Use information to provide our users with valuable products and services.

Develop products that reflect strong privacy standards and practices.

Make the collection of personal information transparent.

Give users meaningful choices to protect their privacy.

Be a responsible steward of the information we hold.

The principles are further explained in a video on the Google Blog (interestingly posted by an engineer, not one of Google’s legal/policy folks).

I like these principles; they are something every organization should commit to and strive for. The problem is, Google hasn’t adhered to them quite as closely as they’d want you to believe. Let’s consider each:

1. Use information to provide our users with valuable products and services. This isn’t so much a privacy principle as it is a disclaimer for what Google purports to do with all the data it collects about its millions of users. Google tracks what we do in order to know whether our search for “Paris Hilton” is about the blond or the hotel. This principle merely presents the value proposition for Google’s potential violation of user privacy.

2. Develop products that reflect strong privacy standards and practices. A very important goal, but the product featured in Google’s video, off-the-record chats in iChat, isn’t providing the kinds of privacy protections that most consumers or advocates clamor for. Certainly, being able to control (to an extent) whether my chats are logged is a way to protect my privacy, but what about IP logging or behavioral targeting? Perhaps Google doesn’t want to bring up its current data retention policies given Microsoft’s recent announcement. And perhaps it doesn’t want to actively promote one of its truly innovative privacy protecting product — the Google Advertising Cookie Opt-Out Plugin — since the more users who install the plugin, the less valuable its advertising platform becomes.

3. Make the collection of personal information transparent. Despite what Google claims about Dashboard, there remains an enormous lack of transparency regarding the collection of user information (Google Analytics comes immediately to mind). If Google was committed to transparency, it wouldn’t have resisted placing a link to its privacy policy on the homepage. If Google was committed to transparency, its behavioral targeting system would be opt-in and would provide a conspicuous link to “Ad Privacy Preferences”.

4. Give users meaningful choices to protect their privacy. Google touts the ability to report problems in Street View and the removal of one’s search history as examples of this principle. Of course, the Street View example has a horrid history, and removing your search history only removes it from that product’s interface, not from Google’s main server logs. That’s a limited choice, not a fully meaningful one.

5. Be a responsible steward of the information we hold. I have faith that Google is indeed being responsible with our information, and that it is keeping it secure. But while security is often necessary to ensure privacy, it certainly isn’t a sufficient condition, and the gaps in the preceding principles overshadow Google’s good stewardship.

In summary, I do give Google much credit for the steps they’ve taken in recent years to improve its privacy practices and communication. But too often its rhetoric is too self-congratulatory, and fails to recognize serious gaps in its approach to user privacy.

These principles are vital, and I hope Google continues to strive to meet them. There is much work still to be done.

Remember how hard we gad to fight to convince Google to include a link to its privacy policy on the Google.com homepage?

Remember how Google argued “we do believe that having very limited text on our home page is important” and that it was pitched as some great sacrifice to include the word “privacy” and disrupt the homepage’s aesthetics?

Remember how, just a month ago, Google argued that a “clean, minimalist approach” to their homepage gives users “just what they are looking for first and foremost” — thus only the search box appeared when you visit Google.com, with all the other content (including the privacy policy link) only fading in if you happen to move the mouse?

Apparently none of this is nearly as important as shilling promoting Google’s new phone, the Nexus One. If you visit Google.com today, you’ll notice everything faded out except a prominently placed Nexus One advertisement:

Move your mouse, and then everything else fades in (including yet another advertisement for Google Chrome, and an ugly one at that):

Yes, we’ve seen this kind of hypocrisy before…

UPDATE (1/7/2010): Google has now changed the way the homepage loads, with the Nexus One ad faded out and only appearing with the other content when the use moves the mouse. I’d be curious to see what kind of discussions led to the original design, and this revert.

[Minor update: crossed out "shilling", since it is Google's own phone]

Sometimes, however, that trust can be misplaced.

Recently, a student in one of my classes gave a presentation on Google, and proceeded to explain how Google ranks search results using an algorithm called…..PigeonRank:

Why Google’s patented PigeonRank™ works so well

PigeonRank’s success relies primarily on the superior trainability of the domestic pigeon (Columba livia) and its unique capacity to recognize objects regardless of spatial orientation. The common gray pigeon can easily distinguish among items displaying only the minutest differences, an ability that enables it to select relevant web sites from among thousands of similar pages.

