Privacy concerns with Google

Privacy concerns with Google — BrandWiki

Potential for data disclosure

Data leaks

On March 10, 2009, Google reported that a bug in Google Docs had allowed unintended access to some private documents. It was believed by PCWorld that 0.05% of all documents stored via the service were affected by the bug.[13] Google stated the bug has now been fixed.[14]

Cookies

Google places one or more cookies on each user's computer, which is used to track a person's web browsing on a large number of unrelated websites and track their search history. If a user is logged into a Google service, Google also uses the cookies to record which Google Account is accessing each website and doing each search. Originally the cookie did not expire until 2038, although it could be manually deleted by the user or refused by setting a browser preference.[15] As of 2007, Google's cookie expired in two years, but renewed itself whenever a Google service is used.[15] This also affected the opt-out at Google's Ads Preferences Manager, which meant that users who thought they had opted out were automatically opted back in after visiting a Google service or website, including YouTube.[16] As of 2011, Google said that it anonymizes the IP address data that it collects, after nine months, and the association between cookies and web accesses after 18 months.[17] As of 2016, Google's privacy policy does not promise anything about whether or when its records about the users' web browsing or searching are deleted from its records.[17]

The non-profit group Public Information Research launched Google Watch, a website advertised as "a look at Google's monopoly, algorithms, and privacy issues."[18][19] The site raised questions relating to Google's storage of cookies, which in 2007 had a life span of more than 32 years and incorporated a unique ID that enabled creation of a user data log.[15] Google faced criticism with its release of Google Buzz, Google's version of social networking, where Gmail users had their contact lists automatically made public unless they opted out.[20]

Google shares this information with law enforcement and other government agencies upon receiving a request. The majority of these requests do not involve review or approval by any court or judge.[21]

Tracking

Google is suspected of collecting and aggregating data about Internet users through the various tools it provides to developers, such as Google Analytics, Google Play Services, reCAPTCHA, Google Fonts, and Google APIs. This could enable Google to determine a user's route through the Internet by tracking the IP address being used through successive sites (cross-domain web tracking), However the fourth generation of Google Analytics claims that it drops any IP information from EU users.[22] Linked to other information made available through Google APIs, which are widely used, Google might be able to provide a quite complete web user profile linked to an IP address or user. This kind of data is invaluable for marketing agencies, and for Google itself to increase the efficiency of its own marketing and advertising activities.[23]

Google encourages developers to use their tools and to communicate end-user IP addresses to Google: "Developers are also encouraged to make use of the parameter to supply the IP address of the end-user on whose behalf you are making the API request. Doing so will help distinguish this legitimate server-side traffic from traffic which doesn't come from an end-user."[24] reCAPTCHA uses the google.com domain instead of one specific to reCAPTCHA.

Gmail

After Google released the Gmail service in 2004, several people, including Microsoft CEO Steve Ballmer,[28] Senator Liz Figueroa,[29] and The Register columnist Mark Rasch,[30] criticized the processing of email message content as going beyond proper use.

Google Inc. claims that mail sent to or from Gmail is never read by a human being other than the account holder, and content that is read by computers is only used to improve the relevance of advertisements and block spam emails.[31] The privacy policies of other popular email services, like Outlook.com and Yahoo, allow users' personal information to be collected and utilized for advertising purposes.[32]

CIA and NSA ties

In February 2010, Google was reported to be working on an agreement with the National Security Agency (NSA) to investigate recent attacks against its network. While the deal did not give the NSA access to Google's data on users' searches or e-mail communications and accounts and Google was not sharing proprietary data with the agency, privacy and civil rights advocates were concerned.[41][42]

In October 2004, Google acquired Keyhole, a 3D mapping company. In February 2004, before its acquisition by Google, Keyhole received an investment from In-Q-Tel, the CIA's investment arm.[43] And in July 2010 it was reported that the investment arms of both the CIA (In-Q-Tel) and Google (Google Ventures) were investing in Recorded Future, a company specializing in predictive analytics—monitoring the web in real time and using that information to predict the future. Private corporations have been using similar systems since the 1990s, but the involvement of Google and the CIA, with their large data stores, raised privacy concerns.[44]

