Facebook (FB) may be getting all the backlash thanks to its data scandal but it turns out Internet users should be more concerned about the data Alphabet’s (GOOG) Google is amassing on them.

That’s according to the Wall Street Journal, which pointed out that in terms of collecting consumers' private data Google is much more of threat based on the volume of data it gathers, its ability to track Internet users and the time spent on Google Internet properties.

Citing security experts, the Wall Street Journal reported that Google likely has so-called shadow profiles of users of at least the same level of specificity as Facebook. Chandler Givens, chief executive officer of the identity theft software company TrackOff, told the paper that unlike Facebook, Google lets users opt out of ad targeting even if they don’t have an account with the company.  Google Analytics, however, is the leading Internet analytics platform and is used by roughly half of the largest companies in America. That means it tracks data on 30 million to 50 million sites and follows users even if they are not logged in, reported the Wall Street Journal. There are the more than billion people who have Google accounts and therefore are tracked more expansively. The paper noted that in 2016 Google changed its terms of service, paving the way for it to merge its tracking and advertising data with identifiable information from Google accounts. While Goole uses browsing and search history, the company told the paper it doesn’t use any data from categories that are sensitive such as race, religion, health or sexual orientation.

But Google’s data collecting reach doesn’t end there. The Wall Street Journal noted that Google powers even more data collection via ad marketplaces. Google works with some of the data brokers directly, which the paper said amounted to 4,000 in the U.S. alone, but says it clears them to stop any ad targeting based on sensitive data. The data brokers collect everything they can about consumers to create profiles for advertisers.  

On the mobile front, Google is also harvesting data via its two billion active Android devices. Woodrow Hartzog, a professor of law and computer science at Northeastern University, told the paper that if the Android operating system helps companies gather data on users then Google is partly to blame for any improper use of that data. The paper pointed to Facebook’s ability to harvest Android users’ calling and texting history as an example. It’s something Facebook wasn’t ever able to access from iPhones, noted the report. (See more: More Time Spent on Google Sites Than Facebook: Study.)

As for Google’s stance in protecting and harvesting data, it appears to be falling on the side of less regulation. It currently is in opposition to the California Consumer Privacy Act which will be on the ballot in November and would give consumers the right to tell a business not to share or sell their data, the right to know where and what data is being sold or shared and the right to know how the data providers are protecting a customer’s information. Google finds the law to be vague and said it was unworkable, noted the Wall Street Journal. Facebook, reeling from the scandal in which Cambridge Analytica accessed the data of 87 million users without their consent, is no longer opposed to the California legislation.