By collecting flocks of pigeons in dense clusters, Google is able to process search queries at speeds superior to traditional search engines, which typically rely on birds of prey, brooding hens or slow-moving waterfowl to do their relevance rankings.

When a search query is submitted to Google, it is routed to a data coop where monitors flash result pages at blazing speeds. When a relevant result is observed by one of the pigeons in the cluster, it strikes a rubber-coated steel bar with its beak, which assigns the page a PigeonRank value of one. For each peck, the PigeonRank increases. Those pages receiving the most pecks, are returned at the top of the user’s results page with the other results displayed in pecking order.

PigeonRank, of course, is a hoax, part of Google’s 2002 April Fool’s Day joke. But how did my student fall for it in 2009?

Simple. He trusted Google.

The first result when you search Google for “How does Google work?” is a link and a blurb purported to describe precisely that:

My student clicked on the link, read, and digested the information. He trusted Google.

Sure, a bit more information literacy might have tipped him off that this was a joke, but, like many folks, he had no real clue how Google works and simply trusted the result. (At the bottom of the page is a disclaimer that it is just a hoax, but he must not have seen it.)

So, making this a teaching moment, we learn from this experience that:

1. Many people still do not understand how Google works.
2. Many people trust Google search results and believe that what appears first is the correct information.
3. We need to teach information literacy as a core competency for all students.
4. We need to think about whether Google has any kind of responsibility to ensure hoaxes (especially of its own making) are marked as such within Google results. (I’m not necessarily suggesting this, but it makes for a good classroom discussion)

UPDATE: The minds at Crooked Timber have a nice discussion of this episode…

UPDATE: This item has been picked up over at MetaFilter.

Aesthetically, this isn’t without its charm, and we all know how anal Google can be regarding the minimalist design of its homepage.

But it took so much effort to get Google to finally add a mere 7-letter hyperlink to its privacy policy on the homepage, it pains me to see it disappear again….

UPDATE: It has been suggested to me that having the privacy policy link “fade-in” might actually draw more attention to it than it simply being visible from the onset. That’s a testable hypothesis that I hope one of my quantitative-leaning colleagues might tackle.

Yet, the fact remains that in Google.com’s natural state, the link is invisible. A user can visit the site, simply start typing search terms, and click return to view the results. Thereby, preserving Google’s minimalist aesthetics, and keeping the links tucked out of view. That might be cool web design, but it is poor privacy compliance.

Speaking of, I wonder what the State of California will think about this, since it was California’s law requiring a privacy policy be “conspicuously” placed on a website’s homepage that finally compelled Google to add the link in the first place. If a user has to interact with a page in order to make the link visible, is that sufficiently conspicuous?

Last week, however, this all changed. Google announced two new “features” in Latitude: Location History and Location Alerts.

Location History allows users to opt-in to having Google keep a history of their locational data tracked by Latitude. Only you can see it, and you can remove items from your history, which is great. But for everyone who activates this service, there’s now a log in Mountain View of everywhere your cellphone has been, a log that could be shared with third parties in according with its privacy policy.

More people might activate Location History when they learn about Location Alerts, a service that notifies you if a friend happens to be nearby. The beauty of Location Alerts is that you won’t be altered when people are simply engaging in their routine activities (ie, you won’t be alerted every time your coworker sits down at their cubicle across from you) . Instead, it “learns” what users’ “normal” locations are, and only notifies friends if they are nearby in an unusual place or time. To make this work, you need to have Location History activated, and in the process, Google is able to create a type of “locational profile” for each user. It is unclear whether this profile might be used for other purposes (ie, targeted advertising).

Google, of course, realizes the privacy implications of all this, and again takes some steps to help mitigate these concerns. there are FAQs for each product detailing how they work and the privacy concerns; the services are op-in; users are reminded periodically when they have Location History activated (Google should do this for all products, btw).

But all this makes me wonder: did Google plan to provide these services from the start, just with a delay? Did Google learn the lessons of Facebook, who repeatedly bites off more than it can chew as it relates to users’ privacy, and decided to launch Latitude without these features, thereby winning the praises of privacy advocates (guilty), and then strategically add them 9 months later, claiming it is simply in response to user demand?

If my fears are true, it’s not quite what I had in mind when calling on Google to engage in value-conscious design in order to protect user privacy.

Remember how Google argued “we do believe that having very limited text on our home page is important” and that it was pitched as some great sacrifice to include the word “privacy” and disrupt the homepage’s aesthetics?

Apparently providing users easy access to information about their privacy is much more burdensome for Google than providing a link to where people can buy Verizon’s Droid mobile phone.

