Brave accuses Google of violating a key principle of the General Data Protection Regulation (GDPR) . Specifically, under the GDPR, companies must state exactly the purpose for which they collect and process users' personal ask and data for consent.
However, Brave (the company behind the Brave browser) filed a complaint with the Irish Data Protection Commission (DPC), stating that Google's privacy policy violates the GDPR, as it "does not explicitly and transparently identify the purposes for which data is collected and processed."
Based on this specific principle of the GDPR, companies must collect and process personal data for a specific purpose, which must be explicitly expressed to users.
Johnny Ryan, a key executive at Brave browser , said Google’s privacy policies are “indescribably vague.” According to Ryan, Google says it collects information for reasons like “developing new services.” That’s too general and not legitimate under GDPR.
Ryan also claims that Google provides ads that match each user's interests, but does not provide enough information about the purposes of data processing and the reasons why users see a particular ad.
Ryan states in the complaint that Google's policy is not at all clear and cannot be verified to determine that what it says is actually being implemented.
The complaint also includes a study, called “Inside the Black Box,” which analyzes the purposes for which Google collects and processes data.
Referring to the study, Ryan claims that the reasons Google cites are not precisely defined, making them meaningless. Data is collected without users knowing the reason. This practice violates the GDPR.
According to Ryan, having personal data doesn't mean Google can use that datafor whatever purpose it wants. It must be completely transparent about the purposes for which it uses the data.
“But Brave’s new data reveals that Google is using personal information for businesses and products in ways that violate the GDPR principle,” he said.
As part of the complaint, Brave asked Google to provide a full list of the purposes for which it processes users, as well as the relevant legal bases for each purpose.
The DPC has already launched an investigation.
