Why Google isn’t the privacy villain it’s made out to be (this time)

Google has been on the receiving end of some particularly egregious complaints lately, most of them stemming from its revised privacy policy that went into place on March 1. However, most of these efforts to call Google to the carpet seem like little more than attempts to make a quick payday with a legal settlement or to make political hay by calling out the privacy villain du jour on behalf of voters. Online privacy is a complex issue, and blindly pointing fingers every time a site changes its privacy policies or introduces a new service does little to advance the discussion.

Just look at the hysteria that transpired after Google when announced its its new privacy policy in late January. The changes whittled down about 70 different policies into one and brought YouTube and web history data under the same rules as most of the services Google offers. First, it was a few dozen state attorneys general expressing concerns over the new policy, claiming Google is leveraging of the ubiquity of its services by taking ever further advantage of users’ personal data. More recently, on March 20, it was a trio of class-action lawsuits jointly filed in California, New York and New Jersey, claiming Google’s new policy somehow violates users’ privacy rights (and, somehow, the Federal Wiretap Act).

But these suits and allegations are silly at best, and disingenuous at worst. They piggyback on the confusion over the the new privacy policy, despite the fact that there’s not much new. These types of suits also ignore how free consumer-focused web sites make money, and they take tricky issues like consent and put them in ludicrously simple terms that won’t help advance how we handle privacy in an online age where we don’t know how our web behaviors will change from week to week.

Google’s not-that-new privacy-policy battle and its age-old battle to monetize users.

For a deeper look at the silliness of the constant suits over privacy, let’s go to the class-action lawsuit. Here is why the complaint in the March 20 lawsuit claims the plaintiffs are entitled to damages:

Google is now aggregating consumers’ personal information without consumers’ consent; has failed to provide a simple, effective opt-out mechanism; and Google’s primary, undisclosed reason for doing so is its own commercial advantage, private commercial gain, and financial benefit. (emphasis mine)

But Google isn’t now doing anything. According to Google, its privacy policies have always allowed it to combine information among services, and the new policy only folded YouTube and web history into the mix. In that regard, there’s actually little that’s new except for the condensed format. Furthermore, a Google spokesperson told me last week it hasn’t even rolled out any new features or services utilizing the new permissions it does grant itself. It isn’t yet even doing what it’s being accused of doing.

When it does use the few new permissions it has under the new policy, it will be in part because Google is trying to evolve its products so they don’t become obsolete, and — yes — to make money. Using consumer data to serve advertisers is how Google makes its money and can afford to offer its myriad services for free. That’s really no secret, and it’s not something Google should have to constantly remind users about.

Like Facebook’s Sponsored Stories, which are the subject of another questionable lawsuit or the Chevron touting its use of Techron in its gasoline, Google’s new data practices serve multiple purposes. They all claim to help users, and maybe they do, but they also aim to put more money in the company’s pockets. That’s business.

However, as one attorney familiar with the ongoing spate of privacy lawsuits told me, “It seems as if the alternative [to expanding use of user data] is to freeze these companies in time.” Anything new is scary, and the companies must be punished.

The real issue is consent and what it means in an online age.

And then there’s the issue of consent. Both the recent class-action lawsuit and consumer watchdog EPIC have called out Google for not giving users a chance to expressly consent to the changes. After entering into a settlement with the FTC over the way it shared user information with Google Buzz, Google now has to obtain users’ express consent before changing the way it presents data to third parties.

Google’s official take on how that settlement relates to the firestorm it’s currently facing, according to a company spokesperson: “We’re not changing how any personal information is shared outside of Google. No users’ settings regarding the sharing or visibility of their personal information are being changed.”

But even should Google decide to share more data with third parties, the FTC agreement might end up being what one attorney calls “an empty framework.” Making users expressly consent to having Google share their data in new ways by isn’t much of a choice at all: if users want to use the service, they’ll click “I agree.” If not, they won’t use the service. Clickwrap contracts, as they’re called, are no different than shrinkwrap contracts for physically purchased software in that regard because there’s no room for negotiation.

Interestingly, though, some form of negotiation or a la carte menu of privacy terms is exactly what the class-action lawyers and attorneys general appear to want. One has to wonder how they came to expect that given the current state of the web. When it comes to direct agreements between service providers and users of their free services, it’s a take-it-or-leave-it world. The FTC even acknowledges as much in its latest report on web privacy.

You want out of much of Google’s tracking? Pay for Google Apps.

If anything, Google has been remarkably forthcoming — in part because its FTC settlement mandates such clarity — in telling consumers of its free services what has changed and pointing to tools in its account-management settings for controlling how Google uses their data. Just last week, Google rolled out a new service to show users what it knows about them. The efforts probably won’t qualify Google for sainthood, but they’re commendable.

But real debate over business models and how to truly empower users to consent is complex stuff; it’s much easier just to jump on the bandwagon and call out Google for impinging on users’ privacy and call it a day. Stoking the fires of privacy hysteria probably won’t change anything, but it might score some attorneys their legal fees or win some politicians a few more votes.

Feature image courtesy of Albert Bridge; handshake image courtesy of Flickr user Aidan Jones.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.