Affiliate Disclosure
If you buy through our links, we may get a commission. Read our ethics policy.

Google agrees to pay largest fine in FTC history for bypassing Safari privacy settings [u]

Google on Thursday agreed to pay a record $22.5 million fine for ignoring security settings designed to prevent advertisers from tracking users with cookies in Apple's Safari web browser, bringing an end to a six month investigation aimed at better protecting consumers' privacy rights online.

FTC members conflicted over settlement

The penalty imposed by the United States Federal Trade Commission is the largest the agency has ever issued and the first for violations of its Internet privacy order.

Despite the record setting fine, FTC members issued a statement (PDF) noting that the fine posed no serious threat to the company, and that Google agreed to pay the fine only if it could "denial of the substantive allegations in the Commission’s civil penalty complaint."

Commissioner J. Thomas Rosch voted against the order, arguing that the FTC's settlement with Google was not in the public interest, primarily because it allowed Google to deny the allegations raised by the FTC.

The FTC wasn't just responding to Google's bypassing of Safari settings. Instead, the settlement involved the larger issue of an agreement the FTC made with Google last year addressing the privacy of users. Google's willful bypassing of Safari's settings violated that earlier consent order, the commission determined.

Allowing Google to deny liability while still paying a fine divided the Commission members 4 to 1 against Rosch. "We strongly disagree with Commissioner Rosch’s view that if the Commission allows a defendant to deny the complaint’s substantive allegations, the settlement is not in the public interest," other members wrote.

"Here, as in all cases, a defendant’s denial of liability in a settlement agreement has no bearing on the Commission’s determination as to whether it has reason to believe the defendant has violated the law or that a proposed settlement will afford appropriate relief for the Commission’s charges."

Google's lying to users deemed more serious than feeding them ads they didn't want

Commission members noted that the heart of the charges were aimed, not at Google's continuing to collect identifying data through cookies, but primarily at Google's false instructions to Safari users telling them that they didn't need to opt out because, Google had lied, Apple's default Safari settings were being respected by the company and that no further action on users' part was necessary.

Commissioners who voted for the deal wrote that "the historic $22.5 million fine is an appropriate remedy for our charge that Google violated a Commission order by misrepresenting to Safari browser users how to avoid targeted advertising by Google."

"In our view," they added, "the most important question is whether Google will abide by the underlying FTC consent order going forward."

There's more where that came from

"We firmly believe that the Commission’s swift imposition of a $22.5 million fine helps to promote such future compliance," the group stated in response to Rosch's opposition to the settlement. "With a company of Google’s size, almost any penalty can be dismissed as insufficient.

"But it is hardly inconsequential to impose a $22.5 million civil penalty when the accompanying complaint does not allege that the conduct at issue yielded significant revenue or endured for a significant period of time.

"This settlement is intended to provide a strong message to Google and other companies under order that their actions will be under close scrutiny and that the Commission will respond to violations quickly and vigorously."

Google remains under its consent order, and the FTC has left the door open to additional fines if the search giant continues to violate its agreement with the government not to bypass the rights of users and lie to them about what they are doing or provide false instructions about how to opt out of Google's data collections.

Busted by Old Media

Google's investigation by the FTC, initiated in February, followed a Wall Street Journal investigation that alleged Google and other ad networks had bypassed Safari's security protocols, violating its October 2011 privacy settlement with the FTC.

Specifically, the FTC charged that for several months in 2011 and 2012, Google placed a certain advertising tracking cookie on the computers of Safari users who visited sites within Google’s DoubleClick advertising network. It did so, the agency asserted, despite previous promises to Safari users that they would automatically be opted out of such tracking as a result of the default settings in Safari on Macs, iPhones and iPads. 

"The record setting penalty in this matter sends a clear message to all companies under an FTC privacy order," said FTC Chairman Jon Leibowitz. "No matter how big or small, all companies must abide by FTC orders against them and keep their privacy promises to consumers, or they will end up paying many times what it would have cost to comply in the first place."

Google denied wrongdoing early and often

For its part, Google in a statement to AppleInsider previously denied the claims waged by the Journal, alleging the paper "mischaracterizes what happened and why." The company issued a statement saying:

We used known Safari functionality to provide features that signed-in Google users had enabled. It’s important to stress that these advertising cookies do not collect personal information.

Unlike other major browsers, Apple’s Safari browser blocks third-party cookies by default. However, Safari enables many web features for its users that rely on third parties and third-party cookies, such as “Like” buttons. Last year, we began using this functionality to enable features for signed-in Google users on Safari who had opted to see personalized ads and other content— such as the ability to “+1” things that interest them.

To enable these features, we created a temporary communication link between Safari browsers and Google’s servers, so that we could ascertain whether Safari users were also signed into Google, and had opted for this type of personalization. But we designed this so that the information passing between the user’s Safari browser and Google’s servers was anonymous— effectively creating a barrier between their personal information and the web content they browse.

However, the Safari browser contained functionality that then enabled other Google advertising cookies to be set on the browser. We didn’t anticipate that this would happen, and we have now started removing these advertising cookies from Safari browsers. It’s important to stress that, just as on other browsers, these advertising cookies do not collect personal information.

Google floats above the law, pays millions only when caught

Google's FTC fine pales in comparison to the $500 million forfeiture settlement it paid the US government after allowing a Canadian pharmacy to illegally advertise drugs in the United States, supporting the illegal import of prescription drugs and controlled substances into the country.

That forfeiture, to avoid further litigation with the government, was also described as the largest ever of its kind. Google's criminal activity was only discovered after David Whitaker, the target of a multimillion dollar financial fraud scheme, was apprehended and confessed to federal investigators that he had been advertising illegal drugs using Google's AdWords program.

Whitaker demonstrated to investigators how he had set up a number of websites using Google's AdWords to advertise illegal drugs. Further investigation revealed that Google knew about the fraudulent advertising as early as 2003, but failed to stop the online pharmacies because it was making money on them.

The Canadian pharmacies Google assisted were not just skirting inconvenient laws to provide Americans with cheaper drugs. Instead, investigators noted that "Google was also on notice that many pharmacies accepting an online consultation rather than a prescription charged a premium for doing so because individuals seeking to obtain prescription drugs without a valid prescription were willing to pay higher prices for the drugs."

Government investigators specifically noted that Google had acknowledged “that it improperly assisted Canadian online pharmacy advertisers," not only allowing them to place illegal AdWords advertisements, but that also "from 2003 through 2009, Google provided customer support to some of these Canadian online pharmacy advertisers to assist them in placing and optimizing their AdWords advertisements and in improving the effectiveness of their websites."