Google might have provided sensitive data of Ukraine sympathizers to a sanctioned Russian company

Google may have been involved in sharing sensitive information of users browsing Ukrainian websites with a sanctioned Russian ad tech company owned by Sberbank, a new report says.

The report seen by ProPublica details that a Russian ad company RuTarget (also unknown under the name Segmento) has been provided access to information on users’ browsing habits in Ukraine and other parts of the world by Google. Digital ad analysis firm Adalytics noted 700 instances of such sharing.

As of February 24th, RuTarget has been added to a US Treasury list of sanctioned companies, with Google stopping data sharing only four months later after being contacted by ProPublica.

RuTarget fell under sanctions as part of a complete block on all operations with Sberbank, a Russian state-owned bank, which is the largest Russian bank by assets' value. The block prohibits US citizens from operating with Sberbank or any of its affiliated companies.

While there was a variety of data shared, ProPublica highlights that information on those users who browsed Ukrainian websites is of most concern. This could have included unique mobile phone IDs, IP addresses, location information, and details about users’ interests and online activity.

“[It is] data that US senators and experts say could be used by Russian military and intelligence services to track people or zero in on locations of interest,” the report explains.

Senate Intelligence Committee Chairman Mark Warner has previously urged Google to consider how its platforms can be used by the Kremlin in its information war.

“Unfortunately, your platforms continue to be key vectors for malign actors – including, notably, those affiliated with the Russian government – to not only spread disinformation, but to profit from it,” he writes.

According to the company’s spokesperson Michael Aciman, Google has since seized operations with RuTarget. Yet, according to Aciman, the Russian ad tech company indeed had access to receiving user and ad buying data from Google up until the tech giant was alerted.

However, Aciman did not comment on whether RuTarget received data about Ukrainians.

“All companies have a responsibility to ensure that they are not helping to fund or even inadvertently support Vladimir Putin’s invasion of Ukraine. Hearing that an American company may be sharing user data with a Russian company – owned by a sanctioned, state-owned bank no less – is incredibly alarming and frankly disappointing. I urge all companies to examine their business operations from top to bottom to ensure that they are not supporting Putin’s war in any way,” Warner responded to the incident.