* FYI * Privacy Rankings Report (dated 6-10-07)

Key findings ..

While there may be a temptation to focus criticism on Google's privacy performance, it is important to note that not one of the ranked organizations achieved a "green" status. Overall, the privacy standard of the key Internet players is appalling, with some companies demonstrating either wilful or a mindless disregard for the privacy rights of their customers. Even the better performing companies create lapses of privacy that are avoidable. With minimal effort most organizations can improve their privacy performance by at least one grade.

The current frenzy to "capture" ad space revenue through the exploitation of new technologies and tools will result in one of the greatest privacy challenges in recent decades. The Internet appears to be shifting as a whole toward this aim, and the opportunity to create market differentiators based on responsible privacy may diminish unless those avenues are explored immediately. We have been impressed by the good work being achieved by some sites, but consumers are right to feel aggrieved when companies fail to adopt the best privacy tools that are available.

On the basis of the evidence we have seen from this study, there is no excuse for any organization to ignore the opportunity to create strong privacy protections. The technologies are available, the expertise is abundant, and the market appears willing to favour sites that treat their customers with respect. We hope that the 2008 rankings will reflect this potential.

Privacy International has poked Google in the eye with the stick. In an interim report on the privacy ranking of the major Internet services, Google was the only company found among those surveyed to receive a failing grade, which Privacy International described as conducting comprehensive consumer surveillance and having entrenched hostility to privacy.

Needless to say, Google objects to the report and asserted that it didn’t have a chance to explain its privacy practices to Privacy International. In the latest twist, Privacy International Director Simon Davies said that two European journalists have asserted that Google representatives are claiming that the watchdog organization has a conflict of interest regarding Microsoft, which scored better than Google in the survey.

The six-month investigation looked at twenty different factors, and using data from public sources, current and former employees and interviews with company representative. Companies were graded on issues such as Corporate administrative details corporate leadership; data collection and processing; openness and transparency; responsiveness; ethical compass; customer and user control; fair gateways and authentication; and privacy enhancing innovations.

The European Commission is concerned about how Google’s data used and Google’s planned acquisition of DoubleClick has privacy advocates charged up.

What’s becoming more evident is that as Google acquires more market power and user data the company needs to provide leadership in establishing clear privacy guidelines in the best interest of its users. It’s not a matter of sending lobbyists to Washington D.C. to sway legislators on issues of importance to the company. Google needs to make sorting out privacy concerns a top priority. It’s not like dealing with the Chinese government on censorship.


Here’s how the report characterized Google’s failures:

* Google account holders that regularly use even a few of Google’s services must accept that the company retains a large quantity of information about that user, often for an unstated or indefinite length of time, without clear limitation on subsequent use or disclosure, and without an opportunity to delete or withdraw personal data even if the user wishes to terminate the service.
* Google maintains records of all search strings and the associated IP-addresses and time stamps for at least 18 to 24 months and does not provide users with an expungement option. While it is true that many US based companies have not yet established a time frame for retention, there is a prevailing view amongst privacy experts that 18 to 24 months is unacceptable, and possibly unlawful in many parts of the world.
* Google has access to additional personal information, including hobbies, employment, address, and phone number, contained within user profiles in Orkut. Google often maintains these records even after a user has deleted his profile or removed information from Orkut.
* Google collects all search results entered through Google Toolbar and identifies all Google Toolbar users with a unique cookie that allows Google to track the user’s web movement.17 Google does not indicate how long the information collected through Google Toolbar is retained, nor does it offer users a data expungement option in connection with the service.
* Google fails to follow generally accepted privacy practices such as the OECD Privacy Guidelines and elements of EU data protection law. As detailed in the EPIC complaint, Google also fails to adopted additional privacy provisions with respect to specific Google services.
* Google logs search queries in a manner that makes them personally identifiable but fails to provide users with the ability to edit or otherwise expunge records of their previous searches.
* Google fails to give users access to log information generated through their interaction with Google Maps, Google Video, Google Talk, Google Reader, Blogger and other services.