Kevin Bankston of the Electronic Frontier Foundation recently said: “Google knows more about you than your mother.” A few years ago, it might have sounded far-fetched.
But if you’re one of the growing number of people who are using more and more products in Google’s ever-expanding stable (at last count, I was using a dozen), you might wonder if he isn’t on to something.
It’s easy to understand why privacy advocates and policymakers are sounding alarms about online privacy in general – and singling out Google in particular. If you use Google’s search engine, Google knows what you searched for as well as your activity on partner websites that use its ad services. If you use the Chrome browser, it may know every website you’ve typed into the address bar or ‘Omnibox’.
Google’s 17 biggest secrets
It may have all of your email (Gmail), your appointments (Google Calendar) and even your last known location (Google Latitude). It may know what you’re watching (YouTube) and whom you are calling. It may have transcripts of your telephone messages (Google Voice).
It may hold your photos in Picasa Web Albums, which includes face-recognition technology that can automatically identify you and your friends in new photos. And through Google Books, it may know what books you’ve read, what you annotated and how long you spent reading.
Technically, of course, Google doesn’t know anything about you. But it stores tremendous amounts of data about you and your activities on its servers, from the content you create to the searches you perform, the websites you visit and the ads you click.
Google, says Bankston, “is expecting consumers to trust it with the closest thing to a printout of their brain that has ever existed”.
How Google uses personal information is guided by three “bedrock principles”, says Peter Fleischer, the company’s global privacy counsel. “We don’t sell it. We don’t collect it without permission. We don’t use it to serve ads without permission.” But what constitutes “personal information” has not been universally agreed upon.
Google isn’t the only company to follow this business model. “Online tools really aren’t free. We pay for them with micropayments of personal information,” says Greg Conti, a professor at the US Military Academy at West Point and author of the book Googling Security: How Much Does Google Know About You? But Google may have the biggest collection of data about individuals, the content they create and what they do online.
It is the breathtaking scope of data under Google’s control, generated by an expanding list of products and services, that has put the company at the center of the online privacy debate. According to Pam Dixon, executive director at the World Privacy Forum, “No company has ever had this much consumer data” – an assertion that Google disputes.
Opacity versus transparency
Critics say Google has been too vague in explaining how it uses the data it collects, how it shares information among its services and with its advertisers, how it protects that data, and how long it retains that data before deleting or “anonymising” it so that it can’t be tracked back to individual users.
“Because of Google’s opacity as to how it is using that data, and a lack of fundamental information rights [that] users have, [privacy] becomes a very thorny question,” says Dixon.
Google may know more about you than your mother does. Got a problem with that?
Privacy policy opacity isn’t limited to Google. It’s so prevalent, in fact, that the Federal Trade Commission warned the industry in February that online businesses will face increased regulation unless they produce privacy statements that explain in a “clear, concise, consumer-friendly and prominent” way what data the companies collect, how they use it and how users can opt out.
Google, however, contends that the concerns about opacity and the scope of data it collects are overblown. “I do push back on this notion that what we have is a greater privacy risk to users,” says Mike Yang of Google’s legal department. Google, he says, gives users plenty of transparency and control. “There’s this notion that an account has a lot more information than is visible to you, but that tends not to be the case. In most of the products, the information we have about you is visible to you within the service.”
In fact, though, the data Google stores about you falls into two buckets: user-generated content, which you control and which is associated with your account; and server log data, which is associated with one or more browser cookie IDs stored on your computer. Server log data is not visible to you and is not considered to be personally identifiable information.
These logs contain details of how you interact with Google’s various services. They include web page requests (the date, the time and what was requested), query history, IP address, one or more cookie IDs that uniquely identify your browser, and other metadata. Google declined to provide more detail on its server log architecture, other than to say that the company does not maintain a single, unified set of server logs for all of its services.
Google says it won’t provide visibility into search query logs and other server log data because that data is always associated with a physical computer’s browser or IP address, not the individual or his Google account name. Google contends that opening that data up would create more privacy issues than it would solve. “If we made that transparent, you would be able to see your wife’s searches. It’s always difficult to strike that right balance,” Yang says.
You do have more control than ever before. Google says it removes user-generated content within 14 days for many products, but that period can be longer (it’s 60 days for Gmail). For retention policies that fall “outside of reasonable user expectations or industry practice”, Google says it posts notices either in its privacy policy or in the individual products themselves.
You can control the ads that are served up, either by adding or removing interest categories stored in Google’s Ads Preferences Manager or by opting out of Google’s Doubleclick cookie, which links the data Google has stored about you to your browser in order to deliver targeted advertising. For more information, see ‘6 ways to protect your privacy on Google’.
Shuman Ghosemajumder, business product manager for trust and safety at Google, says users have nothing to worry about. All of Google’s applications run on separate servers and are not federated in any way. “They exist in individual repositories, except for our raw logs,” he says. But some information is shared in certain circumstances, and Google’s privacy policies are designed to leave the company plenty of wiggle room to innovate.
Yang points to Google Health as an example. If you are exchanging messages with your doctor, you might want those messages to appear in Gmail or have an appointment automatically appear in Google Calendar, he says.
Cont http://www.pcadvisor.co.uk/blogs/index.cfm?entryid=115595&blogid=4&pn=3