Europeans To Ask Google To Change Unified Privacy Policy, Gain User Consent For Data Collection

Earlier this year, in March, Google consolidated more than 70 different privacy policies into a single more unified policy that allowed it to combine user data from all Google properties into a single view. Google argued that it represented privacy simplification for users (which was true). However it also benefited Google with more insight into its users’ activities on the Google network, the ability to deliver more personalized search results and presumably enabled better ad targeting.

The Europeans raised concerns about Google’s new privacy policy at the time and suggested that it might violate their privacy rules. Google went ahead and implemented the policy in Europe arguing the following when the new policy went into effect:

• Our approach to privacy has not changed.
• Google users continue to have choice and control.
• The privacy policy changes don’t affect our users’ existing privacy settings.
• We’re not collecting any new or additional data about users.
• We are not selling our users’ data.
• Our users can use as much or as little of Google as they want.
• We will continue to offer our data liberation tools.

Google said back in March (and today) that it was confident its unified privacy policy did not violate European regulations. However the French data protection agency CNIL is reportedly set to say just the opposite. It and other European countries will reportedly ask Google to roll back its privacy policy changes to their previously fragmented state. According to The Guardian, “[The CNIL] have determined that Google’s changes breached EU law because they did not give users any chance to opt out of the changes.”

The Europeans saw Google thumbing its nose at them by not delaying the implementation of the new privacy policy before they could study it carefully and request changes or modifications. Google argued there had been considerable time for that and went ahead anyway. This decision to some degree must be seen as “payback” (although that doesn’t entirely explain it).

The French, on behalf of the larger European Commission, opened a privacy investigation into Google’s new privacy policy as it went into effect in March. Google has been responding to questions and cooperating with the investigation. But according to The Guardian, there will be a press conference tomorrow to announce the decision to roll back the clock on Google’s privacy policy changes. That press event will feature data protection commissioners from multiple European countries.

Assuming The Guardian’s report is accurate, it’s not clear what recourse Google might have in the matter. It’s also not clear whether there are “structural” changes that Google would need to implement (or re-establish) to un-do the new system. Clearly there are global implications here — though I don’t believe US regulators would come to the same position as the Europeans, who have much stricter privacy laws. (See Postscript II below for more detail on the European request.)

We’ve reached out to Google for a statement and will update this post if one is provided. Below is a video produced by Google to explain the new privacy policy earlier this year.

Postscript: Microsoft has essentially implemented the same privacy policy changes as Google but nobody seemingly is raising any objections. One has to wonder whether the Europeans are too focused on Google or whether Microsoft is next to be investigated.

Postscript II: Reuters has some additional detail on what the Europeans will request. According to a letter obtained by the news agency:

Google must spell out its intentions and methods for combining data collected from its various services, and the web search giant must ask its users for explicit consent when bundling their data together, the regulators say in the letter sent to Google.

If this information is accurate it may not be as burdensome for Google to “roll back” its privacy policy changes. However obtaining “opt-in” explicit consent from European users may not be easy. Google will have to sell them on the benefits and not just of simplification of privacy policies. Most likely that would take the form of arguments about the benefits of search personalization and “more relevant” ads.