States Challenge Google Privacy Policy Change

Attorneys General from 36 states are concerned over the potential implications of Google's new privacy policy, especially for government users and owners of Android-powered smartphones.

In a sharply-worded letter (download PDF) to Google CEO Larry Page, the officials questioned Google's commitment to consumer privacy and said the changes would force Internet users to share their data without giving them a proper ability to opt out.

The letter is the latest, and perhaps most dramatic, expression of concern stemming from Google's announcement that it would create a single privacy policy for all its online products. Under the new policy, scheduled to go into effect March 1, Google will combine user data from services like YouTube, Gmail and Google search and create a single merged profile for each user of its services. (See also "Google's New Privacy Policy: How to Stay off the Grid.").

Google said the new policy is shorter, easier to understand and will allow the company to deliver better and more targeted services for users of its products. The company also noted that users who do not like the new policy can simply stop using its services.

Policy Reversal Claimed

In their February 22 letter, the attorneys general said, "Google's new privacy policy goes against a respect for privacy that Google has carefully cultivated as a way to attract consumers. It rings hollow to call [the ability of users] to exit the Google products ecosystem a 'choice' in an Internet economy where the clear majority of all Internet users use -- and frequently rely on - at least one Google product on a regular basis."

The letter makes special mention of the potential problems the new privacy policy will have on Android-powered smartphone users, many of whom will find it "virtually impossible" to escape the policy without ditching their phones.

Privacy advocates have blasted the move and said that it will force users to share data about themselves that they may not want shared, given a proper choice. They have said that such data synthesizing will allow Google to look at everything a user does online and tie it back to specific individuals.

Some have noted that the user tracking and inference-making Google will be able to do once the data is merged is especially troublesome for government users of Google applications.

Many of those same concerns were echoed by the attorneys general in their letter to Page. Until now, users of different Google products expected that information provided for one service would not be combined with information provided for another, they said.

"Consumers have diverse interests and concerns, and may want the information in their Web History to be kept separate from the information they exchange via Gmail," the letter said. "Likewise, consumers may be comfortable with Google knowing their Search queries but not with it knowing their whereabouts."

Smartphone Security Issues

The state officials also focused on concerns by Android users.

Under the new privacy policy Google said it will collect device-specific information such as the phone model and operating system version, phone number, calling party number, time, date and duration of calls, SMS routing information and a user's location data. Google has also noted that the policy allows it to associate a device identifier or phone number to a user's Google account.

Android smartphone users who do not agree to the tracking would need to buy a new phone, the officials noted. "No doubt, many of these consumers bought an Android-powered phone in reliance on Google's existing privacy policy," which touts the ability of users to give their informed consent to privacy changes.

"That promise appears not to be honored by the new privacy policy." The attorneys general want a Google response by Feb. 29.

In e-mailed comments, a Google spokesman reiterated that the changes make Google's privacy policies easier to understand. He noted that the company has launched its most extensive notification effort ever to help consumers understand the changes. and downplayed concerns about Android-powered smartphones.

"Like our old privacy policy, our updated privacy policy affects users signed into their Google Accounts on Android phones in the same way as users signed into their Google Accounts on a desktop computer," the spokesman said. "We are not collecting any new or additional data about Android users in connection with this change."

Users can still use their Android phones to make calls and access certain Google applications such as search and Google Maps without having to sign into their Google account, he said. It's only for applications such as the Android market and Gmail that users will need to sign in, he said.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com.

See more by Jaikumar Vijayan on Computerworld.com .

Read more about privacy in Computerworld's Privacy Topic Center.

For comprehensive coverage of the Android ecosystem, visit Greenbot.com.

Subscribe to the Security Watch Newsletter

Comments