Personal data that and tech companies are harvesting from visitors to European Union government sites is in apparent violation of the authorities' own EU data protection rules, a study has found.
The study, by Danish browser-analysis company Cookiebot, found that EU governments are allowing more than 100 advertising companies, including Google and Facebook, to track citizens across sensitive public sector websites, contradicting their own data rules.
Industry experts say the data gathered could be combined with data from other sources to draw detailed profiles of each unique user — which could in turn be sold to data brokers.
The Financial Times reported that Cookiebot found ad trackers — which log users' locations, devices and browsing behaviors for advertisers — on the official government websites of 25 EU member states.
Google, YouTube and DoubleClick, Google's advertising platform, accounted for three of the top five tracking domains on 22 of the main government websites.
It appeared that social sharing widgets, such as ShareThis, were being used by commercial trackers to gain access to these public websites through backdoor tactics.
Daniel Johannsen, chief executive of Cookiebot, told the FT: "We found a lot of adtech trackers were smuggling in other third parties through these plug-ins, without the consent of users or knowledge of the governments themselves.
"Although the governments presumably do not control or benefit from the documented data collection, they still allow the . . . privacy of their citizens to be compromised, in violation of the laws that they have themselves put in place."
Eliot Bendinelli, a technologist at Privacy International, the non-profit, told the FT: "Any website has a responsibility to inform their user about any data collection and processing happening on their website," said. "The fact that these websites . . . can't comply with this basic requirement shows that the current tracking ecosystem is out of control.
"Government websites are . . . a case that's especially concerning. They offer crucial information and services that people depend on and often can't choose not to use."
In response, Google said: "Our policies are clear: if website publishers choose to use Google web or advertising products, they must obtain consent for cookies associated with those products."
A Facebook spokesperson told the newspaper: "Facebook considers it the responsibility of the website owner to inform users of which companies may be tracking them."
Meanwhile, the owner of the Daily Mail has become the latest news publisher to call for a break-up of Google and Facebook.
The dominance of the two platforms over the online advertising market was "seriously anti-competitive" and risked putting publishers out of business, said DMG Media.
A collective of some of New Zealand's biggest companies is set to pull ads from Facebook and Google in the wake of the March 15 Christchurch mosques shootings in which the gunman live-streamed his massacre of 50 people.
On Sunday, New Zealand Prime Minister Jacinda Ardern said that she intended to ask Facebook how the gunman was able to livestream the massacre.
