Google, EPIC and the Values of Disaggregation

On January 24, 2012 Google announced the significant revamping of its privacy policies, consolidating the policies to a single, comprehensive approach. The simplicity of the policy is undoubtedly good news for the legions of users who pay attention to such issues.

The bad news is that not only are the policies consolidated, so is the underlying data. Google, which runs dozens of discrete services will be integrating the data collection into a single, comprehensive and interconnected data set – the ultimate Big Data of consumer behavior. The reason is simple: Google’s revenue is tied exclusively to advertising. The better the data integration, the more valuable each ad is when served to a prospective customer.

Google has thus far ignored EU requests to delay the roll-out. Instead, Google insists that any delay would cause more confusion. Instead, in a lengthy response,  Google explained reason behind the merging of several policies into one. Among the features, better integration will support is integrated usage.

Our ability to share information for one account across services also allows signed-in users to use Google+’s sharing feature –called “circles”– to send directions to family and friends without leaving Google Maps. And a signed-in user can use her Gmail address book to auto­complete an email address when she’s inviting someone to work on a Google Docs document.

The answers, however, do not respond to the duties of Google under last year’s FTC consent decree regarding the ill-fated launch of Google Buzz. the Electronic Privacy Information Center (EPIC) has sued to force the FTC to enforce the consent decree and thwart the new privacy policy.  The District Court is scheduled to hear the case in advance of the March 1, 2012 launch date.

According to EPIC’s Complaint, Google has violated a number of its consent decree obligations:

  • Misrepresenting the extent to which Google maintains privacy and confidentiality.
  • Misrepresenting the extent to which Google complies  with the U.S.-EU Safe Harbor Framework and data security obligations.
  • Providing adequate notice and consent to changes in Google privacy policies.

The critical commentary has been mixed, with some finding the changes a tempest in a teapot while other analysts expressing greater concern.

Perhaps most troubling is Google’s own set of comments:

So, here’s the real story:

  • You still have choice and control. You don’t need to log in to use many of our services, including Search, Maps and YouTube. If you are logged in, you can still edit or turn off your Search history, switch Gmail chat to “off the record,” control the way Google tailors ads to your interests, use Incognito mode on Chrome, or use any of the other privacy tools we offer.
  • We’re not collecting more data about you. Our new policy simply makes it clear that we use data to refine and improve your experience on Google — whichever products or services you use. This is something we have already been doing for a long time.
  • We’re making things simpler and we’re trying to be upfront about it. Period.
  • You can use as much or as little of Google as you want. For example, you can have a Google Account and choose to use Gmail, but not use Google+. Or you could keep your data separate with different accounts — for example, one for YouTube and another for Gmail.

Privacy on Google requires turning its services off, operating in Incognito mode, creating multiple accounts or avoiding the products.  Google is increasingly transparent. It does not wish to provide privacy and will make private transactions increasingly difficult. That the data has always been collected is true; that Google can exploit it more effectively is perhaps the real story – and real danger.

The approach is the opposite of the FTC privacy-by-design imitative. Almost everything one does will be tracked. Suddenly search has become quite expensive.