Google allowed a sanctioned Russian advertising company to collect user data from Ukraine for months

After Russia’s full-scale invasion of Ukraine, Senate Intelligence Committee Chairman Mark Warner sent a letter to Google warning the company to be on the lookout for “exploitation of your platform by Russia and Russian-linked entities” and urging the search giant to conduct an audit of its advertising business for economic compliance with the sanctions.

But on June 23, after the publication of a new report, it was revealed that Google shared potentially confidential user data with the sanctioned Russian ad tech company RuTarget, which is owned by Russia’s largest state-owned bank, Sberbank. This is disclosed in the investigation of ProPublica.

Google has allowed RuTarget, a Russian company that helps brands and agencies buy digital advertising, to access and store data about people browsing websites and apps in Ukraine and other parts of the world, according to research by digital advertising analytics company Adalytics.

Adalytics found about 700 examples of RuTarget obtaining user data from Google after the company was added to the US Treasury Department’s list of sanctioned entities on February 24. Data sharing between Google and RuTarget stopped four months later, on June 23, the day ProPublica contacted Google for a comment about the activity.

Of particular concern is the fact that the analysis showed that Google provided data to RuTarget about users who browsed websites in Ukraine. This means that Google could have shared sensitive information such as unique cell phone identifiers, IP addresses, location information, and information about user interests and online activity, data that US senators and experts believe could be used by the Russian military and intelligence services to track people or locations.

Last April, a bipartisan group of U.S. senators sent Google and other major ad tech companies a letter warning of the national security implications of data shared as part of the digital ad buying process. They noted that this user data “will be a gold mine for foreign intelligence agencies, who can use it to inform and enhance hacking, blackmail and influence campaigns.”

Google spokesman Michael Asiman said the company blocked RuTarget from using its ad products in March, and that the firm has not bought ads directly through Google since then. However, he acknowledged that the Russian company was still receiving user and ad-buying data from Google before the problem was spotted by ProPublica and Adalytics.