EU data bodies tell Google to fix privacy rules or face fine (Update)

Oct 16, 2012 by Rory Mulholland
European data protection agencies Tuesday said Google's new privacy policy does not comply with EU laws and told the US Internet giant to fix it within months or face legal action.

European data protection agencies on Tuesday said Google's new privacy policy does not comply with EU laws and told the US Internet giant to fix it within months or face legal action.

"Google has a few months, three or four months, to comply. If it takes no action, we will enter a phase of litigation," said the head of France's CNIL data agency, which took a lead role in a European probe into the company.

Google rolled out the new privacy policy in March, allowing it to track users across various services to develop targeted advertising, despite sharp criticism from US and European consumer advocacy groups.

It contends the move simplifies and unifies its policies across its various services such as Gmail, YouTube, Android mobile systems, social networks and Internet search.

But critics argue that the policy, which offers no ability to opt out aside from refraining from signing into Google services, gives the operator of the world's largest search engine unprecedented ability to monitor its users.

Google is already facing privacy probes by authorities across the globe as it steps up its battle with the social network site Facebook for both users and advertisers.

The CNIL led an investigation into the privacy policy by data agencies from European Union member states and on Tuesday presented its conclusions at a press conference in Paris.

In a joint letter to Google made public ahead of the conference, the agencies wrote that the US firm "provides insufficient information to its users, especially on the purposes and the categories of data being processed.

"As a result, a Google user is unable to determine which categories of data are processed in the service he uses, and for which purpose these data are processed," it said.

CNIL said in a statement that after requests for more information about Google's new policy, the firm had given "several answers (that) were incomplete or approximate" and "did not provide satisfactory answers on key issues".

CNIL president Isabelle Falque-Pierrotin told reporters that "we now demand adjustments" to the policy, failing which "authorities in several countries can take action against Google".

Falque-Pierrotin added however that action would be taken on a national and not an EU level.

European states' data agencies differ widely in their investigative and enforcement powers.

The French government said in a statement that it will "soon invite Google representatives to show ... the manner in which they intend to conform with the recommendations" of CNIL.

Google, in response to CNIL's statement, insisted it was complying with EU law.

"Our new privacy policy shows our continued commitment to protecting our users' data and creating quality products. We are confident that our privacy policies respect European law," it said in a statement.

The California-based firm says the changes are designed to improve the user experience across the various Google products, and give the firm a more integrated view of its users, an advantage enjoyed by Apple and Facebook.

EU competition authorities are separately looking at whether the US firm used its search engine to boost its own services and disadvantage competitors by preferential rankings.

Explore further: LinkedIn membership hits 300 million

add to favorites email to friend print save as pdf

Related Stories

Google rolls out new privacy policy amid howls

Mar 01, 2012

Google rolled out a new privacy policy Thursday allowing the firm to track users across various services to develop targeted advertising, despite sharp criticism from US and European consumer advocacy groups.

French regulator warns of Google privacy policy

Feb 28, 2012

Google's new privacy policy appears to violate the European Union's data protection rules, France's regulator said Tuesday, just two days before the new guidelines are set to come into force.

France orders Google to hand over Street View data

Jul 31, 2012

France's data-protection authority said Tuesday it wants Google to hand over data secretly collected from Internet users by its Street View mapping cars which it failed to delete as promised.

Recommended for you

LinkedIn membership hits 300 million

Apr 18, 2014

The career-focused social network LinkedIn announced Friday it has 300 million members, with more than half the total outside the United States.

Researchers uncover likely creator of Bitcoin

Apr 18, 2014

The primary author of the celebrated Bitcoin paper, and therefore probable creator of Bitcoin, is most likely Nick Szabo, a blogger and former George Washington University law professor, according to students ...

White House updating online privacy policy

Apr 18, 2014

A new Obama administration privacy policy out Friday explains how the government will gather the user data of online visitors to WhiteHouse.gov, mobile apps and social media sites. It also clarifies that ...

User comments : 6

Adjust slider to filter visible comments by rank

Display comments: newest first

Eikka
1 / 5 (1) Oct 16, 2012
But critics argue that the policy, which offers no ability to opt out aside from refraining from signing into Google services, gives the operator of the world's largest search engine unprecedented ability to monitor its users.


Refraining from signing in to Google's services is not enough to stop their tracking.

