ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for The Big Story newsletter to get stories like this delivered to your inbox,
A day after Russia’s February invasion of Ukraine, Senate Intelligence Committee Chairman Mark Warner sent a letter to Google warning that it is on alert for “exploitation of your platform by Russia and Russian-linked entities” and to the company Calling to have your ad audited. Compliance of business with economic sanctions.
But as recently as June 23, Google was sharing potentially sensitive user data with an approved Russian ad tech company owned by Russia’s largest State Bank, according to a new report provided to ProPublica.
Google has given permission to RuTarget, a Russian company that helps brands and agencies buy digital ads, about people browsing websites and apps in Ukraine and other parts of the world, according to research by digital advertising analysis firm Adalytics. To access and store data in After adding the company to the US Treasury list of Approved Entities on February 24, Adalytics identified nearly 700 instances of RuTarget receiving user data from Google. Data sharing between Google and RuTarget ceased four months later on June 23, the day ProPublica contacted. Google About Activity.
RuTarget, which also operates under the name Segmento, is owned by Sberbank, a Russian state bank that the Treasury described as “uniquely important” to the country’s economy when it struck the lender with initial sanctions. . RuTarget was later listed in an April 6 Treasury Declaration that imposed complete blocking restrictions on Sberbank and other Russian entities and individuals. The sanctions mean that US individuals and entities must not do business with RuTarget or Sberbank.
Of particular concern, the analysis revealed that Google shared data with RuTarget about users browsing websites in Ukraine. This means that Google may have altered important information such as unique mobile phone IDs, IP addresses, location information, and details about users’ interests and online activity, data that US senators and experts say. Can be used by the Russian military and intelligence services to track people or zeros at places of interest.
Last April, a bipartisan group of US senators sent a letter to Google and other major ad technology companies warning of the national security implications of data shared as part of the digital ad buying process. He added that this user data “will be a goldmine for foreign intelligence services that can exploit it to inform and supercharge hacking, blackmail and influence campaigns.”
Google spokesman Michael Aciman said the company barred RuTarget from using its advertising products in March and that RuTarget has not purchased ads directly through Google since then. He acknowledged that the Russian company was still receiving user and ad purchase data from Google before being alerted by ProPublica and Adalytics.
“Google is committed to complying with all applicable restrictions and business compliance laws,” Aciman said. “We have reviewed the entities in question and have taken appropriate enforcement action beyond the measures we took to prevent them from using Google advertising products directly earlier this year.”
Aciman said the action includes not only blocking RuTarget from accessing user data, but also blocking ads from purchasing through third parties in Russia that cannot be approved. He declined to say whether RuTarget had purchased ads through Google systems using such third parties, and did not comment on whether data about Ukrainians was shared with RuTarget.
Krzysztof Franaszek, who runs Adalytics and wrote the report, said RuTarget’s ability to access and store user data from Google could open the door to serious potential abuse.
“All we know is that they are taking that data and combining it with 20 other data sources that God knows where,” he said. “If RuTarget’s other data partners include the Russian government or intelligence or cybercriminals, there is a huge risk.”
In a statement to ProPublica, Virginia Democrat Warner called Google’s failure to sever its ties with RuTarget alarming.
“All companies have a responsibility to ensure they are not helping to fund or inadvertently support Vladimir Putin’s invasion of Ukraine. Hearing that a US company is sharing user data with a Russian company — being owned by an approved, state-owned bank — is incredibly dangerous and frankly disappointing,” he said. “I urge all companies to examine their business operations from top to bottom to make sure they are not supporting Putin’s war in any way.”