What Google Should Roll Out Next: A Privacy Upgrade

From the New York Times Editorial Observer: "What Google Should Roll Out Next: A Privacy Upgrade." Nothing that new here for those who follow the privacy implications of Google, but it's good that attention to the issue is broadening. Here are some highlights:

Google has been aggressive about collecting information about its users' activities online. It stores their search data, possibly forever, and puts "cookies" on their computers that make it possible to track those searches in a personally identifiable way - cookies that do not expire until 2038. Its e-mail system, Gmail, scans the content of e-mail messages so relevant ads can be posted. Google's written privacy policy reserves the right to pool what it learns about users from their searches with what it learns from their e-mail messages, though Google says it won't do so. It also warns that users' personal information may be processed on computers located in other countries.

The government can gain access to Google's data storehouse simply by presenting a valid warrant or subpoena. Under the Patriot Act, Google may not be able to tell users when it hands over their searches or e-mail messages. If the federal government announced plans to directly collect the sort of data Google does, there would be an uproar - in fact there was in 2003, when the Pentagon announced its Total Information Awareness program, which was quickly shut down.

In the early days of the Internet, privacy advocates argued that data should be collected on individuals only if they affirmatively agreed. But businesses like Google have largely succeeded in reversing the presumption. There is a privacy policy on the site, but many people don't read privacy policies. It is hard to believe most Google users know they have a cookie that expires in 2038, or have thought much about the government's ability to read their search history and stored e-mail messages without them knowing it.

Google says it needs the data it keeps to improve its technology, but it is doubtful it needs so much personally identifiable information. Of course, this sort of data is enormously valuable for marketing. The whole idea of "Don't be evil," though, is resisting lucrative business opportunities when they are wrong. Google should develop an overarching privacy theory that is as bold as its mission to make the world's information accessible - one that can become a model for the online world. Google is not necessarily worse than other Internet companies when it comes to privacy. But it should be doing better.

Regarding Cohen's belief that "it is doubtful [Google] needs so much personally identifiable information," it seems clear to me that they're using the data to move toward the "perfect search" - a search engine that is personalized, predictive, and relevant (especially in regards to advertising). That's why they "need" the data. But Cohen is correct in calling for stronger privacy policies, especially since we don't know how long Google's "don't be evil" mantra will last.

Technorati tag: Google privacy