Government requests

Google has been criticized both for disclosing too much information to governments too quickly and for not disclosing information that governments need to enforce their laws. In April 2010, Google, for the first time, released details about how often countries around the world ask it to hand over user data or to censor information.[51] Online tools make the updated data available to everyone.[52]

Between July and December 2009, Brazil topped the list for user data requests with 3,663, while the US had made 3,580, the UK 1,166, and India 1,061. Brazil also made the largest number of requests to remove content with 291, followed by Germany with 188, India with 142, and the US with 123. Google, which stopped offering search services in China a month before the data was released, said it could not release information on requests from the Chinese government because such information is regarded as a state secret.[51]

Google's chief legal officer said, "The vast majority of these requests are valid, and the information needed is for legitimate criminal investigations or for the removal of child pornography".[51]

Google Chrome

In 2008, Consumer Watchdog produced a video showing how Google Chrome records what a user types into the web address field and sends that information to Google servers to populate search suggestions. The video includes discussion regarding the potential privacy implications of this feature.[57][58][59]

Google Chrome includes a private browsing feature called "incognito mode" that prevents the browser from permanently storing any browsing or download history information or cookies. Using incognito mode prevents storage of pages visited in the browser's history. However, the individual websites visited can still track and store information about visits. In particular, any searches performed while signed into a Google account will be saved as part of the account's web history.[60] In addition, other programs such as those used to stream media files, which are invoked from within Chrome, may still record history information, even when incognito mode is being used.

Street View

Google's online map service, Street View, has been found guilty of retrieving emails and other personal data in the streets ("payload data"), taking pictures and viewing too far into people's private homes and/or too close to people on the street when they do not know they are being photographed.[63][64]

Wi-Fi networks information collection

From 2006 to 2010, Google Street View camera cars collected about 600 gigabytes of data from users of unencrypted public and private Wi-Fi networks in more than 30 countries. No disclosures nor privacy policy was given to those affected, nor to the owners of the Wi-Fi stations.[65]

Google apologized and said that they were "acutely aware that we failed badly here" in terms of privacy protection, that they were not aware of the problem until an inquiry from German regulators was received, that the private data was collected inadvertently, and that none of the private data was used in Google's search engine or other services. A representative of Consumer Watchdog replied, "Once again, Google has demonstrated a lack of concern for privacy. Its computer engineers run amok, push the envelope and gather whatever data they can until their fingers are caught in the cookie jar." In a sign that legal penalties may result, Google said it will not destroy the data until permitted by regulators.,[66][67] but then failed to do so in eleven countries.[68]

The Street View data collection prompted several lawsuits in the United States. The suits were consolidated into one case before a California federal court. Google's motion to have the case dismissed, saying the Wi-Fi communications it captured were "readily accessible to the general public" and therefore not a violation of federal wiretapping laws, was rejected in June 2011 by the U.S. District Court for the Northern District of California and upon appeal in September 2013 by the U.S. Court of Appeals for the Ninth Circuit. The ruling is viewed as a major legal setback for Google and allows the case to move back to the lower court for trial.[69][70][71]

Currently Google no longer collects WiFi data via Street View, instead using an Android device's Wi-Fi positioning system; however, they have suggested the creation of a unified approach for opting-out from Wi-Fi-based positioning systems, suggesting the usage of the word "nomap" appended to a wireless access point's SSID to exclude it from Google's WPS database.[72][73]

Real names, Google+, and Nymwars

Google Plus (G+) was launched in late June 2011. The new service gained 20 million members in just a few weeks.[80] At the time of launch, the site's user content and conduct policy stated, "To help fight spam and prevent fake profiles, use the name your friends, family or co-workers usually call you."[81] Starting in July 2011, Google began enforcing this policy by suspending the accounts of those who used pseudonyms.[82][83] Starting in August 2011, Google provided a four-day grace period before enforcing the real name policy and suspending accounts. The four days allowed members time to change their pen name to their real name.[84] The policy extended to new accounts for all of Google services, including Gmail and YouTube, although accounts existing before the new policy were not required to be updated. In late January 2012 Google began allowing members to use nicknames, maiden names, and other "established" names in addition to their common or real names.[85]

