The company says it discovered the glitch in March, or right around the time that Facebook was dealing with an onslaught of negative coverage following the Cambridge Analytica scandal, but only opted to reveal the information today. On its blog, the company says data on some 500,000 users is at risk, adding that details such as age, gender, occupation and email addresses were affected as early as 2015.
The Wall Street Journal, which first reported the news, says the company initially chose not to disclose the bug as it feared increased regulatory scrutiny and consumer backlash.
Last week, Facebook disclosed that 50 million accounts were breached. Consumers, meanwhile, have become more aware of how -- and how often -- their data is being sold. The Google+ news may fan the flames further for increased regulation on consumer data and digital governance, s
Google's partners may have had access to the data, but Google itself is unsure if it was misused by any third parties. The company says it intends to go through a sophisticated audit to identify any reckless vendors.
"Our privacy and data protection office reviewed this issue, looking at the type of data involved, whether we could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response," a Google spokesperson said in a statement. "None of these thresholds were met in this instance."
What it means for marketers
For the advertisers, increased regulation will likely make life working with Google harder, says Jason Kint, CEO of Digital Content Next.
"Google and any of the other platforms will be raising the walls to make it more difficult for third parties to interact with them," says Kint. "Third parties and advertisers will be concerned if they have less access to data."
Third parties that report in areas such as measurement and viewability may find themselves with less access to data, and marketers may see more instances of large tech companies providing metrics for whether their ads were seen, or grade their own homework.
Some outfits that specialize in collecting consumer data may abandon or sell off those practices altogether. Acxiom Marketing Solutions, for example, sold itself to IPG shortly after GDPR went into effect.
It will also likely mean that brands and publishers will have to spend lots of money to become compliant, should new regulation pass; companies that prepared for GDPR said they allocated at least $1 million to become compliant.
Google's credibility to take hit
About two weeks ago, Google CEO Sundar Pichai answered questions during a Senate committee hearing, and argued for federal regulation around consumer data. To hear Kint explain it, though, Google's interests are in making sure that any federal regulation passed will be weaker than California's Consumer Privacy Act, which passed in June.
"Google has argued that they are the most secure company on the planet, and that they deserve everyone's trust despite having more access to everyone's data than anyone else," Kint says. "But they withheld information because it created a business risk, so it's going to be a big reality check for them."
California's bill empowers consumers to control of their data, as it allows them to tell companies such as Facebook, Amazon or Google to delete their data or not share it, for example. It also holds companies accountable for any data breaches, allowing the California attorney general to sue for $7,500 for each intentional violation of privacy.
Outfits such as Google, Facebook, Amazon, Microsoft, as well as trade bodies such as the Data Marketing Association and Interactive Advertising Bureau also threw large swaths of money to thwart the bill from being signed into law through the "Committee to Protect California Jobs."
Google's "interests are in making sure there is a federal regulation that preempts California," Kint says. "Whether or not that federal law will be less stringent than California's is yet to be seen, but this recent news will make it more difficult for Google."
When asked whether this was true, Google did not immediately respond to comment.