Liam Tung:

Privacy rights group the Electronic Privacy Information Center (EPIC) will file a legal complaint with the Federal Trade Commission over a system Google is using to link web activity with in-store card purchases.
 
 The complaint concerns Google’s new Store Sales Measurement program, which aims to demonstrate to advertisers that clicks online do lead to purchases at the register.
 
 According to The Washington Post, EPIC wants Google to be more transparent about what data on credit and debit card purchases it’s accessing, how it’s getting the information, and what encryption it’s using to ensure user data remains anonymous.
 
 Announcing the system in May, Google said third-party partnerships allow it to capture 70 percent of all payment card transactions in the US. The system matches transactions back to Google ads, which Google said was done in a “secure and privacy-safe way”. It also reports aggregated and anonymized store sales data to advertisers.

Elizabeth Dwoskin, Craig Timberg::

The Washington Post detailed Google’s program, Store Sales Measurement, in May. Executives have hailed it as a “revolutionary” breakthrough in advertisers’ abilities to track consumer behavior. The company said that, for the first time, it would be able to prove, with a high degree of confidence, that clicks on online ads led to purchases at the cash register of physical stores.

To do this, Google said it had obtained access to the credit and debit card records of 70 percent of U.S. consumers. It had then developed a mathematical formula that would anonymize and encrypt the transaction data, and then automatically match the transactions to the millions of U.S. users of Google and Google-owned services such as Gmail, search, YouTube and maps. This approach prevents Google from accessing the credit or debit card data for individuals.

But the company did not disclose the mathematical formula it uses to protect consumers’ data. In a statement, Google said it had taken pains to build custom encryption technology that ensures the data the company receives remains private and anonymous.