In what's being hailed as its biggest privacy action in almost 10 years, the Federal Trade Commission said it had charged Google with engaging in deceptive practices stemming from the launch of Buzz.
When Google debuted Buzz, the service created social networks from people's Gmail contacts. But Google designed the feature so that it initially revealed information about the names of users' email contact if users activated Buzz without changing the defaults. That design meant that a host of confidential information could inadvertently become known, including the names of Gmail users' doctors, lawyers or coworkers.
Seven Gmail users also filed their own lawsuits. Those cases were consolidated into one class-action, which Google recently agreed to pay $8.5 million to settle. The agreement in that matter calls for Google to pay $6 million to various privacy organizations, $2,500 to each of seven individual Web users who sued, and $2.5 million to the attorneys who brought the case.
EPIC executive director Marc Rotenberg says that Wednesday's enforcement action could have a far-reaching impact. "It's probably the most significant privacy decision from the FTC to date," he says. "It makes clear to other companies that the FTC is prepared to enforce privacy policies and that the FTC is prepared to establish privacy standards."
Rotenberg adds that while the FTC has actively pursued companies who don't do enough to secure users' passwords, actions relating to privacy are far more rare. He says that the FTC's biggest privacy case prior to Wednesday's action against Google occurred in 2002, when the FTC extracted concessions from Microsoft related to its Passport identification system that collected personal information from users.
The FTC will accept comments through May 2 about whether to approve the Google deal. But one commissioner, J. Thomas Rosch, is already expressing reservations about a provision calling for Google to obtain users' opt-in consent to sharing information in new ways. That requirement "applies not just to Google's social networking services or products, but to every single Google service or product that undergoes some 'change, addition, or enhancement.'" Rosch stated.
He added that the opt-in consent requirement appears contrary to Google's self-interest, because it could apply to any product or service Google offers, including those that involve "the tracking and sharing of identified Google users' browsing behavior."
Google's Alma Whitten, director of privacy, product and engineering, again apologized for the Buzz rollout. "We are 100 percent focused on ensuring that our new privacy procedures effectively protect the interests of all our users going forward," she said on Google's blog.