Commentary

FTC Urged To Investigate Google Over 'Dangerously Invasive' Privacy Policy

This summer, Google revised its privacy policy to allow the company to combine data about people's Web-browsing activity -- which ad companies long insisted was "anonymous" -- with information seen as personally identifiable.

The updated terms apply to new account holders by default, but only affect existing users who opt in. The company rolled out the new policy in June, when it announced plans to beef up its ad-targeting capabilities by meshing data about people's Web browsing (gleaned from DoubleClick's ad service) with other information, like people's YouTube viewing and use of maps.

When Google notified users about the new policy, the company asked people to opt in to receiving personalized ads. At the time, Google promised users that doing so would allow them to control ads more easily. "Opting in gives you more granular control over how ads work across devices signed into your Google account," Wired  wrote in June. "If a search for boat shoes (you know, the grey ones with white laces) haunts you across the web, you’ll be able to kill it everywhere, all at once, rather than going device by device."

In October, ProPublica examined Google's move in depth, focusing on its decision to end a longstanding prohibition on combining personally identifiable data with non-personally identifiable information.

ProPublica concluded that Google's new policy lets the company "build a complete portrait of a user by name, based on everything they write in email, every website they visit and the searches they conduct."

Now, longtime Google critic Consumer Watchdog, along with the Privacy Rights Clearing House, is asking the Federal Trade Commission to investigate the company.

"Google has engaged in a dangerously invasive and far-reaching appropriation of user data," the groups say in an FTC complaint.

They add that the company "has given itself the power to track users across the overwhelming majority of websites in use in the world today, many of which appear to users to be entirely unconnected from Google."

The advocates accuse Google of duping users in June by asking them to accept the new policy without clearly explaining that it removes a longstanding ban on combining identifiable and anonymous information.

"Google required existing users to click through a notification announcing their accounts' 'new features,' which ostensibly gave the users 'more control over the data Google collects and how it’s used,'" the groups write. "The notification referenced the combination of the two data tranches two-thirds of the way down the page and in an oblique manner."

The groups continue: "This announcement intentionally misled users, who had no way to discern from the wording that Google was breaking from a nearly decade-old practice and asking them if it could link their personal information to data reflecting their behavior on as many as 80% of the Internet’s leading websites."

They also point out that in 2007, when Google sought to acquire DoubleClick, Google company worked hard to convey the impression that it would keep data about people's Web browsing separate from other information.

David Drummond, Google's chief legal officer, testified to a Senate panel that ad-serving information collected by DoubleClick data is "owned by the customers, publishers and advertisers," and that "DoubleClick or Google cannot do anything with it."

Drummond added in his prepared testimony that DoubleClick "does not own and has very limited rights to use any of the data it processes on behalf of its publisher and advertiser clients.”

Consumer Watchdog and Privacy Rights Clearinghouse also note that Google has a checkered history when it comes to online privacy. In 2012, after Google was caught circumventing Safari's default settings, which prevented tracking, the company agreed to pay $22.5 million to settle Federal Trade Commission charges. Several years before, Google entered into a consent decree with the FTC stemming from its launch of Buzz, which aimed to create networks out of people's email contacts. At launch, the feature revealed information about the names of users' email contacts, if users activated Buzz without changing the defaults.

The groups now want the FTC to fine Google and to order the company to disgorge ad revenues obtained as a result of the new policy.

For its part, Google says it tested the update "around the world with the goal of understanding how to provide users with clear choice and transparency."

The company adds: "It is 100% optional -- if users do not opt-in to these changes, their Google experience will remain unchanged."

Next story loading loading..