June 10, 2007

Google, Hostile to Privacy?

Privacy International, a London-based organization focused on privacy intrusions by government and businesses, released a report (detailed in this PDF) that analyzed the privacy practices of 22 Internet companies. Google received the lowest mark, followed by Yahoo, Windows Live Spaces, Hi5, Apple and AOL. Here are some of the reasons why Google was declared "hostile to privacy":

* IP addresses are not considered personal information. They do not believe that they collect sensitive information.

* Vague, incomplete and possibly deceptive privacy policy. Document fails to explain detailed data processing elements or information flows.

* Generally poor track record of responding to customer complaints. Ambivalent attitude to privacy challenges (for example, complaints to EU privacy regulators over Gmail). Privacy mandate is not embedded throughout the company. Techniques and technologies frequently rolled out without adequate public consultation (e.g. Street level view).

* Will utilise Doubleclick's "Dynamic Advertising Reporting & Targeting" (DART) advanced profiling system.

* Google account holders that regularly use even a few of Google's services must accept that the company retains a large quantity of information about that user, often for an unstated or indefinite length of time, without clear limitation on subsequent use or disclosure, and without an opportunity to delete or withdraw personal data even if the user wishes to terminate the service.

* Google maintains records of all search strings and the associated IP-addresses and time stamps for at least 18 to 24 months and does not provide users with an expungement option. While it is true that many US based companies have not yet established a time frame for retention, there is a prevailing view amongst privacy experts that 18 to 24 months is unacceptable, and possibly unlawful in many parts of the world.

* Google has access to additional personal information, including hobbies, employment, address, and phone number, contained within user profiles in Orkut. Google often maintains these records even after a user has deleted his profile or removed information from Orkut.

* Google collects all search results entered through Google Toolbar and identifies all Google Toolbar users with a unique cookie that allows Google to track the user's web movement. Google does not indicate how long the information collected through Google Toolbar is retained, nor does it offer users a data expungement option in connection with the service.

* Google logs search queries in a manner that makes them personally identifiable but fails to provide users with the ability to edit or otherwise expunge records of their previous searches.

* Google fails to give users access to log information generated through their interaction with Google Maps, Google Video, Google Talk, Google Reader, Blogger and other services.

The report concludes that "the current frenzy to capture ad space revenue through the exploitation of new technologies and tools will result in one of the greatest privacy challenges in recent decades."

Google's reaction to this report? "We are disappointed with Privacy International's report, which is based on numerous inaccuracies and misunderstandings about our services. It's a shame that Privacy International decided to publish its report before we had an opportunity to discuss our privacy practices with them."

I think Google's main problem is that they make the privacy issues very visible and attract a lot of attention. For example, Google Toolbar has a very scary dialog that asks you read some information before deciding if you want to enable the PageRank feature, but fails to explain too much.


Privacy continues to be the Achilles' heel of Google, even though they didn't release millions of search queries that contained personal information (like AOL) or sent people to jail (like Yahoo).

14 comments:

  1. Here's another one they can add to the list:

    - Google automatically save your draft emails on their servers. If you decided to not send your email before hitting the send button, maybe because you choose not to disclose your email, Google already stole your thoughts and automatically saved it on their servers regardless if you did not intent to send it. Google does not provide users the option turn off the auto-save feature.

    ReplyDelete
  2. Google offers by far the widest set of online services. It's what they do best. I WANT them to get all the data they need to make this experience better. IPs are addresses for our computers, they're ment to be taken. We all have real addresses and can't stop anyone from getting them (or coming to our door) while we CAN uninstall programs. If i were afraid that someone gets my IP every time i went on the Internet, i'd first make sure i'm not even listed in the phonebook!

    I don't want to sound mean, or as a Google fanatic (i am a fan, i admit), but frankly i'm tired of some organizations shouting that Google is bad. They simply can't shout louder than the ones saying they like Google. In the online world, especially when user interaction is concerned, features imply sharing information.

    ReplyDelete
  3. Wrong. Google does not by far offer the widest set of online services, Yahoo does. Yahoo has alot more online services than google that collects alot more information than google.

    Google's visibility of privacy issues is exactly why they should not get the lowest score. Yahoo and MSN do not go out of the way to higlight privacy issues like Google. This means that Google is more conscious of people choices when it comes to privacy.

    ReplyDelete
  4. I still think Google offers more services, anyway relative to the fact that it isn't a portal oriented company like Yahoo or the MSN part of MS.

    But i do agree that Google emphasizes privacy (sometimes too much for my own taste, but this is the world we live in..). Btw i have nothing against Yahoo(though, while i agree with IP recording etc., i don't agree with information disclosure), MSN or AOL (accidents happen).

    ReplyDelete
  5. As usual organizations are blowing things way out of proportion and not getting their facts right nor doing a fair analysis and comparison.

    "Anonymous" ... you are an idiot. That auto-save feature is such a boon to the end user that even Yahoo (maybe others) has copied it for their email service.

    "or" ... No, you are wrong! Google DOES offer the widest set of online services. Just going through this list -- http://www.google.com/intl/en/options/index.html -- will prove that point. Yahoo offers services but not to the extent that Google does. They do license more 3rd party content though. Haha, you are right about the visibility thing though.

