of recent elections in France, Germany and Italy.

Last month its policy staffers also said it had set up an internal task force to handle the Ireland referendum.

UK watchdog orders Cambridge Analytica to give up data in US voter test case

Another big development in the personal data misuse saga attached to the controversial Trump campaign-linked UK-based political consultancy, Cambridge Analytica — which could lead to fresh light being shed on how the company and its multiple affiliates acquired and processed US citizens’ personal data to build profiles on millions of voters for political targeting purposes.

The UK’s data watchdog, the ICO, has today announced that it’s served an enforcement notice on Cambridge Analytica affiliate SCL Elections, under the UK’s 1998 Data Protection Act.

The company has been ordered to give up all the data it holds on one US academic within 30 days — with the ICO warning that: “Failure to do so is a criminal offence, punishable in the courts by an unlimited fine.”

The notice follows a subject access request (SAR) filed in January last year by US-based academic, David Carroll after he became suspicious about how the company was able to build psychographic profiles of US voters. And while Carroll is not a UK citizen, he discovered his personal data had been processed in the UK — so decided to bring a test case by requesting his personal data under UK law.

Carroll’s complaint, and the ICO’s decision to issue an enforcement notice in support of it, looks to have paved the way for millions of US voters to also ask Cambridge Analytica for their data (the company claimed to have up to 7,000 data points on the entire US electorate, circa 240M people — so just imagine the class action that could be filed here… ).

The Guardian reports that Cambridge Analytica had tried to dismiss Carroll’s argument by claiming he had no more rights “than a member of the Taliban sitting in a cave in the remotest corner of Afghanistan”. The ICO clearly disagrees.

Important development. @ICOnews agrees with our complaint and orders full disclosure to @profcarroll following findings of non-cooperation by Cambridge Analytica / SCL. We look forward to full disclosure within 30 days. Decision here: https://t.co/X5g1FY95j0 https://t.co/ZsonQhPsKQ

— Ravi Naik (@RaviNa1k) May 5, 2018

Cambridge Analytica/SCL Group responded to Carroll’s original SAR in March 2017 but he was unimpressed by the partial data they sent him — which ranked his interests on a selection of topics (including gun rights, immigration, healthcare, education and the environment) yet did not explain how the scores had been calculated.

It also listed his likely partisanship and propensity to vote in the 2016 US election — again without explaining how those predictions had been generated.

So Carroll complained to the UK’s data watchdog in September 2017 — which began sending its own letters to CA/SCL, leading to further unsatisfactory responses.

“The company’s reply refused to address the ICO’s questions and incorrectly stated Prof Caroll had no legal entitlement to it because he wasn’t a UK citizen or based in this country. The ICO reiterated this was not legally correct in a letter to SCL the following month,” the ICO writes today. “In November 2017, the company replied, denying that the ICO had any jurisdiction or that Prof Carroll was legally entitled to his data, adding that SCL did “.. not expect to be further harassed with this sort of correspondence”.”

In a strongly worded statement, information commissioner Elizabeth Denham further adds:

The company has consistently refused to co-operate with our investigation into this case and has refused to answer our specific enquiries in relation to the complainant’s personal data — what they had, where they got it from and on what legal basis they held it.

The right to request personal data that an organisation holds about you is a cornerstone right in data protection law and it is important that Professor Carroll, and other members of the public, understand what personal data Cambridge Analytica held and how they analysed it.

We are aware of recent media reports concerning Cambridge Analytica’s future but whether or not the people behind the company decide to fold their operation, a continued refusal to engage with the ICO will potentially breach an Enforcement Notice and that then becomes a criminal matter.

Since mid-March this year, Cambridge Analytica’s name (along with the names of various affiliates) has been all over headlines relating to a major Facebook data misuse scandal, after press reports revealed in granular detail how an app developer had used the social media’s platform’s 2014 API structure to extract and process large amounts of users’ personal data, passing psychometrically modeled scores on US voters to Cambridge Analytica for political targeting.

