Why GDPR is a gift to Google’s competitors

Google has taken some hits this week. First, news broke of Google’s $170 million settlement with the FTC and the New York attorney general. The settlement centers around allegations that YouTube collected data on and served targeted ads to children, without parental consent. Then, reports surfaced that a group of 30 state attorney generals will announce a new coordinated antitrust probe of Google on September 9.

But despite the seriousness of these reports, neither are the biggest of Google’s concerns right now. What should be most concerning to Google is that its direct competitors—many of whom lack the resources to compete head-to-head with Google—have found a new tool for weakening the tech giant’s position: GDPR.

Brave, the company behind the privacy-focused Brave Browser, released a report documenting an investigation it commissioned into Google’s DoubleClick/Authorized Buyers ad system. For context, the ad system is supposed to anonymize users so that one advertiser can’t combine the data it collects from a user with the data another advertiser collects on the same user. To allow companies to swap and compile user data like that would be a GDPR violation—and according to Brave’s report, that’s exactly what Google has done.

Before publishing the report, Brave shared the findings with the Irish Data Protection Commission, which has been investigating the DoubleClick/Authorized Buyers system, as well.

It’s unclear how this revelation will impact Google financially. In theory, serious GDPR violations can result in fines of up to 4% of a company’s total annual revenue. In 2018, Google reported $136.8 billion in revenue, which means a 4% fine would come out to about $5.5 billion—no small hit.

Seeing such a fine levied would be a very extreme scenario, as in the past regulators have chosen to issue smaller fines against Google for GDPR violations. However, the potential for such a fine makes GDPR a powerful weapon for smaller, privacy-focused startups hoping to level the playing field and keep bigger tech companies accountable.