Google was able to coast through regulatory review in the US without any consideration of privacy, but Europe is a different matter:

Google spars with European lawmakers over privacy | Reuters

Mon Jan 21, 2008 1:54pm EST

By David Lawsky

BRUSSELS (Reuters) - Google attacked European parliamentarians and privacy advocates on Monday for trying to have competition authorities consider the handling of personal information in its $3.1 billion takeover of rival DoubleClick.

The argument was the centerpiece of a European Parliament hearing to consider the burgeoning role of the Internet in impinging on the privacy of citizens.

The U.S. Federal Trade Commission (FTC) signed off last month on Google's $3.1 billion deal, which combines its dominance in pay-per-click Internet advertising with DoubleClick's market-leading position in display ads.

After listening to a visiting FTC commissioner, U.S. and European privacy advocates and European parliamentarians question the impact of the deal on European citizens' on-line privacy, Google's global privacy counsel shot back.

"People (are) trying to take a privacy case and shoehorn it into a competition law review ... I can understand that people continue to peddle this theory in Europe after having lost in the United States," Peter Fleischer said. His attack did little to calm the waters.

"The reason you want to have the data is because it gives you a competitive advantage. It is business. I don't think they can be completely disconnected. And we should discuss that side of things too," said Sophie in 't Veld, the Dutch parliamentarian who sought the hearing.

She called information a competitive factor and declared: "Having that much information is market power."

Federal Trade Commissioner Pamela Harbour said her four colleagues at the FTC had taken a traditional approach and excluded questions of privacy in their decision. She dissented.

"I believe a traditional approach does not capture the interests of all the parties. There is no proxy for the consumer whose privacy is at stake," she said.

The European Commission has said it will not take privacy into consideration. In the past six years, it has not turned down any all-U.S. deal approved by U.S. authorities.

Fleischer, asked about the deal rationale, said Google wanted to get into banner advertising. He said his firm did not build dossiers on individuals through searches, instead using the words of each search to decide what ads to display with it.

Contractual limits would prevent Google from using DoubleClick information from individuals, he said.

Stavros Lambrinidis of Greece, who chaired the meeting, asked whether Google turned information over to government authorities.

Fleisher said that if authorities go "through a valid legal process we will respond to it".

(Editing by Dale Hudson)

Labels: doubleclick, europe, google, privacy

This past week, the US Federal Trade Commission gave the green light to the merger of Google and DoubleClick. As is highlighted in the official Google blog entry on the topic, privacy didn't play any part in the FTC's decision:

Official Google Blog: Analysis: The FTC clears our acquisition of DoubleClick

Privacy not a part of the merger review. Though we strongly believe in protecting our users' privacy, the FTC clearance decision reaffirmed the law by noting that privacy concerns played no role in its merger review. This is an important principle, as privacy issues need to be addressed on an industry-wide basis, and not on a company-by-company basis. The FTC wrote, "although such issues may present important policy questions for the Nation, the sole purpose of federal antitrust review of mergers and acquisitions is to identify and remedy transactions that harm competition. Not only does the Commission lack legal authority to require conditions to this merger that do not relate to antitrust, regulating the privacy requirements of just one company could itself pose a serious detriment to competition in this vast and rapidly evolving industry." The FTC also noted, however, "that the evidence does not support a conclusion" that this particular transaction will harm consumer privacy.

Data combination wouldn't pose problems. The FTC rejected the suggestion from competitors that Google would combine user information with DoubleClick's customers' data to obtain an advantage in the market, writing that the data is owned by DoubleClick’s customers and that "at bottom, the concerns raised by Google’s competitors regarding the integration of these two data sets -- should privacy concerns not prevent such integration -- really amount to a fear that the transaction will lead to Google offering a superior product to its customers." Moreover, "a number of Google’s competitors have at their disposal valuable stores of data not available to Google. For instance, Google’s most significant competitors in the ad intermediation market, Microsoft, Yahoo!, and Time Warner have access to their own unique data stores."

