EU data bodies tell Google to fix privacy rules or face fine (Update)

Oct 16, 2012 by Rory Mulholland
European data protection agencies Tuesday said Google's new privacy policy does not comply with EU laws and told the US Internet giant to fix it within months or face legal action.

European data protection agencies on Tuesday said Google's new privacy policy does not comply with EU laws and told the US Internet giant to fix it within months or face legal action.

"Google has a few months, three or four months, to comply. If it takes no action, we will enter a phase of litigation," said the head of France's CNIL data agency, which took a lead role in a European probe into the company.

Google rolled out the new privacy policy in March, allowing it to track users across various services to develop targeted advertising, despite sharp criticism from US and European consumer advocacy groups.

It contends the move simplifies and unifies its policies across its various services such as Gmail, YouTube, Android mobile systems, social networks and Internet search.

But critics argue that the policy, which offers no ability to opt out aside from refraining from signing into Google services, gives the operator of the world's largest search engine unprecedented ability to monitor its users.

Google is already facing privacy probes by authorities across the globe as it steps up its battle with the social network site Facebook for both users and advertisers.

The CNIL led an investigation into the privacy policy by data agencies from European Union member states and on Tuesday presented its conclusions at a press conference in Paris.

In a joint letter to Google made public ahead of the conference, the agencies wrote that the US firm "provides insufficient information to its users, especially on the purposes and the categories of data being processed.

"As a result, a Google user is unable to determine which categories of data are processed in the service he uses, and for which purpose these data are processed," it said.

CNIL said in a statement that after requests for more information about Google's new policy, the firm had given "several answers (that) were incomplete or approximate" and "did not provide satisfactory answers on key issues".

CNIL president Isabelle Falque-Pierrotin told reporters that "we now demand adjustments" to the policy, failing which "authorities in several countries can take action against Google".

Falque-Pierrotin added however that action would be taken on a national and not an EU level.

European states' data agencies differ widely in their investigative and enforcement powers.

The French government said in a statement that it will "soon invite Google representatives to show ... the manner in which they intend to conform with the recommendations" of CNIL.

Google, in response to CNIL's statement, insisted it was complying with EU law.

"Our new privacy policy shows our continued commitment to protecting our users' data and creating quality products. We are confident that our privacy policies respect European law," it said in a statement.

The California-based firm says the changes are designed to improve the user experience across the various Google products, and give the firm a more integrated view of its users, an advantage enjoyed by Apple and Facebook.

EU competition authorities are separately looking at whether the US firm used its search engine to boost its own services and disadvantage competitors by preferential rankings.

Explore further: Google offers peek into Bhutan with Street View launch

add to favorites email to friend print save as pdf

Related Stories

Google rolls out new privacy policy amid howls

Mar 01, 2012

Google rolled out a new privacy policy Thursday allowing the firm to track users across various services to develop targeted advertising, despite sharp criticism from US and European consumer advocacy groups.

French regulator warns of Google privacy policy

Feb 28, 2012

Google's new privacy policy appears to violate the European Union's data protection rules, France's regulator said Tuesday, just two days before the new guidelines are set to come into force.

France orders Google to hand over Street View data

Jul 31, 2012

France's data-protection authority said Tuesday it wants Google to hand over data secretly collected from Internet users by its Street View mapping cars which it failed to delete as promised.

Recommended for you

Facebook goes retro with 'Rooms' chat app

16 hours ago

Facebook on Thursday released an application that lets people create virtual "rooms" to chat about whatever they wish using any name they would like.

Some online shoppers pay more than others, study shows

17 hours ago

Internet users regularly receive all kinds of personalized content, from Google search results to product recommendations on Amazon. This is thanks to the complex algorithms that produce results based on users' profiles and ...

Twitter looks to weave into more mobile apps

Oct 22, 2014

Twitter on Wednesday set out to weave itself into mobile applications with a free "Fabric" platform to help developers build better programs and make more money.

Google unveils app for managing Gmail inboxes

Oct 22, 2014

Google is introducing an application designed to make it easier for its Gmail users to find and manage important information that can often become buried in their inboxes.

User comments : 6

Adjust slider to filter visible comments by rank

Display comments: newest first

Eikka
1 / 5 (1) Oct 16, 2012
But critics argue that the policy, which offers no ability to opt out aside from refraining from signing into Google services, gives the operator of the world's largest search engine unprecedented ability to monitor its users.


Refraining from signing in to Google's services is not enough to stop their tracking.

Google's tracking is based on correlating together a user's IP adress, a tracking cookie they put on your computer for simply visiting any Google website or service, your browser's User Agent string which contains information about your operating system, unique customer IDs in Windows registry if you've installed any software that Google owns, such as Picasa or Sketchup3D, which the google's updater service relays back to them along with your current IP adress and other data.

Even if you actively avoid all Google products, many third party websites still refer your web browser to Google Analytics, which tags you with some of the tracking methods listed above.
Eikka
1 / 5 (1) Oct 16, 2012
The irony is that normal web users who don't use Gmail, don't use Google Docs or even Google Search, are still being tracked because Google Analytics has to make sure that they're not counting the same visitors twice, so they database all the anonymous web users by their IP, cookie, and User Agent data. They may not know who it is, but if you later on put your name down anywhere, they got your web history ready to be connected to that name. That's why searching for your own name on Google is a bad idea in general.

Since they are tracking anonymous web users anyways, there is no possible way you can opt out. You'd have to go to Google and tell them to stop tracking you, but to do that they'd have to track you to stop their websites from tracking you.

Hence the "do not track me" tag in web browsers, which nobody really has to honor anyways, and I doubt Google really will either.
hb_
not rated yet Oct 16, 2012
@Eikka

Interesting. Does it help to delete all cookies now and then? And what about using an anonymous-service, such as an anonymous proxy, does it fool the mapping by google?
Eikka
not rated yet Oct 16, 2012
Interesting. Does it help to delete all cookies now and then? And what about using an anonymous-service, such as an anonymous proxy, does it fool the mapping by google?


The point of the use of multiple indicators for tracking is that if any one of them changes, they can still identify you. If your IP and User Agent string remains the same, but your cookies vanish, they simply issue you a new one. Ideally you should change them all at the same time.

As for proxies, they change your apparent IP adress as long as the proxy isn't "transparent", but they do nothing to the other indicators. Especially if you have Google software installed and the googleupdate.exe service happens to phone home, they get to know that it's you.

http://www.ghacks...dateexe/
Eikka
not rated yet Oct 16, 2012
Websites that use Google Analytics have the power to change how long the tracking cookie persists: https://developer...eTimeout

By default, the visitor cookie is set to expire in 2 years. If you prefer, you can change the expiration date of the visitor cookie using this method. You can change the expiration timeout to 0 to indicate that this cookie should be deleted when the browser is closed.


And this is what all webmasters should do if only for common courtesy. However, in itself it is not enough to stop Google's efforts because they still see your IP and operating system, what browser version etc. you're using. For most people the IP adress stays the same for long enough to gather enough other identifying evidence.

One way to block Google Analytics is to prevent "ga.js" from loading with adblock or noscript.
Eikka
not rated yet Oct 16, 2012
And apparently also "urchin.js", or just about anything that tries to contact google's servers. The problem of blocking individual files is that Google can change them at any time.