Google has for years been tracking what people buy, through receipts sent to their Gmail accounts, CNBC reports. There seems to be no way to for Gmail users to turn off Google’s purchase tracking and no easy way to delete the information it has already collected (see below). Google been making this information available to users – no one knows since when – through a private web tool that can be accessed here. The page, titled Purchases, was mentioned in a Reddit thread 10 months ago and surfaced again after CNBC published its report. MediaNama accessed the tool and found a history of our purchases dating back to August 2013. While some newer entries were in reverse chronological order, others were listed haphazardly. Google’s help page on the subject reads: “Your purchases and reservations are brought together from across your Google Account,” from sources including the Play Store, Google Express and Google Assistant, and order receipts or confirmations received in Gmail.

A Google spokesperson told MediaNama in a statement: “To help you easily view and keep track of your purchases, bookings and subscriptions in one place, we’ve created a private destination that can only be seen by you. You can delete this information at any time. We don’t use any information from your Gmail messages to serve you ads, and that includes the email receipts and confirmations shown on the Purchases page.”

No easy way to delete purchases, no way to halt tracking

Google says that users can delete this information at any time, but this isn’t easy to do. MediaNama found that entries on the purchases page can only be deleted individually, and in most if not all cases, doing so requires the user to delete the original email, which everyone might not want to do. Also, there seems to be no way of turning off purchase tracking entirely, only an option to prevent Google from using the data to give you private search results. You can do so by going to google.com, signing in, clicking on ‘Settings’ in the bottom right corner and then ‘Search Settings’. Here, you will find a setting under ‘Private results’ that lets you tell Google not to use your private data in customised search results. But this won’t delete the purchase information Google has already stored, or even stop it from tracking future purchases.

Google’s new privacy controls and 50 million euro fine

Earlier this month, Google announced new privacy controls at its I/O conference, including better access to privacy and security settings, an incognito mode for Maps, privacy tools on Android Q, and federated learning, a kind of machine learning developed by Google that allows its products to work better without collecting raw data from devices. The announcement came months after France’s data regulator CNIL found Google in breach of the EU’s data protection rules (the General Data Protection Regulation or GDPR) and fined it 50 million euros in January. The penalty was the result of an investigation into two complaints filed in May 2018 by two privacy advocacy groups, which claimed that Google did not have any legal basis for processing user data to serve personalised ads, as mandated by the GDPR.