But Carroll’s curiosity about what data Cambridge Analytica might hold about him predates the scandal blowing up last month. Although journalists had actually raised questions about the company as far back as December 2015 — when the Guardian reported that the company was working for the Ted Cruz campaign, using detailed psychological profiles of voters derived from tens of millions of Facebook users’ data.

Though it was not until last month that Facebook confirmed as many as 87 million users could have had personal data misappropriated.

Carroll, who has studied the Internet ad tech industry as part of his academic work, reckons Facebook is not the sole source of the data in this case, telling the Guardian he expects to find a whole host of other companies are also implicated in this murky data economy where people’s personal information is quietly traded and passed around for highly charged political purposes — bankrolled by billionaires.

“I think we’re going to find that this goes way beyond Facebook and that all sorts of things are being inferred about us and then used for political purposes,” he told the newspaper.

Under mounting political, legal and public pressure, Cambridge Analytica claimed to be shutting down this week — but the move appears more like a rebranding exercise, as parent entity, SCL Group, maintains a sprawling network of companies and linked entities. (Such as one called Emerdata, which was founded in mid-2017 and is listed at the same address as SCL Elections, and has many of the same investors and management as Cambridge Analytica… But presumably hasn’t yet been barred from social media giants’ ad platforms, as its predecessor has.)

Closing one of the entities embroiled in the scandal could also be a tactic to impede ongoing investigations, such as the one by the ICO — as Denham’s statement alludes, by warning that any breach of the enforcement notice could lead to criminal proceedings being brought against the owners and operators of Cambridge Analytica’s parent entity.

In March ICO officials obtained a warrant to enter and search Cambridge Analytica’s London offices, removing documents and computers for examination as part of a wider, year-long investigation into the use of personal data and analytics by political campaigns, parties, social media companies and other commercial actors. And last month the watchdog said 30 organizations — including Facebook — were now part of that investigation.

The Guardian also reports that the ICO has suggested to Cambridge Analytica that if it has difficulties complying with the enforcement notice it should hand over passwords for the servers seized during the March raid on its London office – raising questions about how much data the watchdog has been able to retrieve from the seized servers.

SCL Group’s website contains no obvious contact details beyond a company LinkedIn profile — a link which appears to be defunct. But we reached out to SCL Group’s CEO Nigel Oakes, who has maintained a public LinkedIn presence, to ask if he has any response to the ICO enforcement notice.

Meanwhile Cambridge Analytica continues to use its public Twitter account to distribute a stream of rebuttals and alternative ‘facts’.

Facebook is still falling short on privacy, says German minister

Germany’s justice minister has written to Facebook calling for the platform to implement an internal “control and sanction mechanism” to ensure third-party developers and other external providers are not able to misuse Facebook data — calling for it to both monitor third party compliance with its platform policies and apply “harsh penalties” for any violations.

The letter, which has been published in full in local mediafollows the privacy storm that has engulfed the company since mid March when fresh revelations were published by the Observer of London and the New York Times — detailing how Cambridge Analytica had obtained and used personal information on up to 87 million Facebook users for political ad targeting purposes.

Writing to Facebook’s founder and CEO Mark Zuckerberg, justice minister Katarina Barley welcomes some recent changes the company has made around user privacy, describing its decision to limit collaboration with “data dealers” as “a good start”, for example.

However she says the company needs to do more — setting out a series of what she describes as “core requirements” in the area of data and consumer protection (bulleted below). 

She also writes that the Cambridge Analytica scandal confirms long-standing criticisms against Facebook made by data and consumer advocates in Germany and Europe, adding that it suggests various lawsuits filed against the company’s data practices have “good cause”.

Unfortunately, Facebook has not responded to this criticism in all the years or only insufficiently,” she continues (translated via Google Translate). “Facebook has rather expanded its data collection and use. This is at the expense of the privacy and self-determination of its users and third parties.”