According to Google, the real name policy makes Google more like the real world. People can find each other more easily, like a phone book. The real name policy is believed to protect children and young adults from cyber-bullying, as those bullies hide behind pen names,[86] but this view fails to acknowledge that people may also hide from bullies by using nicknames not known to others. There is considerable use of search engines for "people-searching", attempting to find information on persons by performing a search of their name.[87]

A number of high-profile commentators have publicly criticized Google's policies, including technologists Jamie Zawinski,[88] Kevin Marks,[89] and Robert Scoble[90] and organizations such as the Electronic Frontier Foundation.[91]

Criticisms have been wide-ranging,[92][93][94] for example:

The policy is not like the real world, because real names and personal information are not known to everyone in the off-line world.
The policy fails to acknowledge long-standing Internet culture and conventions.[91]
Using real names online can disadvantage or endanger some individuals, such as victims of violence or harassment. The policy prevents users from protecting themselves by hiding their identity. For example, a person who reports a human rights violation or crime and posts it on YouTube can no longer do so anonymously. The dangers include possible hate crimes, retaliation against whistle-blowers, executions of rebels, religious persecution, and revenge against victims or witnesses of crimes.[95]
Using a pseudonym is different from anonymity, and a pseudonym used consistently denotes an "authentic personality".[96]
Google's arguments fail to address the financial gain represented by connecting personal data to real-world identities.[97]

Do Not Track

In April 2011, Google was criticized for not signing onto the Do Not Track feature for Chrome that was being incorporated in most other modern web browsers, including Firefox, Internet Explorer, Safari, and Opera. Critics pointed out that a new patent Google was granted in April 2011, for greatly enhanced user tracking through web advertising, will provide much more detailed information on user behavior and that do not track would hurt Google's ability to exploit this. Software reviewer Kurt Bakke of Conceivably Tech wrote:

"Google said that it intends to charge advertisers based on click-through rates, certain user activities and a pay-for-performance model. The entire patent seems to fit Google's recent claims that Chrome is critical for Google to maintain search dominance through its Chrome web browser and Chrome OS and was described as a tool to lock users to Google's search engine and – ultimately – its advertising services. So, how likely is it that Google will follow the do-not-track trend? Not very likely."

Mozilla developer Asa Dotzler noted: "It seems pretty obvious to me that the Chrome team is bowing to pressure from Google's advertising business and that's a real shame. I had hoped they'd demonstrate a bit more independence than that."[101][102][103]

At the time of the criticisms, Google argued that the technology is useless, as advertisers are not required to obey the user's tracking preferences and it remains unclear as to what constitutes tracking (as opposed to storing statistical data or user preferences). As an alternative, Google continues to offer an extension called "Keep My Opt-Outs" that permanently prevents advertising companies from installing cookies on the user's computer.[104]

The reaction to this extension was mixed. Paul Thurrott of Windows IT Pro called the extension "much, much closer to what I've been asking for—i.e. something that just works and doesn't require the user to figure anything out—than the IE or Firefox solutions" while lamenting the fact that the extension is not included as part of the browser itself.[105]

In February 2012, Google announced that Chrome would incorporate a Do Not Track feature by the end of 2012, and it was implemented in early November 2012.[106]

Moreover, Pól Mac and Douglas J. (2016) in their study “Don’t Let Google Know I’m Lonely”, presented strong evidence that the two giant techs have very high accuracy while providing results based on user's sensitive entries. Pól Mac and Douglas J. (2016) specifically focused on user's financial and sexual preferences and they have concluded that "For Google, 100% of user sessions on a sensitive topic reject the hypothesis that no learning of the sensitive topic by the search engine has taken place and so are identified as sensitive. For Bing, the corresponding detection rate is 91%."[107]

Privacy and data protection cases and issues by country

European Union

European Union (EU) data protection officials (the Article 29 working party who advise the EU on privacy policy) have written to Google asking the company to justify its policy of keeping information on individuals' internet searches for up to two years. The letter questioned whether Google has "fulfilled all the necessary requirements" on the EU laws concerning data protection.[115] On May 31, 2007, Google agreed that its privacy policy was vague, and that they were constantly working at making it clearer to users.[116]

