• by Wendy Davis  @wendyndavis, October 24, 2011

The Federal Trade Commission said Monday that it has finalized a settlement with Google stemming from the company's launch of the social networking service Google Buzz.

The settlement requires Google to create a comprehensive privacy program and submit to independent privacy audits for the next 20 years. Google also promised that it will obtain people's express consent before sharing their information more broadly than its privacy policy allowed at the time of collection. 

The FTC took action against Google after the Electronic Privacy Information Center filed a complaint about Buzz, which created social networks out of people's Gmail contacts. EPIC alleged that the search giant violated users' expectations of privacy, as well as its own privacy policy, when it launched Buzz.

At launch, the service revealed information about the names of users' email contacts, if users activated Buzz without changing the defaults. That design meant that a host of confidential information could inadvertently become known, including the names of Gmail users' doctors, lawyers or coworkers.

Google revised Buzz shortly after unveiling the service, but was unable to stem widespread criticism by privacy advocates and consumers, or a wave of lawsuits by Gmail users.

While Google has been the subject of several complaints by privacy advocates, this case marked the first time the FTC filed charges against the company. The FTC alleged that Google violated its own privacy policy and used deceptive tactics when it launched its social network Buzz. 

After the FTC and Google announced a tentative settlement in March, EPIC filed comments with the FTC asking for more stringent conditions. Among others, the privacy group wanted Google to create a “do-not-track” mechanism for the Chrome browser, delete users' search history after six months, and protect the anonymity of people who use the Google Books service.

The FTC rejected those requests, approving the settlement without any modifications from the March proposal. “While the proposed order sets forth several elements that the privacy program must include, some flexibility is afforded with regard to its implementation,” the FTC wrote in an Oct. 13 letter to EPIC. “This approach allows innovation in the area of privacy-enhancing technologies and is designed to keep pace with a dynamic marketplace.”

In addition to the FTC action, several Gmail users filed civil lawsuits. Those cases were consolidated into one class-action, which Google agreed to pay $8.5 million to settle. The agreement in that matter calls for Google to pay $6 million to various privacy organizations, $2,500 to each of seven individual Web users who sued, and $2.5 million to the attorneys who brought the case. Some users objected to the settlement and filed an appeal to the 9th Circuit, where the matter is still pending.

Google announced earlier this month that it was going to shutter Buzz.