Labels: doubleclick, google, privacy

I was just browsing Google Inc.'s Form 10-K for 2006 and happend upon this little tidbit under "Risk Factors":

Google Form 10-K for 2006

Privacy concerns relating to our technology could damage our reputation and deter current and potential users from using our products and services.

From time to time, concerns have been expressed about whether our products and services compromise the privacy of users and others. Concerns about our practices with regard to the collection, use, disclosure or security of personal information or other privacy-related matters, even if unfounded, could damage our reputation and operating results. While we strive to comply with all applicable data protection laws and regulations, as well as our own posted privacy policies, any failure or perceived failure to comply may result in proceedings or actions against us by government entities or others, which could potentially have an adverse affect on our business.

In addition, as nearly all of our products and services are web based, the amount of data we store for our users on our servers (including personal information) has been increasing. Any systems failure or compromise of our security that results in the release of our users’ data could seriously limit the adoption of our products and services as well as harm our reputation and brand and, therefore, our business. We may also need to expend significant resources to protect against security breaches. The risk that these types of events could seriously harm our business is likely to increase as we expand the number of web based products and services we offer as well as increase the number of countries where we operate.

A large number of legislative proposals pending before the United States Congress, various state legislative bodies and foreign governments concern data protection. In addition, the interpretation and application of data protection laws in Europe and elsewhere are still uncertain and in flux. It is possible that these laws may be interpreted and applied in a manner that is inconsistent with our data practices. If so, in addition to the possibility of fines, this could result in an order requiring that we change our data practices, which could have a material effect on our business. Complying with these various laws could cause us to incur substantial costs or require us to change our business practices in a manner adverse to our business.

Just for fun, I thought I'd check out the 10-K's for Yahoo and DoubleClick.

Yahoo Inc. Form 10-K for 2006

Changes in regulations or user concerns regarding privacy and protection of user data could adversely affect our business.

Federal, state, foreign and international laws and regulations may govern the collection, use, retention, sharing and security of data that we receive from our users and partners. In addition, we have and post on our website our own privacy policies and practices concerning the collection, use and disclosure of user data. Any failure, or perceived failure, by us to comply with our posted privacy policies or with any data-related consent orders, Federal Trade Commission requirements or other federal, state or international privacy-related laws and regulations could result in proceedings or actions against us by governmental entities or others, which could potentially have an adverse effect on our business.

Further, failure or perceived failure to comply with our policies or applicable requirements related to the collection, use, sharing or security of personal information or other privacy-related matters could result in a loss of user confidence in us, damage to the Yahoo! brands, and ultimately in a loss of users, partners or advertisers, which could adversely affect our business.

A large number of legislative proposals pending before the United States Congress, various state legislative bodies and foreign governments concern data privacy and retention issues related to our business. It is not possible to predict whether or when such legislation may be adopted. Certain proposals, if adopted, could impose requirements that may result in a decrease in our user registrations and revenues. In addition, the interpretation and application of user data protection laws are in a state of flux. These laws may be interpreted and applied inconsistently from country to country and inconsistently with our current data protection policies and practices. Complying with these varying international requirements could cause us to incur substantial costs or require us to change our business practices in a manner adverse to our business.

Doubleclick Form 10-K for 2006

Privacy and Data Protection

We continue to be a leader in promoting consumers’ privacy and understanding the technologies that our clients, marketers, advertising agencies and data companies use to communicate with their existing customers and to acquire new customers. Our Chief Privacy Officer leads our privacy and data protection efforts. Our privacy team focuses on ensuring that we are effectively implementing our privacy policies and procedures and works with our clients to institute and improve their privacy procedures, while helping them to educate their customers about the privacy issues applicable to them. In addition, our privacy team actively participates in a number of industry privacy organizations.

....

Our business may be materially adversely affected by lawsuits related to privacy, data protection and our business practices.