After Google merged its different privacy policies into a single one in March 2012, the working group of all European Union Data Protection Authorities assessed that it failed to comply with the EU legal framework. Several countries then opened cases to investigate possible breach of their privacy rules.[117]

Google has also been implicated in Google Spain v AEPD and Mario Costeja González, a case before the Audiencia Nacional (Spain's national court) and the European Court of Justice, which required Google to comply with the European privacy laws (i.e., the Data Protection Directive) and to allow users to be forgotten when operating in the European Union.[118][119]

Czech Republic

Starting in 2010, after more than five months of unsuccessful negotiations with Google, the Czech Office for Personal Data Protection prevented Street View from taking pictures of new locations. The Office described Google's program as taking pictures "beyond the extent of the ordinary sight from a street", and claimed that it "disproportionately invaded citizens' privacy."[120][121] Google resumed Street View in Czech Republic in 2012 after having agreed to a number of limitations similar to concessions Google has made in other countries.[122]

France

In January 2014, the French authority, CNIL sanctioned Google, requiring it to pay their highest fee and to display on its search engine website a banner referring to the decision.[123] Google complied but appealed to the Conseil d'État, France’s highest administrative court.[117] That same year, French and German companies formed the Open Internet Project to oppose Google’s alleged favoritism of its own services.[124]

In 2019, CNIL fined Google €50 million for failing to clearly inform users and obtain valid consent for personalized ads under the GDPR. The Conseil d'État upheld the fine in 2020.[125]

In 2020, Google was fined €100 million for placing advertising cookies without user consent. This fine was confirmed in 2022 by the Conseil d'État.[126]

Germany

In May 2010, Google was unable to meet a deadline set by Hamburg's data protection supervisor to hand over data illegally collected from unsecured home wireless networks. Google added, "We hope, given more time, to be able to resolve this difficult issue."[129] The data was turned over to German, French, and Spanish authorities in early June 2010.[130]

In November 2010, vandals in Germany targeted houses that had opted out of Google's Street View.[131]

In April 2011, Google announced that it will not expand its Street View program in Germany, but what has already been photographed—around 20 cities' worth of pictures—will remain available. This decision came despite an earlier Berlin State Supreme Court ruling that Google's Street View program was legal.[132]

In September 2014, a top official in Germany called for Google to be broken up as publishers were fighting in court over compensation for the snippets of text that appear with Google News updates. The chief executive of Axel Springer, a German publishing giant, expressed fears over Google's growing influence in the country.

Italy

In February 2010, in a complaint brought by an Italian advocacy group for people with Down's Syndrome, Vividown, and the boy's father, three Google executives were handed six-month suspended sentences for breach of the Italian Personal Data Protection Code in relation to a video, uploaded to Google Video in 2006, of a disabled boy being bullied by several classmates.[133][134][135] In December 2012, these convictions and sentences were overturned on appeal.[136]

Norway

The Data Inspectorate of Norway (Norway is not a member of the EU) investigated Google (and others) and stated that the 18- to 24-month period for retaining data proposed by Google was too long.[137]

United Kingdom

On March 27, 2015, the Court of Appeal ruled that British persons have the right to sue Google in the UK for misuse of private information.[138][139]

United States

In early 2005, the United States Department of Justice filed a motion in federal court to force Google to comply with a subpoena for "the text of each search string entered onto Google's search engine over a two-month period (absent any information identifying the person who entered such query)."[140] Google fought the subpoena, due to concerns about users' privacy.[141] In March 2006, the court ruled partially in Google's favor, recognizing the privacy implications of turning over search terms and refusing to grant access.[142]

In April 2008, a Pittsburgh couple, Aaron and Christine Boring, sued Google for "invasion of privacy". They claimed that Street View made a photo of their home available online, and it diminished the value of their house, which was purchased for its privacy.[143] They lost their case in a Pennsylvania court. "While it is easy to imagine that many whose property appears on Google's virtual maps resent the privacy implications, it is hard to believe that any – other than the most exquisitely sensitive – would suffer shame or humiliation," Judge Hay ruled; the Boring family was paid one dollar by Google for the incident.[144]

Privacy concerns with Google

History