Google Settles with FTC over Alleged Privacy Violations
After a period of public comment, the Federal Trade Commission and Google, Inc. agreed to settle charges it made false and misleading statements about its collection and use of users’ personal information during the launch of its Google Buzz platform. The FTC claimed Google engaged in deceptive practices in violation of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. § 45(a). Under the consent order Google agreed to implement a comprehensive privacy program and submit to independent privacy audits for 20 years.
Google Introduced Buzz Social Network
Between 2004 and 2010, Google published on its website certain claims about its privacy practices. In particular, Google stated that it collects users’ personal information for particular services, and that “[i]f we use this information in a manner different than the purpose for which it was collected, then we will ask for your consent prior to such use.” FTC Complaint at ¶ 6.b.
In February 2010, Google launched a social networking service called Google Buzz, which allowed users to share updates, comments, photos, videos, and other information with individuals and groups. According to the FTC, to populate the social network, Google used the personal information of users with existing Google e-mail (“Gmail”) accounts, including their names and e-mail contacts, setting up those users to “follow” or be followed by others, without the users’ prior notice or consent.
The FTC claimed that when Google Buzz was launched, Gmail users were automatically set up to follow the people they most e-mailed and chatted with. Users signing into their Gmail accounts were given the choices “Sweet! Check out Buzz” or “Nah, go to my inbox.” The latter choice nonetheless caused users’ information to be shared in several ways, such as by automatically enrolling them in Buzz without disclosing this to them. Users could be followed by other Gmail users who enrolled in Buzz, and would appear on the public profiles of Buzz users who followed them.
Users were given the option to “Turn off Buzz,” in a link in small type after their Gmail login. However, users who clicked the link still appeared as followers on the Google profiles and Buzz pages of their most frequent e-mail recipients, where links were automatically added allowing other people to follow those users.
FTC Claims Google Buzz Policies Were Deceptive
The FTC claimed that the set-up process for Gmail users enrolling in Buzz did not reveal that previously private information would be publicly shared by default. Moreover, the controls to change the defaults were confusing and hard to find. Among other things, users were directed to create a public Google profile which included their name and photo. The profile-creation screen prominently stated that “you can post publicly to the world or privately to only the people you choose.” Complaint at ¶ 9.b. In far less noticeable type was the statement, “Your profile will include your name, photo, people you follow and people who follow you.” Id.
Users could choose not to have their lists of followers and people the user was following shown on the user’s public Google profile. But the FTC stated “[u]sers who saw no reason to edit their profile – particularly those who already had created a Google profile and did not realize new information would be added and publicly available by default on that profile – would never have learned that these controls were available.” Id. at ¶ 9.c.
Some Gmail users had blocked certain e-mail contacts from viewing information about them, but these preferences were not transferred to Buzz. Individuals who Gmail users had previously blocked in Google Chat or Google Reader were still able to follow the user in Google Buzz. According to the FTC, users complained that the lists of followers automatically generated from e-mail contacts included “individuals against whom they had obtained restraining orders; abusive ex-husbands; clients of mental health professionals; clients of attorneys; children; and recruiters they had emailed regarding job leads.” Id. at ¶ 11. After widespread public criticism and many consumer complaints, Google rectified some of its practices. Google gave users the ability to turn off Buzz, stopped giving automatic lists of people to follow, clarified the processing for editing followers, and made it possible to block any follower.
The FTC filed a complaint against Google, claiming that Google used deceptive tactics in violation of the FTC Act by expressly or impliedly misrepresenting its privacy practices. The FTC further claimed that Google deceptively misrepresented its compliance with the U.S.-EU Safe Harbor Framework, which governs the transfer of personal information from European Union Member States to companies in the United States. The Safe Harbor Framework requires companies to certify that they adhere to principles and related requirements of consumer notice and choice in the use of personal information. According to the FTC, Google self-certified its compliance with Safe Harbor but failed to adhere to these principles by not giving Gmail users notice before using the information collected for another purpose, and not getting their consent to do so. The FTC argued the actions were a deceptive act or practice in violation of the FTC Act.
Google Barred from Misrepresenting Privacy Protection
The privacy assessment must set forth the specific privacy controls that Google has implemented and maintained, explain how such privacy controls are appropriate to Google’s activities, explain how the privacy controls meet or exceed the protections required by the consent order, and certify that the privacy controls are operating with sufficient effectiveness to provide reasonable assurance to protect the privacy of covered information.
This document and any discussions set forth herein are for informational purposes only, and should not be construed as legal advice, which has to be addressed to particular facts and circumstances involved in any given situation. Review or use of the document and any discussions does not create an attorney-client relationship with the author or publisher. To the extent that this document may contain suggested provisions, they will require modification to suit a particular transaction, jurisdiction or situation. Please consult with an attorney with the appropriate level of experience if you have any questions. Any tax information contained in the document or discussions is not intended to be used, and cannot be used, for purposes of avoiding penalties imposed under the United States Internal Revenue Code. Any opinions expressed are those of the author. Bloomberg Finance L.P. and its affiliated entities do not take responsibility for the content in this document or discussions and do not make any representation or warranty as to their completeness or accuracy.
©2011 Bloomberg Finance L.P. All rights reserved. Bloomberg Law Reports ® is a registered trademark and service mark of Bloomberg Finance L.P.