Today, Google.com features an advertising message that the Droid is now for sale, and includes a link to this page touting its benefits, and prompting users to buy it from Verizon.

Makes me long for the days when Sergey Brin and Lawrence Page proclaimed that advertising has no place in search engines:

Currently, the predominant business model for commercial search engines is advertising. The goals of the advertising business model do not always correspond to providing quality search to users. …It is clear that a search engine which was taking money for showing cellular phone ads would have difficulty justifying the page that our system returned to its paying advertisers. For this type of reason and historical experience with other media, we expect that advertising funded search engines will be inherently biased towards the advertisers and away from the needs of the consumers. …we believe the issue of advertising causes enough mixed incentives that it is crucial to have a competitive search engine that is transparent and in the academic realm.

And I wonder if there’s any chance the presence of Bert & Ernie could be seen as a product endorsement….

All this said, I was quite excited at the launch of Google Dashboard:

Google describes Dashboard as a simple way to view “the data associated with your account”, and that it will provide users “greater transparency and control over their own data.” Elsewhere, Dashboard has been described as a “big concession to users’ privacy rights“, as the answer to the question: “What does Google know about me?”, and as a place providing users “more control over the personal information stored in Google’s databases“.

Unfortunately, Google Dashboard is none of these things.

What Google Dashboard provides is a single place to browse the list of most of the Google services you’ve signed up for, quick links to their individual settings pages (including privacy settings & policies), summary statistics of your usage of these services, and indications of what details I’ve shared with others.

While this is a very convenient new interface, and a helpful reminder of some of the services and settings that I might have long forgotten were activated on my account, Dashboard isn’t providing any new transparency or new control over the data Google knows about me. I still only see that information Google wants to make available to me through its interfaces. I still only get to control the limited data Google allows me to control.

Sure, from the Dashboard I can go and look at my Web search history, for example (and this screenshot confirms that my TrackMeNot Firefox Extension is successfully sending ghost queries to Google!), and from there I can remove stored searches from the service. But remember, this is only removing the searches from the Web History service, not from Google’s primary search query logs (as Google acknowledges here). There is no new level of control over the personal information stored in Google’s databases. Simply convenience.

(And, FWIW, Dashboard could be made even more convenient if Google simply had a link to “Dashboard” in the upper right corner after you log in, rather than having to click Settings -> Google Account Settings -> View data stored with this account)

The convenience Dashboard provides is helpful. Users should be regularly reminded of what services they sign up for, what information is being collected, and what their current privacy settings are. And hopefully Facebook will follow Google’s lead and provide similar convenience. But, unfortunately, Google Dashboard is no concession to users’ privacy rights. A helpful step, but we still have a long road ahead of us.

UPDATE: Others agree with my assessment of Dashboard. ReadWriteWeb notes that “Google’s Privacy Dashboard Doesn’t Tell Us Anything We Didn’t Know Before”, while Mashable recognizes that “Dashboard is nothing more than a selected list of privacy-related settings”. And Fred Stutzman correctly observes in the comments below that “By creating this interface, Google gets to functionally define the “sense” of information collection/retention. That is, their sense of the boundaries of collection will be informed by the interface. But…this interface minimizes the true extent of data retention.” Indeed.

In July 2009, Google posted a brief FAQ regarding privacy and Book Search, promising that the services provided under the Settlement will be bound by its general Privacy Policy, that it will only share aggregate usage data with the Book Rights Registry, that Google Accounts will not be required to access the services (although there will be some access limits for those who don’t login).

To most, including myself, this FAQ failed to sufficiently quell concerns over GBS’s impact on intellectual privacy and the freedom to read anonymously.

At the “Google Books Settlement and the Future of Information Access” conference organized by the UC-Berkeley Information School, I joined other advocates in calling on Google to be more forthright about the privacy concerns — and need for more specific protections — related to the GBS settlement and proposed infrastructure for accessing digital books. Google has insisted, however, than a more detailed privacy policy was impossible to construct since the actual technology has not yet been developed. Google’s Privacy Counsel, Jane Horvath, noted this apparent obstacle in an August 31, 2009 letter to the FTC:

Because the settlement agreement has not yet been approved by the court, and the services authorized by the agreement have not been built or even designed yet, it is not possible to draft a final privacy policy that covers details of the settlement’s anticipated services and features.

