At Wired, investigative reporters Dell Cameron and Dhruv Mehrotra tell us that Google technology can be used to harvest sensitive information about users and market it to big world brands despite Google’s rules against the practice:

Display & Video 360 (DV360), one of the dominant marketing platforms offered by the search giant, is offering companies globally the option of targeting devices in the United States based on lists of internet users believed to suffer from chronic illnesses and financial distress, among other categories of personal data that are ostensibly banned under Google’s public policies…

Segments accessible through DV360 that target Americans with asthma contain at least hundreds of millions of mobile IDs—among them, a list simply titled, “People who have asthma.” Hundreds of millions more were found on lists for no other reason than the fact that their users are believed to have diabetes. A vast number of devices and user profiles are spread out across lists that target users determined likely to need specific medications, including some controlled substances, such as Ambien. One list links more than 140 million mobile IDs to opioid usage, suggesting the users need relief from a common “opioid-induced” side effect.

Google did not respond when asked whether a data broker had violated its rules by offering advertisers access to a list of people “likely to have an Endocrine disorder.” (The company only stated that its policies “do not permit” such segments “to be used.”) Asked to explain whether it assigns any level of risk to audience segments that target US government employees working in national security jobs, or contractors with access to restricted US defense-related technologies, Google’s spokespeople did not respond.

“Google Ad-Tech Users Can Target National Security ‘Decision Makers’ and People With Chronic Diseases,” February 20, 2025

The platform also attempts to target people who work at sensitive government jobs, which raises a range of national security issues.

Cameron and Mehrotra warn “While the purpose of mobile IDs and other ad-based identifiers is, ostensibly, to help shield users’ identities, it is no secret that when combined with other datasets, it can become trivial to re-identify people whose information has been ‘anonymized.’” Foreign governments could do it as well as private corporations.

Google is keeping pretty mum about all this, according to Wired. The more a data set can pinpoint specific users, the more profitable it will be to acquire and sell. Consider: If a firm were marketing medications online, wouldn’t it want a list of individuals known to suffer from relevant illnesses?

Stay tuned for this to become a much bigger issue and for Google to get mummer about it.