“What is needed is that Facebook lives up to its corporate responsibility and makes a serious change,” she says at the end of the letter. “In interviews and advertisements, you have stated that the new EU data protection regulations are the standard worldwide for the social network. Whether Facebook consistently implements this view, unfortunately, seems questionable,” she continues, critically flagging Facebook’s decision to switch the data controller status of ~1.5BN international users this month so they will no longer be under the jurisdiction of EU law, before adding: “I will therefore keep a close eye on the further measures taken by Facebook.

Since revelations about Cambridge Analytica’s use of Facebook data snowballed into a global privacy scandal for the company this spring, the company has revealed a series of changes which it claims are intended to bolster data protection on its platform.

Although, in truth, many of the tweaks Facebook has announced were likely in train already — as it has been working for months (if not years) on its response to the EU’s incoming GDPR framework, which will apply from May 25.

Yet, even so, many of these measures have been roundly criticized by privacy experts, who argue they do not go far enough to comply with GDPR and will trigger legal challenges once the framework is being applied.

For example, a new consent flow, announced by Facebook last month, has been accused of being intentionally manipulative — and of going against the spirit of the new rules, at very least.

Barley picks up on these criticisms in her letter — calling specifically for Facebook to deliver:

  • More transparency for users
  • Real control of users’ data processing by Facebook
  • Strict compliance with privacy by default and consent in the entire ecosystem of Facebook
  • Objective, neutral, non-discriminatory and manipulation-free algorithms
  • More freedom of choice for users through various settings and uses

On consent, she emphasizes that under GDPR the company will need to obtain consent for each data use — and cannot bundle up uses to try to obtain a ‘lump-sum’ consent, as she puts it.

Yet this is pretty clearly exactly what Facebook is doing when it asks Europeans to opt into its face recognition technology, for example, by suggesting this could help protect users against strangers using their photos; and be an aid to visually impaired users on its platform; yet there’s absolutely no specific examples in the consent flow of the commercial uses to which Facebook will undoubtedly put the tech.

The minister also emphasizes that GDPR demands a privacy-by-default approach, and requires data collection to be minimized — saying Facebook will need to adapt all of its data processing operations in order to comply. 

Any data transfers from “friends” should also only take place with explicit consent in individual cases, she continues (consent that was of course entirely lacking in 2014 when Facebook APIs allowed a developer on its platform to harvest data on up to 87 million users — and pass the information to Cambridge Analytica).

Barley also warns explicitly that Facebook must not create shadow profiles, an especially awkward legal issue for Facebook which US lawmakers also questioned Zuckerberg closely about last month.

Facebook’s announcement this week, at its f8 conference, of an incoming Clear History button — which will give users the ability to clear past browsing data the company has gathered about them — merely underscores the discrepancies here, with tracked Facebook non-users not even getting this after-the-fact control, although tracked users also can’t ask Facebook never to track them in the first place.

Nor is it clear what Facebook does with any derivatives it gleans from this tracked personal data — i.e. whether those insights are also dissociated from an individual’s account.

Sure, Facebook might delete a web log of the sites you visited — like a gambling site or a health clinic — when you hit the button but that does not mean it’s going to remove all the inferences it’s gleaned from that data (and added to the unseen profile it holds of you and uses for ad targeting purposes).

Safe to say, the value of the Clear History button looks mostly as PR for Facebook — so the company can point to it and claim it’s offering users another ‘control’ as a strategy to try to deflect lawmakers’ awkward questions (just such disingenuousness was on ample show in Congress last month — and has also been publicly condemned by the UK parliament).

We asked Facebook our own series of questions about how Clear History operates, and why — for example — it is not offering users the ability to block tracking entirely. After multiple emails on this topic, over two days, we’re still waiting for the company to answer anything we asked.

Facebook’s processing of non-users’ data, collected via tracking pixels and social plugins across other popular web services, has already got Facebook into hot water with some European regulators. Under GDPR it will certainly face fresh challenges to any consent-less handling of people’s data — unless it radically rethinks its approach, and does so in less than a month. 

