Case Studies: Google

Google Street View: Failing to think through and address the privacy issues related to its Street View mapping project has led to years of headaches for Google, including numerous class action lawsuits, government investigations, and expensive privacy fixes. Within weeks of Street View's 2007 launch, Google was forced to change takedown policies due to bad press over embarrassing photos and a complicated takedown process. This was followed by an invasion of privacy lawsuit filed in 2008. In 2010, when it was revealed that Street View trucks had collected data over unsecured private WiFi networks, Google again faced legal problems from numerous class action lawsuits and investigations by at least seven countries. Ongoing backlash by the EU has forced Google to blur photos and delete unblurred images, and complaints in Japan have forced the company to reshoot all the Street View footage in that country to ensure images on private property were not captured. Identifying and addressing the many privacy issues prior to launch, rather than after the fact, could have saved Google a lot of time, energy, and goodwill.

Google: In April 2010, Google stopped censoring search results in China by rerouting users of Google.cn to Google’s uncensored Hong Kong site. Google has since held its ground and refused to censor search results within China, though it did agree to redirect Chinese users to the Google.hk.com site before processing search requests. The move was lauded as a "historic moment" that "sets a great example" by observers. Some companies, such as "GoDaddy.com", followed suit and ceased doing business in China in the aftermath.

Google: In an important move towards transparency, Google released a Government Requests tool in 2010 to track and display the number of government demands the company receives worldwide, country by country. Although imperfect (the tool doesn’t track all requests, is limited to six months of data, and only counts the numbers of requests received, not the number user records requested), it is a strong step towards educating users about government access to private information held by companies. Google, which had regularly been chastised by privacy organizations and the technology press for a lack of transparency on government requests, was lauded for the move.

Google: In 2010 Google chose privacy over competition and filed a legal brief in support of rival email and search provider Yahoo! in its legal battle with the Justice Department to safeguard user emails. Although not a party to the case, Google stood up and fought back against the disclosure of email without a warrant.

Google Buzz: In early 2010, Google tried to jump on the social networking bandwagon by releasing its own new service, Google Buzz. But the biggest buzz about the new service focused on privacy because Google pre-populated "following" lists with frequent chat and email contacts and made that information public by default. Media articles called Buzz a “privacy nightmare” and warned that Buzz “managed to completely overstep the bounds of personal privacy.” Within weeks of launch, Google Buzz became the subject of an FTC privacy complaint and a class action lawsuit which resulted in a $8.5 million settlement.

Google was unprepared for the negative reaction to Buzz’s privacy flaws and had to scramble to fix the product.  However, faced with such a hostile reaction, Google quickly fixed some of the big problems with the service. Buzz now "suggests" followers to new users rather than automatically following gmail contacts, and it no longer automatically shares private information from other Google services like Picasa Web Albums. Google has also added a more prominent settings tab to Buzz and promised to give Buzz users who signed up before these changes a second chance to evaluate their privacy settings (though, as of mid-March, they had not yet done so).

Google: In 2007 Google became the target of public outcry when it tried to close down its video service that incorporated DRM technology. Because users would have been unable to continue to use their previously purchased content once Google terminated the service, Google was forced to fully refund all payments for the service as well as keep the service active for an additional six months.

Google: When Google stood up for the privacy of its users by fighting an overbroad civil subpoena from the government that demanded millions of private search queries, the company reaped a bonanza of positive public and media attention. In the end, the court held that the government was only entitled to 50,000 URLs with no personal information.

Ask, Google, Microsoft, Yahoo!: Major search engines have started to recognize the importance of limiting data-retention periods for all data. Ask developed the AskEraser, allowing users to conduct online searches without the company logging any information. Microsoft deletes the full IP address, cookies, and any other identifiable user information from its logs after 18 months. Yahoo! is now planning to anonymize all search records after three months. Google now engages in a very limited form of log anonymization after nine months for those using the search engine and not logged into a Google account. After 18 months, the company deletes a portion of the stored IP address and de-identifies the cookie information stored in its logfiles.

Google: The company was pilloried in the press for making millions of its Google toolbar users vulnerable to a malicious software attack because of its toolbar's silent, automatic update mechanism. In 2006, a researcher found a flaw in the toolbar update mechanism of the Firefox browser. But since the Google toolbar software, unlike that used by Yahoo! or Facebook, did not provide notice to and obtain consent from users prior to updating the toolbar, Google toolbar users who used the Firefox browser could not control when the toolbar was updated and faced increased risk.