IMHO this clearly breaks their "Don't be evil" principle.

They have a right as anyone else not to be discriminated against or presented in a bad light.

I applaud the courage of Google to increase diversity by appealing to and allowing evil persons in it's midst.

Not enough companies are addressing this issue!

"And remember… don’t be evil, and if you see something that you think isn’t right – speak up!

Last updated April 5, 2018"

Apple‘s behaviour here is clearly the protectionism of an ecosystem monopolist that’s just as misguided, thinly disguised as privacy feature.

Some prior art was when Microsoft made the Do-Not-Track header opt-out instead of opt-in in order to get a consumer edge. The ad industry as a whole decided to ignore the flag just for IE, but there wasn‘t ever a legal case on that disregard of intended behavior IIRC.

I‘m not sure though who‘s more evil here and if this kind of circumvention was fair game or went too far.

So, some users had their browsing habits illegally harvested, stored, analyzed, and sold to an unknown number of parties for an unknown number of purposes, many of them adverserial in nature to the well-being of the individual. So what?

But even under a civil-court "preponderance of evidence" standard, wouldn't you have to prove some material harm to be eligible for damages (not just the potential of the data perhaps maybe being misused possibly)?

Second the problem statement I made above itself shows harm.

The fact that consumers have to worry about who got their private information, what was done with it, what harms happened that they aren't aware of, such as not getting a job, housing discrimination, loan discrimination, etc. is itself a harm.

That these things happen, in general, is eminently provable and that fact causes worry, anxiety, and changes in behavior which is itself a harm.

There might be some precedent in the space (cigarette ad campaigns were severely curtailed during the "Big Tobacco" crackdown in the US), but ads in general? Good luck.

I assume ads targeted towards children would be a good case study.

Given that the way it occurs is by allowing Google to more accurately profile the users, I'd say yes.

Probably not. But how about a fine? Something in the 5 - 10 Billion € range?

That may help to cool a few hot heads who think pulling off shit like that is a good idea.

to me, this seems like the wrong question.

in a broad sense, it makes more sense to ask how harsh the penalty should be. generally, for actions like this, the penalty is expressed as a monetary forfeiture.

whatever the penalty is, the relinquished funds have to go somewhere, and those who can demonstrate being harmed seems like a sensible destination.

It merits Google being punished. And really, the only way to punish a large company is by fining them.