In her letter, Barley also raises concerns around the misuse of Facebook’s platform for political influence and opinion manipulation — saying it must take “all necessary technical and organizational measures to prevent abuse and manipulation possibilities (e.g. via fake accounts and social bots)”, and ensure the algorithms it uses are “objective, neutral and non-discriminatory”.

She says she also wants the company to disclose the actions it takes on this front in order to enable “independent review”.

Facebook’s huge sprawl and size — with its business consisting of multiple popular linked platforms (such as WhatsApp and Instagram), as well as the company deploying its offsite tracking infrastructure across the Internet to massively expand the reach of its ecosystem — “puts a special strain on the privacy and self-determination of German and European users”, she adds.

At the time of writing Facebook had not responded to multiple requests for comment about the letter.

The BBC will run its first podcast ads, powered by Acast

The BBC will start running ads in its podcasts, thanks to a partnership with podcast publishing and monetization company Acast.

Acast CEO Ross Adams told me that ads will start running later this week, with the BBC including “bumpers” today announcing the imminent ad launch.

“Podcasts are one way we’re reinventing BBC radio to engage younger audiences with our world class content,” said Bob Shennan, Director of BBC Radio and Music, in the announcement. “We’re working with established and new talent to produce shows which are informative and entertaining as only the BBC can be. The BBC has been challenged to generate more commercial income to supplement the licence fee and this new deal will contribute to that.”

To be clear, the BBC will remain ad-free in the United Kingdom, where, it’s supported by the aforementioned license fee. Adams said one of the things Acast could offer was the ability to make sure ads were only served outside the U.K. (and to account for edge cases like U.K. military bases in other countries).

Adams said Acast will also be providing the BBC with new data about how the podcasts are performing.

“We give them the data and the dashboard to start really doubling down and focusing on podcasting as a medium,” he said.

According the announcement, this will apply to all BBC podcasts outside the U.K. (subject to rights restrictions), including Global News, The Assassination, World Business Report and Radio 4’s In Our Time. Most podcasts will have a single 30-second ad the beginning, and then another at the end.

Google accused of using GDPR to impose unfair terms on publishers

A group of European and international publishers have accused Google of using an incoming update to the European Union’s data protection framework to try to push “draconian” new terms on them in exchange for continued access to its ad network — which many publishers rely on to monetize their content online.

Google trailed the terms as incoming in late March, while the new EU regulation — GDPR — is due to apply from May 25.

“[W]e find it especially troubling that you would wait until the last-minute before the GDPR comes into force to announce these terms as publishers have now little time to assess the legality or fairness of your proposal and how best to consider its impact on their own GDPR compliance plans which have been underway for a long time,” they write in a letter to the company dated April 30. “Nor do we believe that this meets the test of creating a fair, transparent and predictable business environment of the kind required by the draft Regulation COM (2018) 238 final published 26 April 2018 [an EU proposal which relates to business users of online intermediation services].”

The GDPR privacy framework both tightens consent requirements for processing the personal data of EU users and beefs up enforcement for data protection violations, with fines able to scale as high as four per cent of a company’s global annual turnover — substantially inflating the legal liabilities around the handling of any personal data which falls under its jurisdiction.

And while the law is intended to strengthen EU citizens’ fundamental rights by giving them more control over how their data is used, publishers are accusing Google of attempting to use the incoming framework as an opportunity to enforce an inappropriate “one-size fits all” approach to compliance on its publisher customers and their advertisers.

“Your proposal severely falls short on many levels and seems to lay out a framework more concerned with protecting your existing business model in a manner that would undermine the fundamental purposes of the GDPR and the efforts of publishers to comply with the letter and spirit of the law,” the coalition of publishers write to Google.

One objection they have is that Google is apparently intending to switch its status from that of a data processor of publishers’ data — i.e. the data Google receives from publishers and collects from their sites — to a data controller which they claim will enable it to “make unilateral decisions about how a publisher’s data is used”.

