> Why do you think Google would sell pii? It doesn't make business sense.

In these discussions, "selling PII" is sometimes a short for "providing a service that allows targeting ads based on PII without actually releasing PII itself to the service users", which is only a little less bad.

Given the context, it's clear that's not what GP means.

Also, from a privacy perspective, there is a vast difference between the two. One person who you trust to keep your data safe (but not to use it in ways you find ethical necessarily) is vastly different from them giving it to other parties who you don't know.

I don't think the difference is that vast in practice.

What's currently stopping evil actors from exfiltrating data from Google's PII through buying narrowly targeted ads, each time with slightly different targeting, and intersecting these results to build a more detailed picture of people who viewed the ads?

I'm combining my response to two comments.

> It's great that they do that, but it's still the bare minimum over here on the Old Continent. We can and should demand more.

Sure, but its been possible to do this since well before the GDPR mandated it. Now maybe you can argue that the threat of regulation is what keeps Google in check here, and ok fine that's an unfalsifiable claim but maybe it's true. But even still, that doesn't actually justify "we should demand more". Maybe more privacy regulation is justified, but "we already have some" isn't actually justification.

> What's currently stopping evil actors from exfiltrating data from Google's PII through buying narrowly targeted ads, each time with slightly different targeting

The snarky answer first. PII has a specific meaning. It means personally identifying information. Your ZIP code isn't PII. Your name is. No matter what ad targeting tricks you do you can't pull my name or address out of what Google sends you. So you don't get PII.

Now the less snarky answer. The actual attack you're describing does this repeated targeting thing, which ties private data to some pseudonymous ID, like a browser fingerprint. At this point they don't have any PII. Then, you get the victim to enter their personal information on your site. Now you can tie the PII to the other information from the shadow profile you've built.

So why isn't this useful? Mostly, cost. To get this to work, you need to have some one or some group click on multiple different ads you control ($ + time cost) and then enter their identifying information on a site you control. Click through isn't assured, and conversion to entering information is very unlikely. When you're, you know, actually selling a product, this is a worthwhile investment.

But this attack is essentially paying to advertise to people with the goal of learning who you are advertising to. As a result, this only really makes sense in the context of targeted attacks or generic blackmail. Targeted attacks don't work because now you need a specific person to enter their PII in your site (and then what?, you've learned that someone is interested in LGBT topics. I'm interested in LGBT topics and straight). And similarly broad blackmail doesn't work.

But I'm interested in how you think an attacker could do something in a cost effective manner.

Are you talking about some kind of an "NDA" on employees? I work for Google. I am being frank when I say you are full of it, and you will not find this message in any script.

Shit, I fed a troll.

That is exactly what I meant. You use PII to create whatever product(s) you sell to 3rds. I read the EULA over a decade ago. Good on Goog for stating it plainly. My answer is still, NO. Even when I go to .govs & other sites using Goog apis(UBO). More people would concur if they had an idea of how much all the minutia the SV giants(& the other alphabets)hoover up about our lives. And how it's used against us in daily commerce.

As for your red herring, I can only guess how mal-scans can be monetized. If anyone can do it, I have no doubt Goog will.

Edit: O-T content removed.

> As for your red herring, I can only guess how mal-scans can be monetized. If anyone can do it, I have no doubt Goog will.

Well yes, they're very clearly monetized: Google supplies a email service which it sells to businesses as part of GSuite. One of the selling points of this email service is spam protection. Is that a bad thing?

> You use PII to create whatever product(s) you sell to 3rds.

Ok, so if your concern is that a company has your PII, that's a concern I guess. But it makes it difficult to use the internet (or, like, shop at stores), since there are all kinds of companies that gobble up your PII but don't tell you or give you control over it (whereas Google does, for example, let you delete the data it has on you and control collection of much of the data it collects).

If you're going to argue that Google is bad for the same reason that your credit card company and Amazon and CVS are bad, then sure they all have your PII, but I'd still argue that Google behaves more ethically than the others when dealing with it.

The problem isn't just with companies having data, but with how they're using that data.

> whereas Google does, for example, let you delete the data it has on you and control collection of much of the data it collects

That's table stakes under GDPR. It's great that they do that, but it's still the bare minimum over here on the Old Continent. We can and should demand more.