Google Knows Even More about You Than You Think
Privacy laws provide little protection in this regard. Most policies -- including Google's -- don't provide an explicit guarantee that the company will notify you if your data has been requested through a court order or subpoena. "The legal protections accorded to data stored with companies [and] the data they collect about you is very unclear," says Bankston.
The industry still relies on the Electronic Communications Privacy Act of 1986, a 22-year-old privacy law that even the government has argued doesn't apply to online data. "Google has yet to state a specific position on whether and how that law protects your search logs," Bankston says.
Privacy groups want Google to reveal just how many requests it receives from litigators and law enforcement and how it responds to those requests, but the company, like its competitors, does not release that information.
Google declined to elaborate on why it's not more forthcoming in this regard, but deputy general counsel Nicole Wong did say that it complies with legal requests "narrowly, appropriately and in accordance with the law."
In at least one high-profile case, Google has taken strong measures to protect the privacy of its subscribers. When Viacom issued a subpoena for the viewing records of Google's YouTube subscribers, it fought the subpoena and turned over only anonymized data that it says can't be traced back to individual users.
But privacy watchers question what happens to the thousands of requests for individual records in less prominent cases. Google's response: "Our overarching principle is we want to notify users," says product counsel Mike Yang.
The ACLU's Ozer thinks Google should collect less data and store it for shorter periods of time. That's one of her suggestions in a 44-page privacy and business primer for Web 2.0 companies published by ACLU of Northern California.
With lawmakers focused on the economy, privacy groups say it's unlikely that laws will change anytime soon. But they -- and regulators -- are pressuring Google to provide leadership and set the example. "For a company with so much data, they have a responsibility to be innovative, proactive and pro-consumer in the area of privacy," Dixon argues.
Parting with a certain amount of personal information is part of the bargain you strike when you sign up for free Web-based software and services. "People should have visibility into what information is being collected and how it will be used, and they should get to choose what they share and control who can access it," says Fleischer.
But the tension between your desire for privacy and Google's need for flexibility in handling your data is likely to be an ongoing dance. "Google's business is to make money from the information it gathers from its users. It will always be a give-and-take," says Bankston.
Eventually, updated privacy laws -- and the choices users make -- will delineate what is acceptable and what is not. "Our business model depends completely on user trust," says Yang. Part of Google's challenge is to build that trust without severely restricting the business's ability to innovate.
Google has done a good job on the trust side, Bankston says. He just wants to see it give users more transparency and control. "We don't want Google to stop innovating," he says. "We just want the law to keep up so that this data is safe."