Though for other Google services, such as its web analytics product, the company has faced the opposite accusation: i.e. that it’s claiming it’s merely a data processor — yet giving itself expansive rights to use the data that’s gathered, rather like a data controller…

The publishers also say Google wants them to obtain valid legal consent from users to the processing of their data on its behalf — yet isn’t providing them with information about its intended uses of people’s data, which they would need to know in order to obtain valid consent under GDPR.

“[Y]ou refuse to provide publishers with any specific information about how you will collect, share and use the data. Placing the full burden of obtaining new consent on the publisher is untenable without providing the publisher with the specific information needed to provide sufficient transparency or to obtain the requisite specific, granular, and informed consent under the GDPR,” they write.

“If publishers agree to obtain consent on your behalf, then you must provide the publisher with detailed information for each use of the personal data for which you want publishers to ask for legally valid consent and model language to obtain consent for your activities.”

Nor do individual publishers necessarily want to have to use consent as the legal basis for processing their users personal data (other options are available under the law, though a legal basis is always required) — but they argue that Google’s one-size proposal doesn’t allow for alternatives.

“Some publishers may want to rely upon legitimate interest as a legal basis and since the GDPR calls for balancing several factors, it may be appropriate for publishers to process data under this legal basis for some purposes,” they note. “Our members, as providers of the news, have different purposes and interests for participating in the digital advertising ecosystem. Yet, Google’s imposition of an essentially self-prescribed one-size-fits-all approach doesn’t seem to take into account or allow for the different purposes and interests publishers have.”

They are also concerned Google is trying to transfer liability for obtaining consent onto publishers — asserting: “Given that your now-changed terms are incorporated by reference into many contracts under which publishers indemnify Google, these terms could result in publishers indemnifying Google for potentially ruinous fines. We strongly encourage you to revise your proposal to include mutual indemnification provisions and limitations on liability. While the exact allocation of liability should be negotiated by individual publishers, your current proposal represents a ‘take it or leave it’ disproportionate approach.”

They also accuse Google of risking acting in an anti-competitive manner because the proposed terms state that Google may stop serving ads on on publisher sites if it deems a publisher’s consent mechanism to be “insufficient”.

“If Google then dictates how that mechanism would look and prescribes the number of companies a publisher can work with, this would limit the choice of companies that any one publisher can gather consent for, or integrate with, to a very small number defined by Google. This gives rise to grave concerns in terms of anti-competitive behavior as Google is in effect dictating to the market which companies any publisher can do business with,” they argue.

They end the letter, which is addressed to Google’s CEO Sundar Pichai, with a series of questions for the company which they say they need answers to — including how and why Google believes its legal relationship to publishers’ data would be a data controller; whether it will seek publisher input ahead of making future changes to its terms for accessing its advertiser services; and how Google’s services could be integrated into an industry-wide consent management platform — should publishers decide to make use of one.

Commenting in a statement, Angela Mills Wade, executive director of the European Publishers Council and one of the signatories to the letter, said: “As usual, Google wants to have its cake and eat it. It wants to be data controller — of data provided by publishers — without any of the legal liability — and with apparently total freedom to do what they like with that data. Publishers have trusted relationships with their readers and advertisers — how can we get consent from them without being in a position to tell them what they are consenting to? And why should we be legally liable for any abuses when we have no control or prior knowledge? By imposing their own standard for regulatory compliance, Google effectively prevents publishers from being able to choose which partners to work with.”

The other publishers signing the letter are Digital Content Next, News Media Alliance and News Media Association.

We put some of their questions to Google — and the company rejected that it’s seeking additional rights over publishers’ data, sending us the following statement:

Guidance about the GDPR is that consent is required for personalised advertising. We have always asked publishers to get consent for the use of our ad tech on their sites, and now we’re simply updating that requirement in line with the GDPR. Because we make decisions on data processing to help publishers optimize ad revenue, we will operate as a controller across our publisher products in line with GDPR requirements, but this designation does not give us any additional rights to their data. We’re working closely with our publisher partners and are committed to providing a range of tools to help them gather user consent.

