This morning I read Google employee Matt Cutts frustrated response to a report from Privacy International that gave Google two big thumbs down. Disclaimer: I own GOOGle stock.

The Privacy International report analyzed the privacy practices of 24 companies including the GYM search engine trio: Google, Yahoo, Microsoft. They also looked at two of Google’s properties: YouTube and Orkut. The actual report is in PDF only (grrr) and is in a colorized table with the legend indicating that green is “privacy friendly and privacy enhancing.”

None of the websites profiled received the best rating. The closest to the best rating are denoted in cyan as “generally privacy enhancing but in need of improvement” and include the BBC, eBay, last.fm and Wikipedia. YouTube and Orkut scored the third to worst rating: “serious lapses in privacy practices” and the only site to garner the worst rating, colorized black, is Google.

Let’s look at the specific comments in the report that lead Privacy International to these conclusions about Google:

- privacy policy not updated since 2005. True, Privacy policy last updated October 14, 2005.
- rejected access to U.S Justice department for research purposes. Correct me if wrong but isn’t this a good thing? As Matt Cutts aptly notes, AOL, Yahoo and Microsoft all offered up search results where Google was the only one to say no. Yet all of them ranked higher in this report.
- IP addresses are not considered personal information. Considering IP addresses can be shared among a pool of users, I’d tend to agree.
- they do not believe that they collect sensitive information. I don’t believe search results are “sensitive” information either because taken by themselves what do they mean?
- Do sometimes track links clicked So …? MyBlogLog by Yahoo tracks your presence on somebody’s website (if registered and logged in).
- Data collection: Unclear, but has stated 18-24 months as eventual outcome. Log history is retained after this period. What is unclear? Google has said publically that they remove any personal identification after 18-24 months. I think it was a good move for Google to remove the 18-24 months, although I’m puzzled why they didn’t update their privacy policy when this change was made.
- Vague, incomplete and possibly deceptive privacy policy. Most documents written by lawyers fit this definition. Google’s policy doesn’t seem out of the ordinary in this respect. They also offer a more plain language Privacy Highlights page.
- [Privacy Policy] fails to explain detailed data processing elements or information flows. And Coca-Cola or KFC list their secret ingredients?
- Generally poor record of responding to consumer complaints. True, this is a fair concern although I’m not sure how it relates to privacy. Google is slow to respond to individual correspondences. It takes several days, sometimes a week or more to get a response. The flip side of that is once you actually get somebody at Google to respond to an issue the conversation flows better. I see this as a scale problem. They have more people contacting them than people with the ability and time to respond. Solution? Hire more customer service reps. Mitch Ratcliffe points out that Privacy International had problems getting Google to respond to their concerns before publishing the report. Google needs to fix this problem.
- Ambivalent attitude to privacy challenges. Denying the U.S justice department access to records doesn’t sound like an “ambivalent attitude” to me. They strongly felt at the time and wrote about on their official blog that they felt this was overstepping privacy for Google users.
- Privacy mandate is not embedded throughout the company. Maybe I misunderstand the goal of the study here but if they are separating out websites like YouTube and Orkut from Google then why are they making this a negative? Shouldn’t each site stand on its own?
- This might be my favorite of the lot: Techniques and technology rolled out without adequate public consultation (IE. street-view). So Google is supposed to run public beta tests through what? More private, closed beta testing first? Isn’t opening a beta product to the public an opportunity to get “adequate public consultation?” Absurd complaint.
- Google does not allow search history to be removed. You can delete recent search results from view anyway using Google Personalized search. I’m fairly certain this doesn’t delete the results from their database though, so this complaint seems justified.

And finally the justification for the worst grade:

- Track history of ignoring privacy concerns. False.
- Every corporate announcement involves some new practice involving surveillance. Come on, “every” new announcement? I didn’t check the last 10 corporate announcements but I sincerely doubt this is accurate. The whole use of the word “surveillance” conjures images of peeping toms.
- Privacy officer tries to reach out but no indication that this has any affect on product service design or delivery. I didn’t know Google had a Privacy officer, but if they do I’m guessing after reading this report he’s hanging from a ceiling fan somewhere.

Here’s what Matt Cutts said about the report:

I believe this report could corrode earnest efforts to improve privacy at companies around the internet. Why? Because the bottom-line takeaway message that I got from the report is that a company can work hard on privacy issues and still get dragged into the mud. Consider: in the last year or so, other companies gave users’ queries to the government, leaked millions of raw user queries, or even sold user queries and still came off better than Google did.

Don’t look now Matt, but the plot thickens. Privacy International director Simon Davies is claiming in an open letter to Google CEO Eric Schmidt that Google is running a smear campaign:

I am writing to express my concern not just at this unfortunate result, but also at communications between Google Inc and members of the media during the period immediately prior to publication of our report. Two European journalists have independently told us that Google representatives have contacted them with the claim that “Privacy International has a conflict of interest regarding Microsoft”. I presume this was motivated because Microsoft scored an overall better result than Google in the rankings.

One of the people on the 70 person Advisory Board that made up the PI report is an employee of Microsoft. How did Microsoft score? Don’t get excited, it’s orange for “serious lapses in privacy practices.”

Hmm thoughts
As I looked closer and closer at this report it occured to me that none of the sites really did that well. I know the big story right now is Google doing the worst, but perhaps the bigger story is that nobody did very well. If none of these websites can get an excellent rating for privacy from an independent study that doesn’t speak well for how our privacy is being handled.

Does this worst rating matter from a financial perspective? Google stock hasn’t been significantly impacted yet, although it is down a few bucks to $513 as of publishing this post.

Generally speaking, I’m with Matt on this one, this report seems to have given Google a bad rap undeservedly. I’m not saying Google doesn’t have things they should work on concerning privacy, but their size and dominance in search appears to be working against them. This report proves Google has the biggest bullseye on their backs and rightfully so. They should be showing others the way which they aren’t doing by having a privacy policy that hasn’t been updated in 18 or so months. They need to update that ASAP.

Ironically the Privacy International site has a Google Page Rank of 7. Google’s algorithm considers this a pretty good source.

If you are concerned about privacy I wrote a post with 12 tips for protecting privacy that might be of interest. My personal take on privacy and search engines remains that I don’t care if they use my search results to make their search engine results better. I expect they will do that just like Amazon should use our purchase results to better suggest related products/services we might be interested in and TiVO (when we had it) should use what we’ve watched to record shows it thinks we might like.

Frankly I’m hoping these companies use this information to contribute back to making a better artificial intelligence. Google has been rightly criticized in the past for not giving enough back to open source and it’s good to see them doing things to improve this criticism. With that in mind, if I were ranking them on this legend I would have put them in the yellow “Generally aware of privacy rights but demonstrates some notable lapses.” With the difficulty of getting rid of some preinstalled AOL software I would have put them at the bottom of the pile, not Google.

Did this post make you go hmm?

Maybe Related Posts (plugin generated)

• Google responds to my nofollow concerns
• Google’s “newfound powers”
• Your blog page movie rating
• Proof that Google spam fight is not a “sham”
• Employee non-work internet activity during work hours
• More Google privacy abounds: paranoia or due dilligence?