Sharing the concern of privacy advocates, the FTC refused to fully accept Google’s deferment, and urged Google to publish a privacy policy outlining Google’s specific privacy commitments for the Book Search product:

[I]t is important for Google to develop a new privacy policy, specific to Google Books, that will apply to the current product, set forth commitments for future related services and features, and preserve commitments made in the existing privacy policy.

As Google develops its new privacy policy, we urge Google to focus in particular on appropriately limiting secondary uses of data collected through Google Books, including uses that would be contrary to reasonable consumer expectations.

So, upon receiving this demand from the FTC, Google did what it has previously said was impossible: it published a Privacy Policy for Google Books.

:::

In announcing the publication of this privacy policy, Google notes that “Google Books has always been covered by the general Privacy Policy for all of Google’s services”, and in the policy itself it is stated that “Any publicly available product authorized by the settlement will have a privacy policy comparable to policies you can see in our Privacy Center today for other Google products.” While this sounds comforting, it is the very fact that Google intends to treat Book Search records with the same (and in many ways, limited) privacy protections as its other products that causes much of the concern.

As I noted in my remarks at the Berkeley event, there are particular expectations of privacy when it comes to seeking information in a library setting. The context of the library brings with it specific norms of information flow regarding patron activity, including a professional commitment to patron privacy. But the insertion of Google into this context raises an alarm, and merely promising that the same privacy standards of Web searching will apply is insufficient. Here’s why:

Searching for information on the World Wide Web was a new experience for most everyone. It was a new frontier of information-seeking, which developed its own business model, its own technical infrastructure, and its own technical standards and best practices, ones that rely heavily on the tracking and capturing of user data. Google has gone to some lengths to explain how & why it must track and collect user data for Web searches. Many people accept this as the norm for Web searchers: in order to benefit from what companies like Google have created, we need to acquiesce to this kind of tracking of our search activity. Yes, Google promises not to give to other people except in specific circumstances, but in general, people know and accept that Google can see what they’re searching for, and they keep and use that data for a variety of purposes. For most, that’s just the way the Web works.

But the context of the library is altogether different. In the library, users intellectual activities are protected by decades of established norms and practices intended to preserve patron privacy and confidentiality, most stemming from the ALA’s Library Bill of Rights and related interpretations. As a matter of professional ethics, most libraries protect patron privacy by engaging in limited tracking of user activities, having short-term data retention policies (many libraries actually delete the record that you ever borrowed a book once it is returned), and generally enable the anonymous browsing of materials (you can walk into a public library, read all day, and walk out, and there is no systematic method of tracking who you are or what you’ve read). These are the norms of the library.

With the proposed GBS settlement, we are talking about the de facto transfer of library practices (reading a book) to a Web-based infrastructure powered by Google (searching the Web). It will be reasonable to expect the same informational norms that exist in the library settings – limited tracking, short-term data retention, possibilities of anonymous browsing – to translate into the proposed digital system for browsing books. If these are the expected norms of information flow, we must ensure they are respected by any system designed for browsing digitized books. In short, the system must be conceived as an extension of the library – with its informational norms in tow – and not an extension of Google, burdened with its standard practice of gathering user information.

Unfortunately, the fact that Google repeats that Google Books will follow the same privacy policy of general Web searching means the norms of data collection of the Web will likely prevail over the norms of the library. All the reasons we are concerned about the privacy of our Web searches are now amplified with the possible emergence of a large-scale infrastructure to track and monitor book searches. This is part of why most advocates where disappointed with the privacy policy released by Google.

:::

That said, there is one hopeful difference in the privacy commitment laid out by Google. Google notes the existence of special protections, in some jurisdictions, protecting the the privacy of people’s activities in libraries:

Special legal privacy protections for users may apply in cases where law enforcement or civil litigants ask Google for information about what books an individual user has looked at. Some jurisdictions have special “books laws” saying that this information is not available unless the person asking for it meets a special, high standard – such as proving to a court that there is a compelling need for the information, and that this need outweighs the reader’s interest in reading anonymously under the United States First Amendment or other applicable laws.

This is an important recognition of how people’s actions in the library setting often deserve special protections (something I wish Google would recognize with all information-seeking activities). In response Google promises that (emphasis added): “Where these “books laws” exist and apply to Google Books, we will raise them.” Quite honestly, I don’t know what Google means by stating it will “raise them”. The most basic reading of this statement means that if the law exists, then Google will bring that law to the Court’s attention (as if the Court wouldn’t have already addressed it?). That’s not the same as a promise to require warrants, challenge subpoenas, or otherwise require compliance with these laws.