A spokesperson for the company also noted that, under GDPR, controller status merely reflects that an involved entity is more than a data processor for a specific service, also pointing out that Google’s contracts define the limits of what can be done with data in such instances.

The spokesperson further emphasized that Google is not asking publishers to obtain consent from Google’s users, but for their own users on their own sites and for the use of ad tech on those sites — noting this could be one of Google’s ad products or someone else’s.

In terms of timing the Google rep added the company would have liked to put the new ad policy out earlier but said that guidance on consent from the EU’s Article 29 Working Party only came out in draft in December, noting also that this continues to be revised. 

Facebook launches commerce “Analytics” app

Facebook wants to prove it can earn businesses money, not just build their social media audience. This morning, just before its big F8 conference, a “Facebook Analytics” app for iOS and Android appeared in the app stores. It touts the ability to “stay on top of your growth, engagement, and conversion efforts on the go. Easily view key metrics and reports, check automated insights, and receive notifications when changes occur.”

As social marketing has matured, companies aren’t content just getting Likes, followers, and reach. They want to sell stuff. Between store fronts on Facebook, marketing bots on Messenger, professional accounts and shopping tags on Instagram, and the new WhatsApp For Business app, Facebook wants to offer tools to keep them loyal.

We’ll likely hear more about the Analytics app later today during the conference, and we’ve reached out for more info. The app complements Facebook’s Pages Manager and Ad Manger. But rather than just those surfaces, the Analytics app helps businesses track their apps, websites, bots, and event source groups.

The Facebook Analytics app lets uses create custom mobile views of their most important metrics like revenue, retention, demographics, and active users. It ties into Facebook’s web Analytics suite to let you view funnels, cohorts, and segments you’ve created there. Some businesses will also see automated insights such as that you’ve expereinced a period of higher sales, or that a certain demographic spends more time or money in your app.

If Facebook can boost confidence in the return on investment businesses get from its social network, it could convince them to invest more in ads, content, and managing their presence there. Clients have largely stuck with Facebook through its recent scandals because there’s simply no place with more precise ways to reach customers. But as the app hits saturation in certain markets and user growth plateaus, Facebook must keep finding ways to squeeze more money out of each of them.

Hustle rallies $30M for grassroots texting tool Republicans can’t use

Hustle 20X’d its annual revenue run rate in 15 months by denying clients that contradict its political views. It’s a curious, controversial, yet successful strategy for the startup whose app lets activists and marketers text thousands of potential supporters or customers one at a time. Compared to generic email blasts and robocalls, Hustle gets much higher conversion rates because people like connecting with a real human who can answer their follow-up questions.

The whole business is built around those relationships, so campaigns, non-profits, and enterprises have to believe in Hustle’s brand. That’s why CEO Roddy Lindsay tells me “We don’t sell to republican candidates or committees. What it’s allowed us to do is build trust with the Democratic party and progressive organizations. We don’t have to worry about celebrating our clients’ success and offending other clients.”

Hustle execs from left: COO Ysiad Ferreiras, CEO Roddy Lindsay, CTO Tyler Brock

Investors agree. Tempted by Hustle’s remarkable growth to well over a $10 million run rate and 85 million conversations started, Insight Partners has led a $30 million Series B for the startup that’s joined by Google’s GV and Salesforce Ventures.

The round comes just 10 months after Hustle’s $8M Series A when it was only doing $3 million in revenue. Lindsay says he was impressed with Insight’s experience with communication utilities like Cvent and non-profit tools like Ministry Brands. Its managing director Hillary Gosher who specializes in growing sales teams will join Hustle’s board, which is a great fit since Hustle is hiring like crazy.

