No, You Don’t Need To Fear The Google Privacy Changes: A Reality Check
There are good reasons why the mess that Google currently finds itself in, surrounded by FUD — fear, uncertainty and doubt — is something the company could have avoided. I covered that in my second article on the changes.
Now, it’s time to put the reality check front-and-center, for the potentially concerned customer out there.
Google’s Doing What Others Like Microsoft Do
Perhaps one of the most jaw-dropping things I saw in the wake of the new changes was the Washington Post’s initial story, with a big scary-sounding headline: Google announces privacy changes across products; users can’t opt out.
Ouch. Can’t opt-out. No way to stop the big G from doing whatever it wants to you. Bend over, and can I have another, sir?
Consider if you want to sign-up for Hotmail, Microsoft’s rival to Google’s Gmail:
That’s the sign-up screen for Hotmail. Note the arrows at the bottom. The first one points to text that says:
One Windows Live ID gets you into Hotmail, Messenger, Xbox LIVE—and other Microsoft services
Sharing Seems An Industry Practice
In order to offer you a more consistent and personalized experience in your interactions with Microsoft, information collected through one Microsoft service may be combined with information obtained through other Microsoft services.
Microsoft is out today with a new blog post, this time slamming Google’s Gmail service, pushing the idea that if you don’t want cross-sharing to happen, your only options might be to:
- Use separate browsers to segregate your communications, social, and video log-ins
- Sign in and out of your accounts throughout the day to de-couple specific activities as needed.
By signing in on one Microsoft site or service, you may be automatically signed into other Microsoft sites and services that use Windows Live ID.
What? I just wanted to check my email, and you signed me into Bing Videos! Is that so Microsoft can more easily combine my information between services, you know, all Google-style?
The Incredible Lightness Of Privacy Policies
Who knows. As I keep reading through these privacy policies at Google and Microsoft, aside from trying to stay awake and and trying to piece through the unfamiliar terms, I still come away with three main thoughts:
- The don’t seem that different in general
- They lack a “Bill of Rights” of what they will not do
- They mean little without a corresponding comprehensive control panel allowing users to limit how data is collected or used
A Journey To Understand If Search “Remarketing” Is Happening
Does the new policy allow Google to use my search history as a way to target ads to me as I surf the web? In other words, if I search for “mortgages” when logged-in on Google, can advertisers target me so that if I’m on non-Google web sites — but web sites that carry Google ads — I might see ads about mortgages?
The policy actually says it won’t do this, but you only know that if you understand a great deal about how Google works. It’s this section:
We will not combine DoubleClick cookie information with personally identifiable information unless we have your opt-in consent.
You have to understand that the DoubleClick cookie is something that Google says is used to do “interest-based” advertising that might allow for the search history targeting scenario that I’ve described above.
Google’s existing ads policy is actually pretty detailed about the DoubleClick cookie, but all that detail seems to be disappearing as part of the move to have a simplier and supposedly easier-to-understand master policy.
So much for that.
The Journey Continues Into Non-Search Remarketing
Even the existing Google ad policy makes no mention of “remarketing.” Also called retargeting, this is how Google advertisers can already follow people around across the web with ads.
This isn’t done based on what you searched for. Rather, it’s a way for an advertiser who saw you come to their site to tag you with an anonymous cookie, so that the advertiser can start showing you their ads when you go to other sites in Google’s ad network. Others ad networks allow the same, including Microsoft, to my understanding.
What else might they do? Turning to the Google Dashboard for a button to disable remarketing isn’t much help. There’s nothing like this listed there. There is a section that lists my recent “web history” — which really means my search history — and a link that says “Remove items or clear Web History.”
Hunt For The Opt-Out
That link is actually a potential opt-out option. You know, an opt-out like the Washington Post told you that you can’t do? Because if I click on that link, I can actually turn off my web history (well, put it on pause) if it was enabled (not that the link tells you this). And if I pause it (and clear anything already gathered), all those worries about what Google might now be able to do with my past searches? Poof. I have no past searches.
But phew. That was exhausting. Shouldn’t there be an easier way for me to make sure I’m not having my searches linked to retargeting? Potentially, there is. You see, Google uses an industry-standard way to flag controls around its ads. Look here:
That’s a real ad, which I know was targeted to me, because I’ve recently been looking for Mac repair (seriously, Apple, two logic board failures on my son’s MacBook? I know it’s old, but two?). See the arrow pointing to that weird triangle icon. If you clicked on that, you’d get to this page, telling you that’s the AdChoices icon:
While Google often shows you ads based on the content of the page you are viewing, we also show some ads based on the types of websites you visit, view, or where you interact with an ad or other Google product supported by Google’s advertising services.
