Google today agreed to pay $22.5 million to settle a Federal Trade Commission (FTC) charge that it bypassed Safari’s privacy settings to serve targeted ads to consumers. Google placed these cookies on Safari users’ computers, despite the fact that, as the FTC notes, “Google had previously told these users they would automatically be opted out of such tracking, as a result of the default settings of the Safari browser used in Macs, iPhones and iPads.” This, according to the FTC, was in direct violation of the earlier privacy settlement between Google and the FTC.
The FTC’s charge focused on the fact that Google exploited a loophole in Safari to place cookies on its users’ computers even though Safari, by default, blocks cookies from third-party sites. As the WSJ reported earlier this year, Safari makes an exception for cookies from sites that users interacted with before by, for example, filling out a form. To place its ad tracking cookies, Google tricked Safari into believing that users were submitting a form to Google and the browser would then allow Google to install its temporary ad tracking cookies.
The existence of today’s fine was first reported last week, but wasn’t official until today. Given that this is a settlement, it’s important to note that today’s “consent order is for settlement purposes only and does not constitute an admission by the defendant that the law has been violated.”
Despite these legal details, the FTC is clearly looking at this settlement as a success. “The record setting penalty in this matter sends a clear message to all companies under an FTC privacy order,” said Jon Leibowitz, Chairman of the FTC. “No matter how big or small, all companies must abide by FTC orders against them and keep their privacy promises to consumers, or they will end up paying many times what it would have cost to comply in the first place.” One could easily argue, though, that paying a $22.5 million fee isn’t exactly a problem for Google, which had an operating income of over $3 billion last quarter.
We asked Google for a statement regarding today’s announcement. Here is Google’s response:
We set the highest standards of privacy and security for our users. The FTC is focused on a 2009 help center page published more than two years before our consent decree, and a year before Apple changed its cookie-handling policy. We have now changed that page and taken steps to remove the ad cookies, which collected no personal information, from Apple’s browsers.
Google has until February 15, 2014 to expire all of the cookies involved in today’s settlement.