Humanizing The Call To Action

Founded in late 2014, Hustle’s app lets organizers write MadLibs-style text message scripts and import contact lists. Their staffers or volunteers send out the messages one by one, with the blanks automatically filled in to personalize the calls to action. Recipients can respond directly with the sender ready with answers to assuage their fears until they’re ready to donate, buy, attend, or help. Meanwhile, organizers can track their conversions, optimize scripts, and reallocate assignments so they can reach huge audiences with an empathetic touch.

The Hustle admin script editor

The app claims to be 77X faster than making phone calls and 5.5X more engaging than email, which has won Hustle clients like LiveNation’s concert empire, NYU, and the Sierra Club. Clients pay $0.30 per contact uploaded into Hustle, with discounts for bigger operations. Now at $41 million in total funding, Hustle plans to push further beyond its core political and non-profit markets and deeper into driving alumni donations for universities, sales for enterprises, and attendance for event promoters.

Hustle will be doing that without one of its three co-founders, Perry Rosenstein, who left at the end of 2017. [Disclosure: I know Lindsay from college and once worked on a short-lived social meetup app with Rosenstein called Signal.] Lindsay says Rosenstein’s “real excellence was about early stage activities and problems”. Indeed, in my experience he was more attuned to underlying product-market fit than the chores of scaling a business. “It was Perry’s decision, it was a departure we celebrated, and he’s still involved as an informal adviser to me and the company” Lindsay concluded.

Hustle is growing so fast, this recent photo is already missing a third of the team

Hustle has over 100 other employees in SF, NYC, and DC to pick up the torch, though. That’s up from just 12 employees at the start of 2017. And it’s perhaps one of the most diverse larger startups around. Lindsay says his company is 51 percent women, 48 percent people of color, and 21 percent LGBT. This inclusive culture attracts top diverse talent. “We see this as a key differentiator for us. It allows us to hire incredible people” Lindsay says. “It’s something we took seriously from day one and the results show.”

Partisan On Purpose

What started as a favored tool of the Bernie Sanders campaign has blossomed into a new method of communicating at scale. “We’re massively humanizing the way these organizations communicate” Lindsay said. “Humans really matter, no matter if what you care about is getting lots of people to come to events, vote, or renew a season ticket package. Having a relationship with another person can cut through the noise. That’s different than your interactions with bots or email marketing campaigns or things where it’s dehumanized.”

Lindsay felt the frustration of weak relationships when after leaving Facebook where he worked for six years as one of its first data scientists, he volunteered for Mark Zuckerberg’s Fwd.us immigration reform organization. Its email got just a 1 percent conversion rate. He linked up with Obama’s former Nevada new media director Rosenstein and CTO Tyler Brock to fix that with Hustle.

Working with Bernie aligned with the team’s political sentiments, but they were quickly faced with whether they wanted to fuel both sides of the aisle — which would mean delivering fringe conservative campaign messages they couldn’t stomach. Hustle still has no formal policy about declining Republican money, and a spokesperson said they point potential clients to TechCrunch’s previous article mentioning the stance. Meanwhile, Hustle is growing its for-profit client base to make shunning the GOP feel like less of a loss. Having Salesforce as a strategic investor also creates a bridge to a potential exit option.

Focusing on the left is working for now. Over 25 state Democratic parties are clients. Hustle sent 2.5 million messages and reached over 700,000 voters — 1 in 5 total — during the Alabama special election, helping Democrat Doug Jones win the Senate seat.

“Let’s build this great business for the Democratic party. Let’s let someone else take the Republicans” Lindsay explains. A stealth startup called OpnSesame is doing just that, Lindsay mentions. But he says “we don’t actually see them as competitive. We see them as potential allies that advocate for the power of p2p texting in getting everyone included in our democracy.” Instead, Lindsay sees the potential for Hustle to lose its sense of purpose and drive as it rapidly hires as its biggest threat.

Long-term, Hustle hopes to propel the right side of history by sticking to the left. Lindsay concludes, “You can really just put on your business hat and see this is a good choice.”