We have been a defendant in several lawsuits and governmental inquiries by the Federal Trade Commission and the attorneys general of several states alleging, among other things, that we unlawfully obtain and use Internet users’ personal information and that our use of ad serving “cookies” violates various laws. Cookies are small pieces of data that are recorded on the computers of Internet users. Although the last of these particular matters was resolved in 2002, we may in the future be subject to additional claims or regulatory inquiries with respect to our business practices. Class action litigation and regulatory inquiries of these types are often expensive and time consuming and their outcome may be uncertain.

Any additional claims or regulatory inquiries, whether successful or not, could require us to devote significant amounts of monetary or human resources to defend ourselves and could harm our reputation. We may need to spend significant amounts on our legal defense, senior management may be required to divert their attention from other portions of our business, new product launches may be deferred or canceled as a result of any proceedings, and we may be required to make changes to our present and planned products or services, any of which could materially and adversely affect our business, financial condition and results of operations. If, as a result of any proceedings, a judgment is rendered or a decree is entered against us, it may materially and adversely affect our business, financial condition and results of operations and harm our reputation.

All three seem relatively boilerplate-ish, but what's interesting is that none of the 10-Ks go to any length to discuss how privacy and customer trust might be a real driver for their brands. Privacy and trust are taken for granted. Some dicussion elsewhere in each document includes privacy as part of their brands, but it is mainly in the context of risks to those brands.

Labels: doubleclick, google, privacy, retention

The latest developments in internet advertising are getting some pretty close scrutiny. I've posted before about concerns over the proposed Google / DoubleClick merger (see: Google at the bottom of online privacy rankings FTC probes Google / Doubleclick merger, Google is watching you. No surpise, but privacy regulators are ..., Google-DoubleClick deal under privacy fire, Google Buys DoubleClick for $3.1 Billion)

The buzz on this proposed deal continues:

• Google's DoubleClick deal runs into consumer resistance Guardian Unlimited
• European organizations worry about results of GoogleClick deal DM News
• Google-DoubleClick Deal Draws Criticism TIME

And now, not to be outdone, Yahoo! is introducing a new search technology that relies more on the information that the company has collected about users. No surprise that the scheme is receiving a sceptical reception from privacy advocates. See: ABC News: Yahoo's New Ad Program Gets Personal.

Be sure to also read Michael Zimmer's take on this: michaelzimmer.org » Archives » With SmartAds, Yahoo Finally Joins Google…as a Threat to Privacy.

Labels: doubleclick, google, privacy

Michel-Adrien Sheppard, aka Libray Boy, is linking to a new report by Privacy International that ranks the privacy practices of online companies. What's most interesting is that Google is at the bottom and merits special mention:

A Race to the Bottom - Privacy Ranking of Internet Service Companies

Why Google?

We are aware that the decision to place Google at the bottom of the ranking is likely to be controversial, but throughout our research we have found numerous deficiencies and hostilities in Google's approach to privacy that go well beyond those of other organizations. While a number of companies share some of these negative elements, none comes close to achieving status as an endemic threat to privacy. This is in part due to the diversity and specificity of Google's product range and the ability of the company to share extracted data between these tools, and in part it is due to Google's market dominance and the sheer size of its user base. Google's status in the ranking is also due to its aggressive use of invasive or potentially invasive technologies and techniques.

The view that Google "opens up" information through a range of attractive and advanced tools does not exempt the company from demonstrating responsible leadership in privacy. Google's increasing ability to deep-drill into the minutiae of a user's life and lifestyle choices must in our view be coupled with well defined and mature user controls and an equally mature privacy outlook. Neither of these elements has been demonstrated. Rather, we have witnessed an attitude to privacy within Google that at its most blatant is hostile, and at its most benign is ambivalent. These dynamics do not pervade other major players such as Microsoft or eBay, both of which have made notable improvements to the corporate ethos on privacy issues.

