Google takes a hit over data privacy

Privacy regulators are concerned about the web giant’s activities. Lorraine Mallinder reports.

The world’s favourite search engine has taken on a slightly more sinister aura of late. Google, the company that is so popular it became a verb, was once perceived as the altruistic company that offered web searches free of charge on the simplest of interfaces. Now, however, its image has changed to one of a web snoop extraordinaire, with a direct line to the complex collective psyche.

Under Google’s watch, the web seems to have become a much less anonymous place. The company now powers more than half of the world’s 61 billion monthly web searches, according to data for August 2007 released by US internet tracker comScore. By comparison, Yahoo, also a major contender in the online world, only powered 8.5 billion searches that same month.

Data protection campaigners are concerned about Google. In July this year, the cyber rights group Privacy International ranked the company bottom in privacy ratings, describing the company as having "serious lapses" in its policies. Google was judged as being "hostile" to privacy.

Earlier this year, the company attracted scrutiny from data protection officials in the EU after it had volunteered information about reducing the periods for which it would retain data. Search information such as traceable IP addresses and queries would be held for a maximum of 24 months and destroyed after 18-24 months, the company announced blithely, only to be targeted by an EU data protection watchdog, the article 29 working group.

Google was puzzled by all the attention. "We thought it was the single biggest privacy improvement that any company in our industry had made," says Peter Fleischer, Google’s global privacy counsel. He points out that Google needs to retain data to help the fight against fraud and to protect users from threats such as spam and phishing.

Under pressure, the company compromised further in June, offering to destroy all identifiable data after 18 months, but the watchdog’s investigation was nevertheless extended until the beginning of next year. Fleischer says that EU officials, who are also probing the activities of Yahoo and Microsoft, realised "the issues are more complex than they originally thought". "We were a lightning rod in the debate," he says.

Notwithstanding the article 29 investigation, the EU consumer group BEUC expresses additional fears about the recent wave of consolidation in the online advertising market. The next stage of web development will see web-search companies swallow up even more of the online advertising market. Campaigners fear this development could lead to search information being exploited for commercial gain.

Google itself has bid $3.1bn (€2.2bn) for DoubleClick, a company that monitors consumer behaviour to help advertisers track the effectiveness of their strategies. The Commission’s competition department is currently reviewing the deal, but Neelie Kroes, the competition commissioner, has already signalled that the investigation will not cover privacy issues.

"They [Google] could merge these databases and use the accumulated database to attract more advertisers," says Cornelia Kutterer, senior legal adviser at BEUC. "The more a company knows about its subject, the better the service is. But for us all, this targeted advertising also has negative aspects."

Fleischer is adamant that information can be used in the advertising world for the greater good. Google, which was already carrying out its own advertising experiments prior to bidding for DoubleClick, is currently looking at ways of improving industry-led standards on online marketing, he says. The current code of conduct, known as the network advertising initiative, was created by industry in consultation with the US authorities seven years ago and includes principles on issues such as consumer notification.

Google is looking for technological solutions that will strengthen the provisions of the code by breaking down companies’ ability to collate information on consumers and by improving notification techniques. Consumers may in future have more control over the advertisements that they are shown, says Fleischer.

"That’s cynical. This is like saying you don’t have any privacy, get over it," says Kutterer. "Here is a company trying to enlarge its databases, which has a serious problem with data issues, which can now expand its control over personal data." BEUC is pushing Kroes to take data protection issues into account. The commissioner is set to announce next week (26 October) whether further investigation of the Google-DoubleClick merger is warranted,

Google, it seems, is trying hard to show the world that its ‘do no evil’ mantra still applies, but the world seems unconvinced and unsympathetic. As net rival Microsoft has also learnt to its cost, regulatory scrutiny comes with being one of the big guys. For Google, which has gone from start-up to world domination in less than ten years, the lesson has been painful. Butwith so many of the world’s queries nestling in its pockets, it can hardly have come as a great surprise.

Privacy regulators are concerned about the web giant’s activities. Lorraine Mallinder reports.