Web browser Brave hands evidence to Irish data regulator showing Google uses hidden webpages to pass personal data of users to advertisers, undercutting GDPR
Google is secretly using hidden web pages that feed the personal data of its users to advertisers, undermining its own policies …
Context & Ripple Effects
This filing is the escalation of a campaign Brave started a year earlier, when it filed GDPR complaints in the UK and Ireland against Google and others seeking an official probe into behavioral advertising that exposes user data. What changed now is the form of the argument: rather than a policy-level complaint, Brave's chief policy officer has handed the Irish regulator direct technical evidence that Google operates hidden webpages feeding users' personal data to advertisers.
The timing matters because early post-GDPR data showed Google and Facebook drawing ad money by collecting consent at far higher rates than rivals, per related coverage, meaning the consent-based model was already concentrating spend with the biggest platforms. A finding that those flows may bypass proper consent strikes at the core of that advantage.
First-order effects
- Ireland's data protection authority — already Google's lead GDPR regulator — receives actionable technical evidence on top of Brave's earlier complaint, moving the question from whether to investigate how Google's ad data flows work.
- Google now faces allegations that its own hidden webpages undercut both its published policies and GDPR consent requirements, a reputational and legal exposure distinct from routine ad-practice disputes.
Second-order effects
- Advertisers receiving personal data through these channels inherit compliance risk of their own, since accepting such data implicates them in any breach the regulator confirms.
- The broader real-time bidding ecosystem becomes the enforcement surface: Brave has separately documented real-time bidding running across 198 UK council websites, signaling that scrutiny of one mechanism generalizes to the ad-tech stack around it.
Third-order effects
- If regulators validate browser-supplied evidence, browsers consolidate power as de facto privacy enforcers — able to shape which data flows survive regardless of what ad intermediaries negotiate among themselves.
- A confirmed violation would push European ad-tech toward structural redesign of consent and data-sharing mechanics, since patching individual campaigns would not cure a systemic consent gap.
The trend: Browser makers are positioning themselves as private enforcers of privacy regulation, supplying regulators with evidence against ad-tech giants whose data flows they can technically observe.