In doing this, Google doesn’t know your name or any other personal information about you. Google simply recognizes the number stored in your browser on the DoubleClick cookie, and shows ads related to the interest and inferred demographic categories associated with that cookie.
See that arrow? It’s pointing to the link you have to use to turn off personalized advertising. Big giant buttons to “Try AdSense” or “Try AdWords” and a little whisper, “or opt-out of personalized advertising.”
When you go to that page, you don’t even get the opt-out button. No, that’s still another click away:
By default, if you have a profile that’s been formed, you’re shown what Google believes you’re interested in as well as your assumed age and gender.
Side Note: What Google Clearly Doesn’t Know About You
People have been having good fun poking at Google about that, but it ought to be reassuring to anyone who fears the Google data monster. It shows that this is an anonymous profile not linked with your personal profile, where unless you outright lied, Google knows your real age and gender.
It also shows, by the way, exactly what many television networks would get wrong about you when you tune into a show. Believe me, with all the tampon ads I seem to get in association with my shows, I’m pretty sure there are advertisers who think I’m a woman.
There’s The Opt-Out!
But yes, if I click on that opt-out link, finally I can find a way to opt-out of that remarketing:
Let’s Talk Privacy Controls
That’s been my frustration with all this, that you’d think Google would have known better. That you think they’d have learned from the lessons that Facebook learned in 2010 and figure out better overall privacy controls. Consider what I get over at Facebook:
That dashboard isn’t perfect. It does seem to have improved since I wrote my Drill (Down), Baby, Drill: Facebook’s New “Simple” Privacy Settings Still Pretty Complex story in 2010. Still, if you dare to drill down into specifics, it can be pretty overwhelming.
What Google needs is that type of privacy controls dashboard, only better. Microsoft seems to need one too, by the way. That’s because everything I just went through with Google above? I have to do the same thing with Microsoft (even though it does have a basic dashboard of its own, here).
Microsoft Takes You On A Journey, Too
With Microsoft, I have to:
- Read the Microsoft Online Privacy Statement, which tells me to…
- Read to read the Microsoft Advertising Privacy Supplement
There, I learn that Microsoft does seem to have the right to use my search history to target me with ads as I surf the web. Whether Microsoft actually does this, I can’t tell. But I can opt-out using a page similar to what Google has, or I can clear my search history at Microsoft similar to how I can do it at Google.
- Potentially share what you do at YouTube with other Google products
- Potentially use your search history with other Google products
If those absolutely freak you out, Microsoft stands-by ready to let you search and watch videos there. Of course, as best I can tell, Microsoft already has all the same rights that Google is now granting for itself.
That means, in the end, it’s more about whether you trust Google and Microsoft to begin with, rather than what their broadly-worded privacy policies seem to allow. So if you already trust Google to begin with, you’re probably fine.
Google’s Users Seem Relaxed
Certainly, Google’s existing users don’t seem to be concerned. Look here:
But The PR Stumble Is Real
That doesn’t mean this entire thing hasn’t been a big problem for Google. While its existing users will likely plod along more annoyed by all the privacy notices they’re getting rather than the changes, the broader tech and mainstream media space I’d say looks at the PR stumble here — on the heels of another PR stumble over Search Plus Your World — and loses a little faith.
That can inch into the mainstream of users, as I covered more in my Anti-Google Graffiti, Steve Martin Joke: Signs Perceptions Of Google Changing For Worse? story last week.
That’s a problem Microsoft is obviously trying to exploit — and hey, Microsoft does have a suite of products and services people may want to consider, not because they’re super-better on the privacy front (that’s debatable) but simply because they have good products as well.
For Google, the PR problem looks far, far worse than what I think is the case with its actual users. Those users, I suspect, either trust Google or simply don’t care. It’s another big company. What are you going to do?
Two Wishes: Bill Of Rights & Privacy Controls
I’ll end with two things I’d like to see emerge from all this:
- A data privacy Bill of Rights from individuals companies that clearly spells out in plain language what won’t be done with our data
- A centralized, easy-to-understand set of controls to limit how data can be collected and used
I’d like that from Google, Microsoft and any major company that collects data on individuals. You know, like those other nasty companies that members of the US Congress don’t seem to send letters to, credit card companies, credit bureaus and supermarkets with loyalty cards, to name some.
- Drill (Down), Baby, Drill: Facebook’s New “Simple” Privacy Settings Still Pretty Complex
- FAQ: What’s The Debate About Google’s Search Plus Your World?
- Anti-Google Graffiti, Steve Martin Joke: Signs Perceptions Of Google Changing For Worse?
- Microsoft Slams Google Privacy Changes With “Putting People First” Ad Campaign
- Google “Myth Busts” Microsoft’s Privacy Claims