More Uproar About New Google Privacy Policies

First appeared in USA Today

An advocacy group went to court on Wednesday to block Google from making a policy change that could lead to the search giant assembling richer behavior profiles of people who use more than one of its popular online services.

The Electronic Privacy Information Center filed a complaint asking a Washington, D.C., district court judge to restrain Google from making the policy change on March 1. EPIC also asked the judge to order the Federal Trade Commission to enforce a standing court order that prohibits Google from misrepresenting its privacy policies.

"We believe Google went way over the line in a variety of ways," says Marc Rotenberg, EPIC's executive director.

Google spokesman Chris Gaither indicated the company has not seen the court filings. "We welcome discussions about our approach," he says.

Google recently announced that it would institute a new privacy policy applicable to anyone using any of its popular online services. The new policy would make it easier for Google to cross-reference users' activity data culled from its most popular services, including search, Gmail, Google Apps, Google+, Picasa and YouTube.

Rotenberg contends that Google is repeating deceptive practices that got the company into hot water in early 2010 when it launched Buzz, a new social network that was intended to be part Facebook, part Twitter.

Google piggy-backed Buzz onto the Gmail accounts of 176 million users of its free online e-mail service without asking their permission. To instantly establish a list of Facebook-like friends, a Google algorithm selected up to 50 of each Gmail user's contacts and designated them as Buzz followers, akin to how Twitter users follow each other's postings.

A lengthy FTC deceptive practices probe of Buzz, sparked by an EPIC complaint, resulted in Google agreeing to a consent order that prohibits the company from misrepresenting its privacy practices. The company also agreed to obtain users' consent before disclosing personal data and to comply with a comprehensive privacy program, subject to audit for 20 years.

Google later also agreed to pay $8.5 million to settle privacy invasion claims stemming from the launch of Buzz.

Rotenberg contends the same general privacy concerns sparked by Buzz apply to Google's new privacy policy, which opens the door to the systematic cross-referencing of users' behaviors across all of the company's most popular consumer services.

"Buzz involved the combining of data from discrete services and it gave rise to the consent order," Rotenberg says. "This is about combining data across the entire Google platform, even after they were made subject to the consent order. As a legal matter we think it is far more serious."

Gaither counters that the company is not changing the visibility of users' information, nor how it shares that information with others parties.

He emphasizes that the company has undertaken "the most extensive notification effort in Google's history to ensure that users have many opportunities to learn about the changes." He insists that the new policy "will make it easier to understand our privacy commitments."

Two Google executives made those same points in a closed door briefing last week with 10 members of Congress.

Rep. Joe Barton, R-Texas, said he was disturbed by the executives' answers to questions about users' inability to delete data from sensitive e-mails or data that reveals visits to certain websites, such as one with information about cervical cancer.

"It was obvious to me, as I left the room, that this company has established this policy so instead of the consumer being the master of the Internet, Google is the master of the consumer," Barton says. "I think that is just wrong."

Rep. Mary Bono Mack, D-Calif., said Google's explanations during the briefing lacked clarity. Bono Mack said she intends to convene full hearings on Internet privacy this spring.

The FTC on Wednesday acknowledged being aware of EPIC's court filing, but declined to comment specifically on it.

"The FTC takes compliance with our consent orders very seriously and always looks carefully at any evidence that they are being violated," says spokeswoman Cecelia Prewett.

Google makes Gmail Statement Regarding Google Buzz Lawsuit

    From: Google Buzz
    Date: November 2, 2010 3:30:00 PM EDT
    To: @gmail users
    Subject: Important Information about Google Buzz Class Action Settlement

Google rarely contacts Gmail users via email, but we are making an exception to let you know that we've reached a settlement in a lawsuit regarding Google Buzz (http://buzz.google.com), a service we launched within Gmail in February of this year.

Shortly after its launch, we heard from a number of people who were concerned about privacy. In addition, we were sued by a group of Buzz users and recently reached a settlement in this case.

The settlement acknowledges that we quickly changed the service to address users' concerns. In addition, Google has committed $8.5 million to an independent fund, most of which will support organizations promoting privacy education and policy on the web. We will also do more to educate people about privacy controls specific to Buzz. The more people know about privacy online, the better their online experience will be.

Just to be clear, this is not a settlement in which people who use Gmail can file to receive compensation. Everyone in the U.S. who uses Gmail is included in the settlement, unless you personally decide to opt out before December 6, 2010. The Court will consider final approval of the agreement on January 31, 2011. This email is a summary of the settlement, and more detailed information and instructions approved by the court, including instructions about how to opt out, object, or comment, are available at http://www.BuzzClassAction.com.