I’m Alan Chapell. Over the past 20+ years, I’ve been outside privacy counsel to hundreds of digital media companies and have brought over 40 of them to successful exits. I write a monthly syndicated report called The Chapell Regulatory Insider, and I’m also a regulatory analyst for The Monopoly Report.
The latest Monopoly Report podcast! This week, I welcome Marc Guldimann, Co-Founder and CEO of Adelaide. We discuss why attribution may be solving the wrong problem, how Adelaide measures media quality, and whether attention can become a true currency for digital advertising.
The great ones make it look easy.
AI Vampires Came for Spirit Airlines
As you may know, Spirit Airlines announced in May that it was shutting down operations and is in process of selling off its assets. Those assets include a trove of data that Spirit has built over the past 50 years. Google outbid another AI firm to purchase that data set for $10 million dollars.
On the one hand, it’s encouraging to see an AI company paying for data. :)
On the other hand, if you happened to have sent an email to Spirit complaining that their food gave you diarrhea back in 2005*, it probably never crossed your mind that your correspondence would ultimately make its way into an AI company and be memorialized forever. Same with decades of Spirit’s internal correspondence and confidential employee records.
Wait. Is This Legal?
Well, it’s certainly legal in that there’s no law that prevents it from happening. A labor union representing the employees of Spirit Airlines has filed an objection with the bankruptcy court, and as a result, the sale hearing has been pushed back a few weeks. But just know that bankruptcy law only mandates that a debtor engage a consumer privacy ombudsman to evaluate the sale of data in a very narrow set of circumstances. (I should know. I’ve been appointed as CPO in over 25 bankruptcies over the years.)
So, one can certainly argue that the transfer of this information to Google here is inappropriate, but I’m not sure there’s a clear legal foothold for those seeking to prevent its sale. Also, the $10 million dollars would help get creditors paid, and that’s certainly a valid consideration.
As part of the sale, Google commits not to “intentionally associate the Deidentified Data with any person or household” and may only “transfer Deidentified Data to third parties, provided that [Google] contractually obligates such transferees to comply with the provisions.”
So yeah. The data is all de-identified by Google. Accordingly, it’s privacy safe — right?
How Can We Judge “Privacy Safe”?
At the end of the day, the bankrupcty court judge and everyone else will probably have to take Google’s word that this incredibly vast data set has been sufficiently de-identified and that privacy interests are safeguarded.
And that is precisely the issue I want to examine today. Because any assurance Google provides here should be evaluated in the context of statements Google has made in other venues.
Search Data Is Always Unsafe as It Leaves Google
I’ve written, podcasted, and even done a Daily Show-style video about this issue. Google is legally required to share search data with rivals in two separate legal proceedings:
The U.S. Search Antitrust case against Google
EU Commission decision against Google under the Digital Markets Act.
But in those cases, Google is effectively stating that that a good chunk of its search data is so detailed and sensitive that is all but impossible to anonymize, de-identify, or render it as privacy safe — even though the recipients (i.e., rival search engines) are legally required to protect the data and undergo audits.
Advertising Data Is Only Safe If It Remains with Google
And the search data-sharing claims are coming in the wake of Google’s attempt to establish the Chrome browser as the central repository for all advertising data, under the framing that the company’s use of privacy-enhancing technologies (PETs) rendered the advertising data set as privacy safe.
Here’s the Bottom Line
You don’t have to be a privacy or regulatory expert to see there’s a jiu-jitsu move or three being played. Google is effectively making the following claims:
Google’s receipt of decades of sensitive data pursuant to a bankruptcy sale is privacy safe, and we should all take its word for it.
Google’s provision of search data is not privacy safe, regardless of anonymization techniques used and the number of audits conducted.
Google’s collection and processing of all ad data via Chrome is not only privacy safe but also would make for a “better” ad-supported internet.
At some point, privacy, data protection, competition, and perhaps even bankruptcy law will ask Google to actually show its math.
__________________________________________
* allegedly gave you diarrhea. This is not meant as a broader statement on the quality of Spirit airlines’ food, or airline food more generally.
If there’s an area that you want to see covered on these pages, if you agree or disagree with something I’ve written, if you want to tell me you dig my music, or if you just want to yell at me, please reach out to me on LinkedIn or in the comments below.
Be in the rooms defining the future of advertising and brand building.
This fall, Marketecture Live is setting its clocks to Central Time and convening in the heart of brand building: Chicago.
The Windy City established the blueprint for world-class brand work. Now, it serves as the backdrop for conversations shaping AI, retail media, connected TV, creator marketing, and the future of consumer engagement.
There’s no better place for brand and agency professionals to revamp their strategies for an AI- and creator-led future of brand building.
Tickets are going fast. Secure your seat at chicago.marketecturelive.com.
Tickets are complimentary for qualified agency and brand attendees.
