Google allows Russian advertising company under sanctions to collect user data for months

ProPublica is a Pulitzer Prize-winning investigative news outlet. Subscribe to The Big Story newsletter to receive similar stories in your inbox.

The day after Russia’s February invasion of Ukraine, Senate Intelligence Committee Chairman Mark Warner sent a letter to Google warning that the company should be on the lookout for “exploitation of your platform by Russia and Russia-related entities”and urged the company to audit your advertisement. business compliance with economic sanctions.

But as recently as June 23, Google shared potentially sensitive user data with a sanctioned Russian advertising company owned by Russia’s largest state bank, according to a new report provided by ProPublica.

Google has allowed RuTarget, a Russian company that helps brands and agencies buy digital ads, access and store data about people browsing websites and apps in Ukraine and other parts of the world, according to a study by digital ad analytics company Adalytics. Adalytics has identified about 700 cases in which RuTarget received user data from Google after the company was added to the U.S. Treasury Department’s list of sanctioned entities on February 24. The data exchange between Google and RuTarget ended four months later on June 23, the day ProPublica contacted Google about the activity.

RuTarget, which also operates under the Segmento name, is owned by Sberbank, a Russian state-owned bank that the Treasury called “critical”to the country’s economy when it imposed initial sanctions on the lender. RuTarget was later listed in an April 6 statement from the Finance Ministry, which imposed full blocking sanctions on Sberbank and other Russian entities and individuals. The sanctions mean that US individuals and entities must not do business with RuTarget or Sberbank.

Of particular concern is the analysis, which showed that Google shared with RuTarget data about users browsing websites from Ukraine. This means that Google may have shared sensitive information such as unique mobile phone identifiers, IP addresses, location information, and details of user interests and online activity, data that U.S. senators and experts believe could be used by Russian military and intelligence agencies to track people. or focus on places of interest.

Last April, a bipartisan group of U.S. senators sent a letter to Google and other major ad tech companies warning about the national security implications of data shared as part of the digital ad buying process. They said that this user data “will be a goldmine for foreign intelligence services that can use it to inform and amplify hacking, blackmail and influence campaigns.”

Google spokesman Michael Aciman said the company blocked RuTarget from using its advertising products in March, and that since then RuTarget has not bought ads directly through Google. He acknowledged that the Russian company was still receiving user and ad purchase data from Google before ProPublica and Adalytics warned about it.

“Google is committed to complying with all applicable sanctions and trade compliance laws,”Aciman said. “We have reviewed the organizations in question and have taken appropriate enforcement action, in addition to the measures we took earlier this year, to block their direct use of Google’s advertising products.”

Aciman said the action includes not only preventing RuTarget from further accessing user data, but also a ban on buying ads through third parties in Russia, which cannot be subject to sanctions. He declined to say whether RuTarget bought ads through Google systems with the help of such third parties, and did not comment on whether data about Ukrainians was passed to RuTarget.

Krzysztof Franaszek, head of Adalytics and author of the report, said RuTarget’s ability to access and store Google user data could open the door to serious potential abuse.

“As far as we know, they are taking this data and combining it with 20 other data sources that they got from God knows where,” he said. “If RuTarget’s other data partners include the Russian government, intelligence or cybercriminals, there is a huge danger.”

In a statement to ProPublica, Warner, a Democrat from Virginia, called Google’s inability to cut ties with RuTarget worrisome.

“All companies have a responsibility to ensure that they do not help finance or even inadvertently support Vladimir Putin’s invasion of Ukraine. Hearing that a US company could be sharing user data with a Russian company owned by no less than a sanctioned state-owned bank is incredibly disturbing and downright disappointing,” he said. “I urge all companies to review their business operations from top to bottom to make sure they are not supporting Putin’s war in any way.”