Google revises privacy policy despite EU protests
Google has introduced a new privacy policy that applies across its dozens of services, despite repeated pleas from European data protection authorities to wait for a proper impact assessment.
The move on Thursday is designed to allow Google to share users' personal data between services such as Google Search and YouTube, partly for user convenience and partly so Google can tailor its ads better. It forms part of a broad drive by Google to bake identity into its entire portfolio.
"Our privacy policies have always allowed us to combine information from different products with your account — effectively using your data to provide you with a better service," Google privacy chief Alma Whitten said in a blog post. "However, we've been restricted in our ability to combine your YouTube and Search histories with other information in your account."
"Our new privacy policy gets rid of those inconsistencies so we can make more of your information available to you when using Google. So in the future, if you do frequent searches for Jamie Oliver, we could recommend Jamie Oliver videos when you're looking for recipes on YouTube — or we might suggest ads for his cookbooks when you're on other Google properties," Whitten continued.
Google announced its plan to unify its disparate privacy policies little more than a month ago. Users have no opt-out from having their data shared across the company's services — if they are logged into their Google account, the information will be shared and ads will be targeted across the portfolio.
After the move's pre-announcement, the European Union's Article 29 data protection working group appealed to Google to pause so the impact of the measure could be properly assessed. The working group tasked French data protection watchdog CNIL with examining the new policy.
CNIL wrote to Google on Monday, again pleading with the company to slow down. The watchdog said its initial findings indicated the unified policy "does not meet the requirements of the European Directive on Data Protection, especially regarding the information provided to data subjects".
"Google's online services are numerous and differ greatly, both with regard to purposes and types of data they process. The new privacy policy provides only general information about all the services and types of personal data Google processes. As a consequence, it is impossible for average users who read the new policy to distinguish which purposes, collected data, recipients or access rights are currently relevant to their use of a particular Google service," CNIL said.
CNIL is still investigating the issue on behalf of the EU's data protection authorities. Data protection authorities in Japan are also reportedly nervous about the new policy, and the US Federal Trade Commission (FTC) is also looking into complaints over the move.
In her post on Thursday, Whitten noted that Google had "undertaken the most extensive user education campaign in our history" to tell users about the change — a point that CNIL had already gratefully acknowledged.
"If you don't think information sharing will improve your experience, you can use our privacy tools to do things like edit or turn off your search history and YouTube history, control the way Google tailors ads to your interests and browse the web 'incognito' using Chrome," Whitten wrote.
"You can use services like Search, Maps and YouTube if you are not signed in. You can even separate your information into different accounts, since we don't combine personal information across them. And we're committed to data liberation, so if you want to take your information elsewhere you can," she added.