Weekly Updates

Today we'll do something different. We'll focus on three pieces of news concerning Google and its regulatory mishaps. All three illustrate situations where the regulators' non-systemic approach to regulation can lead to uncertainty and harmful asymmetries.

Google Bard and the asymmetric nature of the EU data protection regulation

From Politico:

"Google forced to postpone Bard chatbot’s EU launch over privacy concerns

The Irish privacy watchdog said the tech giant has given insufficient information about how it will respect the EU’s data privacy rules. (…)

‘Google recently informed the Data Protection Commission of its intention to launch Bard in the EU this week,’ said Deputy Commissioner Graham Doyle.

The watchdog ‘had not had any detailed briefing nor sight of a data protection impact assessment or any supporting documentation at this point.’ (…)

‘Bard will not now launch this week,’ said Doyle”.

Meanwhile, ChatGPT keeps on the strategy of asking for forgiveness instead of permission. The Politico article continues:

“Several European privacy authorities in Italy, Germany and Spain have started investigating [ChatGPT]; the pan-European network of regulators, the European Data Protection Board, has set up a task force to evaluate it”.

That is, of course, despite the fact that OpenAI has been failing to implement basic cybersecurity defenses compatible with the scale they've reached. From Security Week:

“According to OpenAI’s investigation, the titles of active users’ chat history and the first message of a newly created conversation were exposed in the data breach. The bug also exposed payment-related information belonging to 1.2% of ChatGPT Plus subscribers, including first and last name, email address, payment address, payment card expiration date, and the last four digits of the customer’s card number”.

This inconsistency between Google's and OpenAI's treatment in EU operations is as clear as it is harmful to the market competition. And, sadly, it's not at all surprising.

As of right now, while ChatGPT and Microsoft have been freely and rapidly expanding through the European market, Google's Bard is being held back by regulators. That kind of asymmetric enforcement gives ChatGPT and Microsoft an unfair advantage in the race against Google.

Europe has become an unfair market at the hands of its own regulators.

In this case, it's not even an issue of a regulator going against a proverbial "Goliath” while letting a proverbial "David” experiment through try-and-error. As we mentioned in a past issue, long gone is the time when OpenAI was a non-profit research center. Today, OpenAI is a for-profit company with a connection of undisclosed extension to Microsoft.

The current state of uneven enforcement also creates perverse incentives for companies not to cooperate with regulators. The message regulators are sending is that moving fast and breaking things allows you to operate while establishing a communication channel with regulators does not.

The worst part, though, is that this asymmetric enforcement is not unheard of. On the contrary, it's the natural output of an overarching regulation that relies heavily on discipline and punishment, like GDPR does. The data protection regulation in Europe is so broad and restrictive that is simply impossible for national and European regulators to timely supervise and enforce all its provisions against all the Europe-facing internet. That means regulators will always have to choose where they put their efforts, leading to an asymmetric application of the law that is bound to benefit some parts of the market over others. In short, legislators are writing checks law enforcement cannot cash in a coherent way.

That's the typical scenario of a case-by-case executive enforcement instead of a systemic outcome-focused approach. That is typically associated with a perception that the law has an untapped power to conform reality. It often leads to the point where bending other's behavior to the regulator's will becomes more important than reaching a positive outcome for the people the law was supposed to protect.

Who won in Google’s Referer-Header lawsuit?

Google has agreed to pay USD 23M in a settlement related to a lawsuit that claimed Google shared search queries with third parties without user consent. In the US, a settlement is not necessarily an admission of wrongdoing, and Google has claimed it is not guilty of all of the charges.

What is interesting in this lawsuit is that the claims ignore how the internet works and who is effectively sharing information. The lawsuit goes over how Google Search monetizes its business, and how important search queries are for that. So far so good. However, the claim then establishes that Google shared the search queries with third parties by the Referer HTTP header.

