Module 8 · Search engines, Google Spain & social media targeting
Search engines determine purposes/means, so they are controllers. Google Spain (2014, CJEU) established the right to be forgotten and held search engines to be controllers of personal data in third-party pages (and subject to the GDPR if they have an EU establishment economically linked to the search activity). Social-media platforms can involve multiple controllers; EDPB Guidelines 8/2020 address targeting via provided, observed or inferred data.
Search engines determine purposes and means, so they are controllers. Google Spain / Google v AEPD (2014, CJEU) established the right to be forgotten: search engines are controllers of personal data appearing in third-party pages, and are subject to the GDPR where they have an EU establishment economically linked to the search activity. Search marketers using analytics (e.g. Google Analytics) can also be controllers and should anonymise IPs. See EDPB Guidelines 5/2019 on RTBF in search-engine cases.
Social-media platforms (SMPs) can involve multiple controllers (the SMP and app authors). They must be transparent: notice of marketing use plus opt-out; notice of sharing with third parties; explanation of profiling; processing of sensitive data; and privacy-risk warnings. Explicit consent is usually needed to publish someone's personal data online unless they published it themselves.
| Type | Meaning |
|---|---|
| Provided | Data the user actively gives (e.g. profile fields). |
| Observed | Data captured from the user's activity (e.g. pages liked). |
| Inferred | Data derived/predicted; typically needs a case-by-case assessment, consent and Article 5 compliance. |