On March 1, 2012, Google will replace its existing privacy policy with an entirely new policy, which will apply to most Google products, including the Google search engine, Gmail and YouTube, and consolidate over 60 different existing privacy policies for various Google products and services.

Pursuant to the new privacy policy, if an account-holder is signed in to a Google product, Google will combine the information that the individual has provided from one service with the information from its other services, such that the account-holder is treated as one single user across all Google products. For example, if a user spends an hour researching hockey on the Google search engine, the next time that user logs into YouTube, he or she might get recommendations for hockey videos, along with advertising for hockey gear or sporting events. 

The new privacy policy has been highly criticized by some commentators since Google disclosed its plan in late January 2012, perhaps unfairly. To better address many of the concerns and arguments relating to the new Google privacy policy, we have set out several considerations below.

Aggregate Sharing of Super-Profiles

Google shares aggregated, non-personally identifiable information publicly and with its partners, such as publishers, advertisers or connected sites. Under the new policy, account-holders’ user data is compiled across multiple Google sources to create user super-profiles.

Point: Even if Google shares such super-profile information in an aggregated, non-personally identifiable fashion, the disclosure risks revealing user personal information. Given the means that are currently available for aggregating disparate pieces of data, it is not unreasonable to consider that personalized information collected by advertisers, even when anonymized, might eventually be linked to an individual. As suggested in the Office of the Privacy Commissioner of Canada’s Guidelines on Privacy and Online Behavioural Advertising, released in December 2011, the information involved in online tracking and targeting will generally constitute personal information for the purposes of privacy legislation.  

Counterpoint: There’s no such thing as a free lunch. In order to provide free services, Google relies on advertising revenues. In order to maximize revenues, it provides targeted advertising, reducing useless advertising and resulting in less spam and more hits. This benefits everyone, including advertisers and consumers. The aggregation of data is inherently safe as it has been stripped of personal identifiers. This type of behaviour helps everyone and should be encouraged, as long as there are adequate safeguards as to the stripping of personal identifiers.

No Separate Identity across Platforms

Google has heralded its new privacy policy as a simpler, more intuitive information-management system. Nonetheless, it provides no opt-out mechanism to its new harmonized privacy policy, short of account deletion.

Point: While not all Google products require users to open Google accounts, some products are strictly accessible to account-holders. And, given the dominance and popularity of online Google products, Google customers are more likely than not to be Google account-holders. Through the implementation of this new privacy policy, users are losing their right to manage and maintain different identities within Google products. 

Counterpoint: If you don’t like it, you’re not forced to use it. If people want to use Google’s free products, there is a price to pay. There are lots of alternatives in the marketplace to Google – go use them if you don’t like it. There’s also more accountability for users in this system, which is important in the wild west of the Internet. Also, it’s quite easy to set up multiple Google accounts, so set up a different account for each service if this is such a problem.

Risk of Data Loss

Point: If Google were to suffer a privacy breach, as was the case when it rolled out Google Buzz, super-profiles containing mass amounts of personal information would be at risk, as opposed to the limited information that would be exposed if each Google product simply maintained its own distinct privacy policy and information-handling practices. 

Counterpoint: You get what you pay for. If you are worried that your browsing habits will be the subject of a massive data loss, pay for your services. Or, as above, set up different accounts for each service to minimize your data exposure.

***

The new privacy policy can be reviewed here:

http://www.google.com/intl/en/policies/privacy/preview/