The Referer header is a standard header in the HTTP protocol. Whenever a user clicks on a link on any webpage, the user's browser will automatically send the current page URI to the next site the user visits. This is quite important. Google Search has never shared that information. After a user clicks on the link, the browser (Safari, Edge, Firefox, Chrome, etc.) does the sharing. This is similar to how other automatic parts of the internet work. Whenever a user tries to reach a site, the user's computer shares the IP address with that site so that it knows where to send the response (web page).

Suing the website owner (Google Search or any other website) for something that the browser chosen by the plaintiff does automatically does not make any sense and should have been rejected ten years ago when it was first filed. The automatic part of the internet is responsible, in large part, for how easy it is to use it. No one needs to remember a server IP address to access a website. No one needs to understand how a browser works internally to use it.

After the lawsuit was filed, Google worked to improve the technology and enhance privacy by creating a standard way for website owners to control the Referer header and implemented it on Chrome. Such a standard simply didn't exist anywhere in the industry at the time the lawsuit was filed. Someone could argue that means the lawsuit brought forward a benefit to society, even if indirectly, right? Not really. Firstly, because that wasn't even the claim in the lawsuit — remember, it was directed against Google Search, as a website; not Chrome or any other browser. Secondly, given a choice, this control is only applied to 0.048% of the pages accessed by the Chrome browser. Not much changed after the lawsuit in 2013 and the settlement now ten years later.

The main winners of this lawsuit? The lawyers. They will pocket around USD 5.75M (page 6). From the Referer Header Settlement website:

"How will the lawyers be paid? Class Counsel will request up to 25% of the Settlement Fund for their attorneys’ fees and up to $150,000 to cover their out-of-pocket costs. They will also ask the Court to approve an Incentive Award for each of the Settlement Class Representatives not to exceed $5,000 each. The Court may award less than these amounts. If approved, these fees, costs and awards will be paid from the Settlement Fund."

Hints of a new wave of Section 230 challenge

In a previous issue, we raised a concern about a potential new stream of challenges:

“The Court in a way laid down a how-to guide to build a better claim against content platforms

The Court based its decision heavily on the failures of the plaintiff's claim as opposed as on the interpretation of the law. From the majority opinion: (…)

The complaint here alleges nothing about the amount of money that Google supposedly shared with ISIS, the number of accounts approved for revenue sharing, or the content of the videos that were approved. It thus could be the case that Google approved only one ISIS-related video and shared only $50 with someone affiliated with ISIS; the complaint simply does not say, nor does it give any other reason to view Google’s revenue sharing as substantial assistance. Without more, plaintiffs thus have not plausibly alleged that Google knowingly provided substantial assistance to the Reina attack, let alone (as their theory of liability requires) every single terrorist act committed by ISIS.

By doing this, the Court once again left the door open for future complaints to explore the gaps in this case's allegations”.

Fast forward a few weeks to this Wired article:

"Google Made Millions From Ads for Fake Abortion Clinics The search giant took $10 million in ads from, and gave grants to, ‘crisis pregnancy centers’ that work to prevent women from accessing abortions”.

To be sure, undermining women's reproductive rights is unjustifiable, absurd, and perverse. Whether or not this is somehow Google's fault or whether Google has a duty to avoid it is a completely different topic for discussion. Here we are focusing solely on Google's role as an advertising platform. Unless there was evidence that Google was actively favoring illegal or immoral service companies, placing the blame for the existence of such companies on the open platform can only undermine free speech for all.

Again, to be sure: there is no guaranteed way of removing only the kind of content we disagree with from the internet at scale. Either we have open platforms where anyone is free to say whatever and eventual abuses are dealt with after the fact on a case-by-case basis, or the internet will not be free for anyone. In this case, fake abortion clinics aren't even illegal in the United States. So pinning the responsibility to decide what is morally acceptable on the platform because the democratic (legislative) and legal (judiciary) instruments failed could have even greater unintended consequences.

This kind of monetary argument against content platforms, however, is likely to come into fashion. That's why we believe the decision in the Twitter case undermined Section 230, even without ever mentioning it, by creating diversion and uncertainty around the subject. The fight for internet freedom is an ongoing one.

Google and the regulators' triple miss