In the closing days of our research we received a copy of supplemental material relating to a complaint to the Federal Trade Commission concerning the pending merger between Google and DoubleClick. This material, submitted by the Electronic Privacy Information Center (EPIC) and coupled with a submission to the FTC from the New York State Consumer Protection Board, provided additional weight for our assessment that Google has created the most onerous privacy environment on the Internet. The Board expressed concern that these profiles expose consumers to the risk of disclosure of their data to third-parties, as well as public disclosure as evidence in litigation or through data breaches. The EPIC submission set out a detailed analysis of Google's existing data practices, most of which fell well short of the standard that consumers might expect. During the course of our research the Article 29 Working Group of European privacy regulators also expressed concern at the scale of Google's activities, and requested detailed information from the company.

In summary, Google's specific privacy failures include, but are by no means limited to:

• Google account holders that regularly use even a few of Google's services must accept that the company retains a large quantity of information about that user, often for an unstated or indefinite length of time, without clear limitation on subsequent use or disclosure, and without an opportunity to delete or withdraw personal data even if the user wishes to terminate the service.
• Google maintains records of all search strings and the associated IP-addresses and time stamps for at least 18 to 24 months and does not provide users with an expungement option. While it is true that many US based companies have not yet established a time frame for retention, there is a prevailing view amongst privacy experts that 18 to 24 months is unacceptable, and possibly unlawful in many parts of the world.
• Google has access to additional personal information, including hobbies, employment, address, and phone number, contained within user profiles in Orkut. Google often maintains these records even after a user has deleted his profile or removed information from Orkut.
• Google collects all search results entered through Google Toolbar and identifies all Google Toolbar users with a unique cookie that allows Google to track the user's web movement.17 Google does not indicate how long the information collected through Google Toolbar is retained, nor does it offer users a data expungement option in connection with the service.
• Google fails to follow generally accepted privacy practices such as the OECD Privacy Guidelines and elements of EU data protection law. As detailed in the EPIC complaint, Google also fails to adopted additional privacy provisions with respect to specific Google services.
• Google logs search queries in a manner that makes them personally identifiable but fails to provide users with the ability to edit or otherwise expunge records of their previous searches.
• Google fails to give users access to log information generated through their interaction with Google Maps, Google Video, Google Talk, Google Reader, Blogger and other services.

Labels: doubleclick, google, privacy, retention

According to the New York Times, the US Federal Trade Commission has begun an inquiry into the planned acquisition of Doubleclick by Google: Google Deal Said to Bring U.S. Scrutiny - New York Times:

Privacy groups said it was significant that the F.T.C., the agency that monitors online privacy issues, would be conducting the review.

“We think it’s very important that the F.T.C. is taking a look at the Google-DoubleClick deal,” said Marc Rotenberg, executive director of the Electronic Privacy Information Center, a privacy rights group.

In the days after the planned merger was announced, Mr. Rotenberg’s center and two other advocacy groups, the Center for Digital Democracy and the United States Public Interest Research Group, filed a request for the F.T.C. to investigate the privacy implications.

In the complaint, the groups noted that Google collects the search histories of its users, while DoubleClick tracks what Web sites people visit. The merger, according to their complaint, would “give one company access to more information about the Internet activities of consumers than any other company in the world.”

Google has built a lucrative business in selling small text ads that appear alongside its search results and on other Web sites. DoubleClick is the leader among companies that specialize in placing graphical and video ads online.

Jeff Chester, executive director of the Center for Digital Democracy, said that decisions made now about the structure of the online advertising industry could have lasting effects on data collection and personal privacy on the Internet, especially if control rests with a “few powerful gatekeepers” led by Google.

Still, privacy issues are not typically the concern of antitrust officials. In reviewing a proposed merger, legal experts say, regulators weigh the likely impact on competition and struggle with tricky technical matters like defining the relevant market to measure.

Labels: doubleclick, google, privacy

From the Independent (UK):

Google is watching you - Independent Online Edition > Science & Technology

'Big Brother' row over plans for personal database

By Robert Verkaik, Law Editor

Published: 24 May 2007

Google, the world's biggest search engine, is setting out to create the most comprehensive database of personal information ever assembled, one with the ability to tell people how to run their lives.

