Somewhat quietly – perhaps because we are in the middle of summer and for many it's holiday time, or perhaps because the subject is delicate and not easy to understand – there were two important events in the first ten days of July: two changes to the "rules of the web" which, in our view, deserve more attention. With this explanatory article we will try to do our bit.
The dates in question are 1 and 10 July. But let's take things in order.
1 July 2023
Let's start with 1 July, the day on which Google suddenly changed its privacy policy, bringing it into force from 10 July.
This is a really important development, because with this new policy Google makes a crucial statement that could significantly shape the web in the years to come. It states that the publicly available information it comes into contact with through all its services may be used to develop new products and technologies, in particular to train its artificial intelligence systems.
In essence, it will use – in fact already uses (as we write this article, 10 July has passed) – "data scraping", a process that automatically collects information from web pages and turns it into a structured format, in order to carry out machine learning for Google Bard (just released in Italy too; we talked about it in this social post), Cloud AI and Google Translate.
So what's the problem? Although on the one hand all this will certainly improve customer satisfaction for its users, who will find what they are looking for or need sooner and better, on the other hand it will make monetisation harder and more problematic for creators – the people who create the information Google's AI draws on, often investing a great deal of time and effort every day.
Although the new policy refers to publicly available information, it does not say how Google intends to prevent copyrighted material from ending up in its machine learning system. At the moment, in fact, there seems to be no way of telling "Google's spiders" – the software that crawls the web looking for pages to index – which pages the rights holder does NOT want Google to use to train its AI (unlike pages you don't want listed in the SERPs, for which you use the robots.txt file in the web root).
Given this problem, which could put content producers in a very awkward position (think of a blog like ours which, hypothetically, could provide a negative answer to the Bard question "Does Google's new policy of 1 July 2023 protect creators?" without receiving any citation, and therefore any payment), it will be interesting to see how this approach develops in future alongside the various global regulations such as the GDPR, the law that protects EU citizens from the misuse of their data without explicit consent.
And perhaps it is a coincidence (or perhaps not?) that 10 July, the second date we want to focus on in this article, is another key day this month.
10 July 2023
Because it was on 10 July that the European Commission finally adopted an important decision on the adequacy of the EU-US Data Privacy Framework. Essentially, this day marks the long-awaited agreement under which US companies will be able to receive European citizens' personal data securely through the implementation of binding safeguards.
A Data Protection Review Court has also been set up to protect them in the event of disputes, along with periodic reviews in cooperation with the competent authorities.
As explained on the website of iubenda – one of ESSE I's suppliers and one of the leading providers of solutions to make websites and apps legally compliant (in several languages and jurisdictions, no less) – over the last three years the use of Google Analytics and other services involving the transfer of personal data to the United States had been prohibited, creating regulatory uncertainty and compliance problems for users, because there was no specific legal framework to govern such transfers.
The recent decision has finally clarified how data can be transferred. In practice, from 10 July US-based service providers, Google included, can resume the flow of personal data but – take note! – they must first obtain certification under the EU-US DPF.
So there now seems to be a legal basis for transferring data from Europe to the US, and clear procedures for service providers that ensure compliance with EU privacy rules.
One question is very popular among industry professionals right now: "can we go back to using Google Analytics without risk?"
iubenda's answer: if the service providers concerned complete the self-certification process beforehand, website administrators will be able to resume using these tools.
For Google Analytics this process appears to be under way, so we just have to wait for further developments.
The doubt remains
How is it possible that Google has declared it will use data provided by creators for its AI without any possibility of preventing it?
To us it seems a violation of the most basic ethical rules on privacy. What do you think?
Let us know by writing to us or, if you prefer, by interacting with us on the social post for this article.