Google's tracking is based on correlating together a user's IP adress, a tracking cookie they put on your computer for simply visiting any Google website or service, your browser's User Agent string which contains information about your operating system, unique customer IDs in Windows registry if you've installed any software that Google owns, such as Picasa or Sketchup3D, which the google's updater service relays back to them along with your current IP adress and other data.

Even if you actively avoid all Google products, many third party websites still refer your web browser to Google Analytics, which tags you with some of the tracking methods listed above.
Eikka
1 / 5 (1) Oct 16, 2012
The irony is that normal web users who don't use Gmail, don't use Google Docs or even Google Search, are still being tracked because Google Analytics has to make sure that they're not counting the same visitors twice, so they database all the anonymous web users by their IP, cookie, and User Agent data. They may not know who it is, but if you later on put your name down anywhere, they got your web history ready to be connected to that name. That's why searching for your own name on Google is a bad idea in general.

Since they are tracking anonymous web users anyways, there is no possible way you can opt out. You'd have to go to Google and tell them to stop tracking you, but to do that they'd have to track you to stop their websites from tracking you.

Hence the "do not track me" tag in web browsers, which nobody really has to honor anyways, and I doubt Google really will either.
hb_
not rated yet Oct 16, 2012
@Eikka

Interesting. Does it help to delete all cookies now and then? And what about using an anonymous-service, such as an anonymous proxy, does it fool the mapping by google?
Eikka
not rated yet Oct 16, 2012
Interesting. Does it help to delete all cookies now and then? And what about using an anonymous-service, such as an anonymous proxy, does it fool the mapping by google?


The point of the use of multiple indicators for tracking is that if any one of them changes, they can still identify you. If your IP and User Agent string remains the same, but your cookies vanish, they simply issue you a new one. Ideally you should change them all at the same time.

As for proxies, they change your apparent IP adress as long as the proxy isn't "transparent", but they do nothing to the other indicators. Especially if you have Google software installed and the googleupdate.exe service happens to phone home, they get to know that it's you.

http://www.ghacks...dateexe/
Eikka
not rated yet Oct 16, 2012
Websites that use Google Analytics have the power to change how long the tracking cookie persists: https://developer...eTimeout

By default, the visitor cookie is set to expire in 2 years. If you prefer, you can change the expiration date of the visitor cookie using this method. You can change the expiration timeout to 0 to indicate that this cookie should be deleted when the browser is closed.


And this is what all webmasters should do if only for common courtesy. However, in itself it is not enough to stop Google's efforts because they still see your IP and operating system, what browser version etc. you're using. For most people the IP adress stays the same for long enough to gather enough other identifying evidence.

One way to block Google Analytics is to prevent "ga.js" from loading with adblock or noscript.
Eikka
not rated yet Oct 16, 2012
And apparently also "urchin.js", or just about anything that tries to contact google's servers. The problem of blocking individual files is that Google can change them at any time.

More news stories

Ex-Apple chief plans mobile phone for India

Former Apple chief executive John Sculley, whose marketing skills helped bring the personal computer to desktops worldwide, says he plans to launch a mobile phone in India to exploit its still largely untapped ...

Airbnb rental site raises $450 mn

Online lodging listings website Airbnb inked a $450 million funding deal with investors led by TPG, a source close to the matter said Friday.

Health care site flagged in Heartbleed review

People with accounts on the enrollment website for President Barack Obama's signature health care law are being told to change their passwords following an administration-wide review of the government's vulnerability to the ...

A homemade solar lamp for developing countries

(Phys.org) —The solar lamp developed by the start-up LEDsafari is a more effective, safer, and less expensive form of illumination than the traditional oil lamp currently used by more than one billion people ...

NASA's space station Robonaut finally getting legs

Robonaut, the first out-of-this-world humanoid, is finally getting its space legs. For three years, Robonaut has had to manage from the waist up. This new pair of legs means the experimental robot—now stuck ...

Filipino tests negative for Middle East virus

A Filipino nurse who tested positive for the Middle East virus has been found free of infection in a subsequent examination after he returned home, Philippine health officials said Saturday.

Egypt archaeologists find ancient writer's tomb

Egypt's minister of antiquities says a team of Spanish archaeologists has discovered two tombs in the southern part of the country, one of them belonging to a writer and containing a trove of artifacts including reed pens ...