Google Allowed a Sanctioned Russian Ad Company to Harvest User Data for Months

This article details how Google shared user data with a sanctioned Russian ad firm, RuTarget, despite U.S. sanctions on Russia following its invasion of Ukraine. Researchers found that through Google’s ad network, millions of websites and apps inadvertently exposed their users’ browsing and location data to RuTarget. This occurred because RuTarget was listed as an approved bidder in Google’s real-time ad auctions, a relationship publicly disclosed on Google’s own support pages.

In 2021, U.S. senators investigating foreign data access demanded that major tech companies, including Google, disclose their partnerships. While competitors like Amazon and Microsoft complied, Google refused to name its partners, citing “non-disclosure obligations.” However, researchers discovered that Google openly listed hundreds of partner firms—including over 30 Chinese-owned and 16 Russian-based companies—on its public websites. RuTarget was among these, contradicting Google’s claim it couldn’t disclose the information.

Major publishers like Reuters and ESPN unknowingly shared user data with RuTarget via their reliance on Google’s ad tools. Consent pop-ups on these sites listed RuTarget as a recipient of user data under EU privacy laws. After Russia’s invasion of Ukraine, Google cut ties with Russian bidders, including RuTarget, but only in late March 2022—weeks after sanctions began. Reuters confirmed it had no recent transactions with RuTarget post-April 6, while ESPN did not respond.

The article highlights systemic issues: Google’s dominance forces publishers to use its services despite risks, and the opaque digital ad ecosystem enables widespread data sharing without user awareness. It also notes that RuTarget’s clients included major global brands like Pfizer and Procter & Gamble, though some denied current ties. Experts argue the ad-tech landscape is complex and poorly regulated, leaving users vulnerable.

A correction clarifies the Federal Trade Commission chair’s name: Lina Khan, not Linda. The piece underscores calls for tighter oversight of data practices and transparency in tech partnerships. (Word count: 398)