Report: Google allowed sanctioned Russian ad company to harvest user data for months

According to a report by ProPublica, Google had been sharing potentially sensitive user data with a sanctioned Russian ad tech company owned by Russia’s largest state bank until as recently as June 23.

Citing data from digital ad analysis firm Adalytics, the report details how Google allowed RuTarget, a Russian company that helps brands and agencies buy digital ads, to access and store data from people browsing online in Ukraine and other parts of the world. The report

Overall, Adalytics identified close to 700 examples of RuTarget receiving user data from Google, despite the fact that the ad tech company had been added to the U.S. Treasury’s list of sanctioned entities in late February. The data sharing between Google and RuTarget continued for about four months. It the data sharing ended on June 23 after ProPublica sought answers from Google about the suspicious activity.

“For all we know they are taking that data and combining it with 20 other data sources they got from God knows where,” said Krzysztof Franaszek, who runs Adalytics and authored the report. “If RuTarget’s other data partners included the Russian government or intelligence or cybercriminals, there is a huge danger.”

RuTarget is owned by Sberbank, a Russian state bank that, in early April, was added to the U.S. Treasury’s list of Russian entities and people imposed with full blocking sanctions – meaning that U.S. individuals and entities are not supposed to conduct business with them.

Responding to the report, Google spokesperson Michael Aciman said that Google blocked RuTarget from using its ad products in March and has not sold ads to the company since then. However, he did acknowledge that the Russian company was still receiving user and ad buying data from Google before being alerted by ProPublica and Adalytics.

“Google is committed to complying with all applicable sanctions and trade compliance laws. We’ve reviewed the entities in question and have taken appropriate enforcement action beyond the measures we took earlier this year to block them from directly using Google advertising products,” Aciman said.