In a mission statement that raises the spectre of an internet Big Brother to rival Orwellian visions of the state, Google has revealed details of how it intends to organise and control the world's information.

The company's chief executive, Eric Schmidt, said during a visit to Britain this week: "The goal is to enable Google users to be able to ask the question such as 'What shall I do tomorrow?' and 'What job shall I take?'."

Speaking at a conference organised by Google, he said : "We are very early in the total information we have within Google. The algorithms [software] will get better and we will get better at personalisation."

Google's declaration of intent was publicised at the same time it emerged that the company had also invested £2m in a human genetics firm called 23andMe. The combination of genetic and internet profiling could prove a powerful tool in the battle for the greater understanding of the behaviour of an online service user.

...

Privacy protection campaigners are concerned that the trend towards sophisticated internet tracking and the collating of a giant database represents a real threat, by stealth, to civil liberties.

That concern has been reinforced by Google's $3.1bn bid for DoubleClick, a company that helps build a detailed picture of someone's behaviour by combining its records of web searches with the information from DoubleClick's "cookies", the software it places on users' machines to track which sites they visit.

The Independent has now learnt that the body representing Europe's data protection watchdogs has written to Google requesting more information about its information retention policy.

The multibillion-pound search engine has already said it plans to impose a limit on the period it keeps personal information.

A spokesman for the Information Commissioner's Office, the UK agency responsible for monitoring data legislation confirmed it had been part of the group of organisations, known as the Article 29 Working Group, which had written to Google.

It is understood the letter asked for more detail about Google's policy on the retention of data. Google says it will respond to the Article 29 request next month when it publishes a full response on its website.

The Information Commissioner's spokeswoman added: "I can't say what was in it only that it was written in response to Google's announcement that will hold information for no more than two years."

...

A spokeswoman for the Information Commissioner said that because of the voluntary nature of the information being targeted, the Information Commission had no plans to take any action against the databases.

Peter Fleischer, Google's global privacy Ccunsel, said the company intended only doing w hat its customers wanted it to do. He said Mr Schmidt was talking about products such as iGoogle, where users volunteer to let Google use their web histories. "This is about personalised searches, where our goal is to use information to provide the best possible search for the user. If the user doesn't want information held by us, then that's fine. We are not trying to build a giant library of personalised information. All we are doing is trying to make the best computer guess of what it is you are searching for."

Privacy protection experts have argued that law enforcement agents - in certain circumstances - can compel search engines and internet service providers to surrender information. One said: "The danger here is that it doesn't matter what search engines say their policy is because it can be overridden by national laws."

Labels: doubleclick, google, privacy, retention

According to Computer Business Review online, three advocacy groups, including EPIC, have made represenations to the Federal Trade Commission to block Google's acquisition of DoubleClick on consumer privacy grounds. See: Google-DoubleClick deal under privacy fire - CBRonline.com.

CBR also thinks this is a good time for Google to get its privacy ducks in a row:

Our View

While the privacy groups' goals are noble, the arguments in their complaint as they relate to the acquisition itself are rather weak, and we can't help but think that DoubleClick deal is just being seized as an opportunity to pressure Google into adopting better privacy practices.

Google is already big enough, and its privacy practices sufficiently slanted away from the end user, that it could use privacy reform whether it gets to buy DoubleClick or not.

A commitment to "anonymize" search data after two years storage is as good as no commitment at all. The company will still know which IP address and cookie has searched for what terms for the last two years.

What is needed from Google is a method by which users can opt out of having their queries logged, period. DoubleClick has had an opt-out feature for years. Google could simply lay an opt-out cookie on users' machines, and refuse to log any queries associated with that cookie.

This would very likely make the privacy criticisms go away.