Perhaps I’m wordsmithing, but this is such an important issue, Google should be more precise in their intentions (which was the whole point of demanding this policy in the first place). Further, this seems to be yet another case where Google is thinking like lawyers about privacy, suggesting that “there are some laws that might protect readers’ privacy, and we’ll “raise them” when appropriate.” But it seems to be only the existence of such laws that prompts Google’s additional attention to the uniqueness of intellectual privacy.

What Google needs to do is think like a librarian, and do whatever it takes to ensure readers’ privacy and confidentiality is protected, regardless of what the law requires.

More recently, Samuelson has questioned whether the Authors Guild and AAP fairly represented the interests of all authors and publishers during the negotiations that led up to the settlement agreement. She notes:

The Authors Guild has about 8000 members. OCLC has estimated that there are 22 million authors of books published in the U.S. since 1923 (the year before which books can be presumed to be in the public domain).

Along with this disparity is the fact that not all authors write and publish with the same motivations. Compare academic authors, who often write with the hopes of spreading knowledge (with little to no direct compensation), versus many traditional authors who hope to provide an escape or entertainment for profit (both worthy goals, btw). As Samuelson noted on NPR earlier this week:

University of California law professor Pamela Samuelson says the Authors Guild doesn’t represent the interests of academic authors, either. Samuelson doesn’t want money for her work — she just wants people to see it.

“[The Authors Guild doesn't] share the academic values that I think would lead people like me to prefer and want to maximize public access rather than maximize revenues,” she says.

This is a very important concern: the settlement agreement, as negotiated, does not sufficiently represent my needs and concerns as an academic author. Access to knowledge is paramont; profit is secondary.

Because of this, I’ve joined other academic authors in signing a letter to the judge ruling on the proposed settlement, penned by Dr. Samuelson, that outlines this significant fault in the settlement agreement.

While acknowledging that the Google Book Search project potentially represents “extraordinarily valuable public good with the aim of greatly enhancing public access to the knowledge”, the letter expresses that “If approved, the settlement will fundamentally transform the cultural ecology of public access to books; yet, we fear that this may not be in entirely beneficial ways.”

Specifically, the letter discusses three primary concerns about the proposed settlement that are “unfair to academic authors and researchers or pose serious risks for harm to academic author and researcher interests”:

1. The overarching concern that neither the Authors Guild nor the individual plaintiff-authors in the Authors Guild v. Google case have fairly and adequately represented the interests of academic authors during the litigation or in the course of negotiations that led up to the proposed settlement.
2. The general opacity of the settlement agreement, and the parties’ intentions with respect to it, that have made it difficult for many authors, especially academic authors, to make well-informed decisions about how to respond to it.
3. Concern that the Settlement Agreement is private legislation in the guise of a class action settlement.

The closing paragraph aptly sums up the tenor of the entire document:

Whatever the outcome of the fairness hearing, we believe strongly that the public good is served by the existence of digital repositories of books, such as the GBS corpus.  It would just be better for Google not to have a monopoly on it.  The future of public access to the cultural heritage of mankind embodied in books is too important to leave in the hands of one company and one registry that will have a de facto monopoly over a huge corpus of digital books and rights in them.  Google has yet to accept that its creation of this substantial a public good brings with it public trust responsibilities that go well beyond its corporate slogan about not being evil.

I speak last on a panel of esteemed experts, including Angela Maycock, Office for Intellectual Freedom, American Library Association; Tom Leonard, University Librarian, UC Berkeley; and Jason Schultz, Associate Director of the Samuelson Law, Technology & Public Policy Clinic at U.C. Berkeley School of Law; fellow, Electronic Frontier Foundation.

They will certainly cover all the important terrain, so my remarks will focus on my desire to trust Google when they say they’re “thinking hard” about these issues and promise to “protect readers’ privacy rights”, while noting their track record is reason enough to cause us some pause, and is why we’re pushing so hard as advocates on these vital concerns.

I will also suggest a few tactics they can take to engage in the ethical-design of the proposed service, and will close with a call for coders to help develop a version of TrackMeNot for Book Search, thereby giving some power back to the users to obfuscate their book search activities.

A rough draft of my remarks are here, and a pdf of my slides are here.

You can follow the tweet stream for the conference at #gbsfia.

UPDATE: PCWorld has some coverage of our panel discussion: “Privacy Missing From Google Books Settlement”, which was also picked up by the New York Times.

YouTube video of the panel presentation is here.