April 17, 2007 7:00 PM PDT
Privacy concerns dog Google-DoubleClick deal
(continued from previous page)
The scary scenario for privacy advocates would be if Google were to combine its own storehouse of data on users--yielded through cookies and other personal information given up for services like Gmail--with DoubleClick's data. It would then have unparalleled visibility into people's online behavior, a point brought home last year when AOL accidentally leaked the search histories of users.
What's more, with Google venturing into ad sales for offline media, including radio, TV and print, the company could eventually have a user profile database that goes well beyond what DoubleClick ever planned. Google, for example, just introduced a free voice-activated local-search service for the cell phone and landlines.
"You start to add on more and more collections of information, and they have the ability to tie all of this together, and that poses a major potential for privacy risk in the future," said Ari Schwartz, deputy director for the Center for Democracy and Technology, an advocacy group in Washington.
Merger may spur dialogue on practices
Still, privacy advocates think the merger could be an opportunity to talk to Google about its practices and put together some clear privacy standards for the industry.
The CDT has urged the FTC to hold a workshop on behavioral targeting to set best practices in the industry and get players like Microsoft, Google and Yahoo to agree on them. The organization wants to ensure that people have control in the event that these companies begin to merge consumer information from search and Web-surfing records to personalize ads.
Google currently targets ads to people based only on the context of their searches. A search for lemon pie recipes, for example, might yield an ad for Martha Stewart's recipe database. It also uses IP addresses to target people by their location.
Schwartz, whose CDT brought privacy action against DoubleClick in 2000, said Google called the center after the purchase was finished. Although CDT is still talking to Google, he said the group has some concerns with the acquisition that aren't necessarily related to DoubleClick's collection practices. They deal more with the wide-ranging projects Google has tackled without developing clear privacy policies for each one.
For example, Google is forward about letting people know about the privacy implications involved with installing its Toolbar application, saying "it's not the usual yada yada yada" and that it will collect Web-surfing footprints from the user if he or she opts in. In contrast, Schwartz said Google has been unclear on how long it takes Gmail to get rid of e-mail, once a user has deleted it, unlike rival Yahoo.
Earlier this year, Google also changed its data retention policy. Now the company will purge search query data associated with cookies and IP addresses after 18 to 24 months, rather than its previous policy of keeping them forever. Still, privacy advocates would like to see Google come up with data retention policies for other services on its site, such as histories associated with watching videos on YouTube.
"There's a complexity there about where they're going. They've had this goal of collecting all of the world's information and making it publicly searchable, but they haven't had the corresponding policy to protect privacy," Schwartz said.
"They've had a shadow of protection in what they discuss by 'not doing evil,' but they don't have that bigger vision," he added.
Opsahl said he would like to see Google consider rendering the IP addresses that DoubleClick collects through its ad servers more private, the way Google itself has done.
Google recently said it will remove the last quartet of the IP address associated with an individual computer so the number is lumped into a larger set of 256 IP numbers. That way, it can target people based on country, not by computer. "It's a step in the right direction; it's not complete anonymity," he said.
The goal, Opsahl said, is "to minimize the amount of information collected to only the necessary info to operate the business, and keep it for minimum amount of time. That's something to continue the dialogue with Google about."
Some think Google just hasn't yet been able to articulate its vision for consumer privacy. On a conference call announcing the DoubleClick deal Friday, even one of Google's co-founders had difficulty articulating his company's plans.
"Overall, we care very much about end-user privacy, and that's really going to take the No. 1 priority when we contemplate new kinds of ad products," co-founder Sergey Brin said.
"So I think anything along those lines..." and Brin trailed off. Then he added: "There are quite a few challenges with such a plan, with respect to how we feel about privacy."
10 commentsJoin the conversation! Add your comment