The Financial Times has some further info on how Google is proposing to respond to this:

FT.com / Home UK / UK - Google promises to tackle fears over privacy

Google promises to tackle fears over privacy

By Richard Waters

Published: April 22 2007 22:24 | Last updated: April 22 2007 22:24

Google is developing technology to try to appease critics who complain that its proposed acquisition of DoubleClick will lead to an erosion of online privacy, according to Eric Schmidt, its chief executive.

Speaking in an interview, he also promised changes in the internet company’s policies, saying Google would do whatever was necessary to quell a rising tide of complaints about lack of privacy that began with news of its planned $3.1bn acquisition 10 days ago.

“At the end of the day, people will be happy,” said Mr Schmidt. “That’s because they have to be,” or Google would lose both users and advertisers and its business would be at risk, he said.

Fears have been stoked by the potential for Google to build up a detailed picture of someone’s behaviour by combining its records of web searches with the information from DoubleClick’s “cookies”, the software it places on users’ machines to track which sites they visit.

As the company that “serves”, or delivers, the majority of banner ads seen by web users, DoubleClick’s reach within its market is on a par with that of Google in the search business.

Mr Schmidt said Google was working on a way of handling “cookies” that would reduce concerns about the practice. The technology has long been controversial, because many internet users do not realise their surfing habits are tracked. Google has bowed to those concerns by not using cookies, though it has said it would change its policy after the DoubleClick acquisition.

“We have technology in that area that can make it much better,” Mr Schmidt said, though he refused to give details of the technique ahead of the company’s discussions with regulators.

Besides privacy groups, the DoubleClick deal has also stirred unease among advertisers and other online media companies over the competitive advantage Google would gain from the vast amount of information it would have about their businesses.

Mr Schmidt last week said that Google would consider arrangements to deal with those fears, such as keeping apart data about advertisers and media owners contained in Google and DoubleClick’s systems.

While stoking fears about loss of privacy, greater use of personal data collected online could have benefits, from enhancing the personalisation of services to helping fight terrorism, the Google chief executive said.

“These are the conflicts of our age,” he added. “We’re trying to find the right balance.”

Labels: doubleclick, google, ip address, privacy

This is an interesting development. (Google Buys DoubleClick for $3.1 Billion - New York Times)

As more and more online services that collect personal information amalgamate, it is important to ask questions about what happens when databases of personal information merge as part of the process. Google already has an advertising network which collects clickstream data, and holds terabytes of personal e-mail, photos, videos and documents. Its social networking site, Orkut, is slowly growing. Doubleclick, on the other hand, has been in the clickstream game longer and is itself no stranger to privacy controversey. (You may recall the fuss raised when it was suggested the DoubleClick may perform data matching with offline personal information.) What's going to happen to the databases?

This bears some close thinking about.

Labels: doubleclick, google, privacy

Virante, an internet marketing company, has made an interesting proposal to protect the privacy of search engine users. It suggests that users should be able to opt out of having their search tracked by IP address or cookie by appending "#privacy" to the search query. Here's the release from Virante:

Press Release - Search Engine Privacy Standard Proposed To Protect Users:

New website proposes a new search standard, #privacy, to protect user privacy when performing search engine queries.

/24-7PressRelease/ - DURHAM, NC, October 22, 2006 - With recent data leaks at AOL, governments seeking information from Google on its users, and no simple user privacy solutions available, a standard for empowering user search privacy has finally been proposed. PoundPrivacy.org is spearheading a search privacy revolution with its proposed #privacy standard. Our proposal is that the #privacy flag could be added to the end of searches by users to tell the search engine 'don't track this query.' In response, the search engine should not track the user by IP address or cookie, and the query should not be made public in keyword tools. The website carefully addresses the one exception to this capability - queries in which a crime is likely being committed (like the solicitation of child pornography) should be excluded from the #privacy flag.

PoundPrivacy.org contains an open letter addressed to the major four search engines - Google, Yahoo, Microsoft, and Ask - requesting that they adopt the #privacy standard. Additionally, the site offers ideas on ways individuals who agree with the standard can support the campaign, including blogging about it, linking to poundprivacy.org, and sending out emails to friends.

