Google LLC is allegedly using secret webpages that feed personal data to advertisers, according to evidence submitted to Ireland’s Data Protection Commission Wednesday by Brave, an upstart browsing company.

The claim was made in the filing by Johnny Ryan, Brave’s chief policy officer. Brave is a Chromium-based browser founded by former Mozilla Foundation Chief Executive Officer Brendan Eich that ostensibly puts user privacy first and blocks site advertising by default. But in a twist, it overlays advertising on websites with its own ads instead, for its own profit.

According to The Financial Times, Ryan claims that “he discovered that Google used a tracker containing web browsing information, location and other data and sent it to ad companies via webpages that showed no content.” The use of such pages was claimed to allow companies buying ads to match a user’s Google profile and web activity to profiles from other companies. The practice is said to be against Google’s own ad buying rules.

“The evidence we have submitted to the Irish Data Protection Commission proves that Google leaked my protected data to an unknown number of companies,” Ryan said in a statement. “One cannot know what these companies then did with it, because Google loses control over my data once it was sent. Its policies are no protection.”

Ryan went on to allege that Google is using the method as a “workaround” of the European Union’s General Data Protection Regulation.

Google has denied the report, saying that it doesn’t serve “personalized ads or send bid requests to bidders without user consent.”

Ryan’s claim is backed up by Zack Edwards of consulting firm Victory Medium, who is said to have recruited hundreds of people to test Google’s behaviors over a month. In all cases, the identifier — the tracker — was found to be shared by multiple advertising firms to enhance their targeting abilities.

The report comes a day after Google agreed to pay $170 million to settle a suit filed by the U.S. Federal Trade Commission claiming that it breached children’s privacy on YouTube. The FTC alleged that Google violated the Children’s Online Privacy Protection Act by gathering the personal information of young users on YouTube without first securing parental consent.

Photo: Marco Verch/Flickr