Comprehensive integration of consumer data may compromise privacy
BALTIMORE (February 22, 2012)—Attorney General Douglas F. Gansler today sent a letter to Google Chief Executive Officer Larry Page outlining multiple concerns regarding Google’s recently announced changes to its privacy policy and requesting a meeting with Mr. Page as soon as possible. 35 other states and territories joined in the letter. Google has been given a week to reply to the request.
The policy changes, scheduled to automatically take effect for all users of Google products and services on March 1, 2012, invade consumers’ privacy by unilaterally allowing Google to raid information it collects when a consumer uses one Google product and share it with all other service and products offered by Google. Individuals who allow Google access to certain information as part of using one service will now, whether they want to or not, be giving Google authority to use that information for all its services and products. Users who would like to use one Google product without allowing Google to access the information provided when they use another Google service will generally not be able to do so. The new policy also potentially heightens the risk of identity theft and fraud, since Google will now be storing far more comprehensive, consolidated personal information profiles.
“I am deeply concerned about Google’s effort to push a major privacy change on consumers without giving them the choice to opt in, or at a minimum the opportunity to opt out,” said Attorney General Gansler. “After years of touting its commitment to meaningful privacy choices for its users, Google should abide by its claimed privacy principles and let consumers decide whether to say ‘No thanks’ to a new policy.”
Under the new privacy policy, Google gives itself the freedom to combine users’ personal information from services like Web History and YouTube with all other Google products, and precludes existing users from fully opting out of this policy change unless they cease using the Google ecosystem entirely. Given Google’s robust Internet market share across platforms, Internet users must acquiesce to diminished privacy or be cut off from a vast portion of their existing Internet experience.
For millions of consumers who use Android-powered smartphones, currently estimated to be 50 percent of the national smartphone market, ramifications of the new privacy policy will be virtually impossible to avoid Users of these smartphones must log in to Google to activate much of the functionality of their devices. They would now have to choose between either frequently logging in and out to avoid Google’s consolidation of their data, thus greatly reducing the efficiency of their smartphones, or replacing their smartphones at great personal expense.
Threats to consumers’ privacy go beyond the consolidation and use of personal data. Consolidated personal data profiles offer a tantalizing target for hackers and privacy thieves. As stated in the letter to Google authored by Attorney General Gansler on behalf of his Office and the other 35 signatories:
“Those consumers who remain in the Google ecosystem may be making more of their personal information vulnerable to attack from hackers and identity thieves. Our offices litigate cases of identity fraud with regularity and it seems plain to us that Google’s privacy policy changes, which suggest your company’s intent to create richer personal data profiles, pose the risk of much more damaging cases of identity theft and fraud when that data is compromised, a risk that will grow as instances of computer hacking grow. With this newly consolidated bank of personal data, we foresee potentially more severe problems arising from any data breach.”
The Attorneys General recognize there may be consumers who welcome the consolidation and indiscriminate sharing of their personal information and data across multiple platforms. Unfortunately, many more consumers will either dislike the consolidation or not realize the potential harm that comes from it. Consumers deserve a full accounting of how this new privacy policy may impact them, and a meaningful opportunity to avoid being subjected to it.
Given the serious concerns expressed on behalf of those consumers, the Attorneys General have requested a meeting with Google Inc. CEO Larry Page as soon as possible. Mr. Page has been asked to reply no later than Wednesday, Feb. 29. This quick response is needed in order to enable the Attorneys General to review Google’s accounting before the new privacy policy goes into effect.
The states and territories signing on to this letter include: Arizona, Arkansas, California, Connecticut, Delaware, the District of Columbia, Guam, Hawaii, Illinois, Indiana, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Montana, New Hampshire, New Mexico, New York, North Carolina, North Dakota, N. Mariana Islands, Pennsylvania, Puerto Rico, Rhode Island, South Dakota, Tennessee, Texas, Utah, Vermont, the Virgin Islands, and Washington.
The complete text of the State Attorneys General letter to Google Inc. can be found at http://somd.me/AG-Google-Privacy
Source: Office of Attorney General Douglas F. Gansler