Google World – the Documentary

By Greg Hluska

I had the opportunity to watch a very interesting documentary on the rise of Google.  Those of you who know me (or those of you who follow this blog) know that I have an unhealthy a mild obsession with Google.  That search engine, more than any other web site, completely changed the way that I use the web.  Prior to Google, I used to use a combination of Yahoo, Webcrawler and Alta Vista for all of my searches.  Neither engine worked terribly well and sorting through crap was a big part of my online experience.

Google has expanded since those innocent days when they were just a very good search engine.  One of their stated goals is to index every single piece of information in the world.  They have expanded into email, online (cloud-based) word processing/office productivity software, photo sharing, social networking, and many other areas.  Because of this omnipresence and the sheer amount of information that Google collects, the company has several privacy advocates up in the air.

In response to privacy concerns, Eric Schmidt (Google C.E.O.) made a very interesting statement in the Doc Zone documentary (which you can watch online).  Echoing free market ideals, he talked about how Google has to be in the business of protecting its users privacy because if it fails, the marketplace will find out, people will stop giving Google their personal information, and Google’s revenues will drop accordingly.

Not only an interesting statement, but an interesting deviation from a particularly boneheaded statement that Schmidt made in 2006, when he was quoted as saying:

I think judgment matters. If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place. If you really need that kind of privacy, the reality is that search engines — including Google — do retain this information for some time and it’s important, for example, that we are all subject in the United States to the Patriot Act and it is possible that all that information could be made available to the authorities.

It is amazing how a few years (and a great Public Relations team) can change one’s tune from being completely offensive to being logical and relatively benign.  However, there is still a problem with Eric Schmidt’s most-recent statement.  The fact remains that, outside of some hardcore privacy advocates/researchers, the mainstream public is not necessarily aware of what information Google collects, what Google does with that information, and how/if we can opt out.

To shed a little bit of light on this, here are some things that Google uses your personal information for (this is a direct quote from http://www.google.com/privacypolicy.html)

• Providing our services, including the display of customized content and advertising;
• Auditing, research and analysis in order to maintain, protect and improve our services;
• Ensuring the technical functioning of our network;
• Protecting the rights or property of Google or our users; and
• Developing new services.

Consider what this means in context of the information that Google collects from you.  When you sign in to your Gmail account, Google will analyze every single email you have received and sent to figure out what sorts of things you are interested in.  And then, they will serve you targeted ads according to your interests.  However, their collection does not stop there – when you visit Google pages, they will set cookies on your browser, and use these cookies to learn more about you and your search habits.

I have read the Personal Information Protection and Electronic Documents Act cover to cover (amazing, amazing read) and I am not sure that Google’s privacy policy completely complies with Canadian law.  For example, Google sets cookies on your computer (and monitors things like your IP address) whether you log in to a Google account or not.  So, let’s say you log in to your Google account, check your email and write a document.  Then, you log out of your Google account, go to Google.ca and search for, “Personal Information Protection and Electronic Documents Act”.  Does Google associate that search with your Google account, even though you were not logged in when you made the search?

Or how about Ben Edelman’s scary findings about how the Google Toolbar keeps transmitting personal information even after you choose to disable it?  Is that, in any way compliant with PIPEDA?  And, even more importantly, do any mainstream computer users know about this violation?  And finally, most importantly, does that problem still happen when Google Toolbar is installed in Canada?

I hope that this article starts a discussion, but I am, in no way implying that Google actively or knowingly violates PIPEDA.  Rather, I am putting this post here for information purposes and to start a more formal process where I am going to analyze some of Google’s activities from a privacy point of view.  My first step is going to be to try and replicate Ben Edelman’s findings three months after they were first published.  It is entirely possible that Google did not know that problem existed (I work for a software company, believe me, bugs slip through the most strenuous checks and balances).  And, it is my hope that this bug has been fixed.

I will keep you updated but until then, please think about where your personal information goes.