    ReplyDelete
  6. Google generally gives you the option of how much data they collect and keep in areas where your are personally identifiable. I don't turn on Page Rank, for example, for that reason. I don't get into 'social networking' sites for that reason (that is a strange use of the word 'social', by the way).The real problem is that 95% of all users are technically ignorant and make the wrong choices (how many go to phishings sites, open email attachments with malware, etc.). Complaints about Streetview boggle my mind. The cameras are in PUBLIC places, photographong PUBLIC events. How can anyone logically complain about violations of privacy? Overall, I think google is pretty responsible. I also think it is ironic, as Google pointed out, that the report criticized Google for not consulting users onthe use of informatio, but the report was issued without consulting Google on their their side of the the issue.

    ReplyDelete
  7. One of the biggest complaints regarding privacy is that Google retains the information from their server logs indefinitely and that information could be used to uniquely identify users. Google promised to address this issue and anonymize the server logs after 2 years or less:

    "When you search on Google, we collect information about your search, such as the query itself, IP addresses and cookie details. Previously, we kept this data for as long as it was useful. Today we're pleased to report a change in our privacy policy: Unless we're legally required to retain log data for longer, we will anonymize our server logs after a limited period of time. When we implement this policy change in the coming months, we will continue to keep server log data (so that we can improve Google's services and protect them from security and other abuses)—but will make this data much more anonymous, so that it can no longer be identified with individual users, after 18-24 months."

    ReplyDelete
  8. - as Teo said, IPs are here to be stored; they were invented to identify a users pc + they change from time to time.

    - google was the only search company to fight the DOJ request, the other's didn't

    - google let's you opt-in to webhistory (not opt out)

    - with feedburner you can opt-out before the acquisition takes place

    - they show you very clearly in the toolbar at on desktop what advanced features are (not the usual tadada).
    If they were evil, they would make it seem like a usual tadada, but they tell the people what the risks are, because they have nothing to hide. They make you avare of privacy.

    - same with gmail, they make it very clear that your emails are being scanned for ads. And I like this, no I even love this, because I prefer those scanned emails (who are scanned for spam anyways and only by machines), becuase they give me some serious ads and not the hotmail live blinking banner crap. And if you don't want it, don't use it.

    - they were the only major search company to ristrict the keeping of the logs for 18 months or so. It may seem long, but at least they doing something instead of keeping them forever. People worried about this, but before it was worse. So basically:
    Google: "hey, we only store it for 18 months now"
    privacy freaks: "OMG 18 MONTHS OMG"
    Why don't they first look at the companies who store that forever before going nuts?

    I think the reason google was the worst in this study is, that if this privacy whatever company publishes it like that, they get a lot of publicity and attention. Nobody would have bothered much if MSN live was at the bottom, but now with google it's big news.

    Anyways, Alex, I hope you read this and the comments above me. I am sure you as a Google expert know this all very well and I would be happy if people knew.

    I am just so thankful to have gmail and other great free products and not have to rely on some other stuff anymore!

    ReplyDelete
  9. At least Google is the only company pushing the envelope... trying to expand how web services can help a user, and thus, on the border between what is ethical and what isn't. The only way to expand the web is to take some risks. And without Google, we'd all still be using our 2 MB Yahoo Mail accounts and using Mapquest to get from Point A to Point B. The review doesn't take into account anything that Google has accomplished, meanwhile keeping user data more private than its competitors.

    ReplyDelete
  10. At least google has kept up there promise in saying quote:WE WONT PULL AN AOL:
    That meaning they wont show what each individual is looking at,along with his personal info and ip address. I beleive google takes matters seriously, espesially privacy.

    ReplyDelete
  11. My only reaction is... "WTF? How did Google rank *below* Yahoo, AOL, and Microsoft in privacy?!?"

    I'm sorry, but I have trouble taking their report seriously if they rank Google below *AOL* in privacy terms...

    ReplyDelete
  12. Use Google while disallowing them to abuse you. Kill search tracing, IP tracking & install encrypted GMail @ www.custmizegoogle.com for Firefox. Always go "off the record" & install encrypted GTalk @ Cypherix or a number of free encryption options.

    ReplyDelete
  13. I used to like services from Microsoft a lot that I was a fan of that company. When I went through the features that Google has to offer, I'm bowled over.
    Google is in no way hostile to privacy.
    Oh, by the way, IBM uses Google services and some of their new software products come with Google desktop embedded in it.
    Of course, a bit of tweak could be made in Orkut but majority of the services in Google aren't dangerous to the privacy.
    Every website uses Cookies and so does Google. These cookies are created by the server and also eaten by the same server. Neither the user nor the browser reads them.
    If you do a spyware scan using computer associates online scanner with the option of scanning for tracking cookies, you will find that a cookie named "@m.webtrends.com" is available. This cookie is created by Microsoft. So doesn't the Redmond Corp. violate privacy by collecting an individual's details?
    Also, if you take Windows XP or Vista, the Error reporting feature(turned on by default), sends information to the server but we don't complain, do we?
    It's not correct to single out Google.

    ReplyDelete
  14. There are also other kinds or privacy issues where Google are lacking in integrity.
    A person who I've had countless other problems with over the last few years has taken it upon themselves to write an offensive blog comment ans sign it as myself. Google are not interested in protecting people from impersonation or slander. I've written several times requesting that they remove the offending comment and have even provided police crime report numbers. Google have not even responded to me. It sounds rather petty, until it actually happens to you and you realize that anyone can do this and your reputation is on the line. There needs to be some accountability regarding this powerful multi-million dollar organization that somehow cannot take the time protect innocent people.

    ReplyDelete

Note: Only a member of this blog may post a comment.