About Virante, Inc.

Virante, Inc., is a leading internet marketing solution provider. For more information please visit Virante Web Marketing Solutions or contact us at Email Virante, (919) 459-1088, 1-800-650-0820.

Also check out www.poundprivacy.org.

UPDATE: Adam over at Emergent Chaos thinks this is a silly idea and I must say I agree with just about everything he says, other than the bit about the goat. I'm sure they're not that expensive.

Emergent Chaos: A Very Silly Idea: #privacy, and poundprivacy.org:

"This is silly on a number of levels:

1. It propagates the simplistic 'opt-in/opt-out' thinking that the US marketing industry has been promulgating for decades. Look where that thinking has taken us.
2. It defaults all queries to opt-in, implied by absence of an opt-out. Privacy should be a default, and the 'right' way to implement this would be with #trackthis.
3. It will be prone to user error (typos) and forgetting. It offers no way to say, set a privacy cookie. Even Doubleclick does that.
4. Implementation is left as an exercise for the search engines, who are supposed to both magically not track your queries, and magically track them if you might be violating a law. (I say magically because I have some understanding of how web logs actually work.)
5. For some remarkable reason, no search engine has actually bothered to comment on the proposal. Certainly, no one has accepted it yet. So why am I blogging about it?
6. Really, this idea is one level above an idea I had at the pub last night. Unfortunately, as it turns out, goats are expensive, and probably won't walk on treadmills. It's a good thing I sobered up before setting up a web site."

Labels: aol, doubleclick, google, ip address, privacy

The recent controversey over subpoenas of high-profile search engines has spurred a lot of discussion about what search engines know about you. For example, John Battelle was able to get confirmation from Google of what a lot of people have probably always suspected:

1) "Given a list of search terms, can Google produce a list of people who searched for that term, identified by IP address and/or Google cookie value?"

2) "Given an IP address or Google cookie value, can Google produce a list of the terms searched by the user of that IP address or cookie value?"

I put these to Google. To its credit, it rapidly replied that the answer in both cases is "yes." Just FYI.

What else does Google know? Given that Google operates

• one of the most widely used advertising networks,
• one of the most widely used webmail services,
• one of the most widely used mapping services,
• one of the most widely used website statistics services,
• one of the most widely used browser toolbars,
• one of the most widely used news aggregators,
• one of the most widely used online group services,

they know a heck of a lot. Every time you visit a site that uses adwords, your computer connects to google and tells them what you're viewing and probably what got you there. And all this can be matched by your google cookie or your IP address.

The question is, other than for personalized services, why should a company maintain information that is personally identifiable? Why keep logs that have your ip address down to the last digit when the same value can be obtained from the data by only keeping the first three units (192.168.168.* compared to 192.168.168.111)? The level of trust that consumers have for companies like Google is eroding and businesses should take heed of this. If you don't need the information in personally identifiable form, don't keep it.

It will not be long before the cost of keeping this stuff is prohibitive if you have to spend valuable personel time responding to subpoenas. I can imagine the FBI or some other three-letter-agency having a form subpoena that will seek all the records from Google, Yahoo!, DoubleClick and others about the supposed "owner" of a suspicious IP address. What did you search for? What did you read? When were you online? All this info is mantained by a small handful of companies.

UPDATE: While you're thinking about this, check out Google's data minefield by Mark Rasch (via robhyndman.com).

Technorati tags: IP address :: privacy :: tracking :: logs :: retention :: personal information :: Google :: Search Engines

Labels: doubleclick, google, information breaches, ip address, law enforcement, privacy, retention

The New York Times is reporting that a private equity firm is about to buy DoubleClick, a company that has repeatedly been in the privacy crosshairs: The New York Times > Business > Equity Firm Is Set to Buy DoubleClick.

Labels: doubleclick, information breaches