Technology

Barton Conducts a Serious Google Search

House Privacy Caucus Founder Sends Laundry List of Questions to Search-Engine Giant 12/12/2007 09:00:00 AM Eastern

House Privacy Caucus founder Joe Barton (R-Texas) is feeling dissed by the folks at Google and wants some answers to questions he has about the merger of that company and DoubleClick. Barton is concerned about the "intentional collection and coordination" of personal data.

Joe Barton

So are some anti-media-consolidation activists, who see the potential for marketing mischief and a new battle ground in the fight against Big Media control of information pathways.

In a letter to Google chairman Eric Schmidt Wednesday, Barton said that at a Nov. 6 meeting, Schmidt "graciously offered assistance to my staff to learn about your company’s and the broader industry’s current search and targeted-advertising practices."

But, he added, “Subsequently, attempts to send staffers on a fact-finding mission had been rebuffed on numerous occasions … Your warm initial invitation, followed by Google’s chilly response to a proposed visit by committee counsels, is disconcerting."

Google was baffled by the letter, said Washington spokesman Adam Kovacevich. He said the last the company had heard from committee staffers was that they would not be able to travel to Calfornia while the House is in session, which it has been since the end of the Thanksgiving break.

As for not being able to accommodate Barton's initial request, he said that it came two days before Thanksgiving, with Barton wanting to send staffers out the following Tuesday and Wednesday, only three working days away, with many Google staffers having to travel to Florida that week for the YouTube Republican debate.

He also pointed out that Schmidt had offered to set up a meeting in Washington with Google's public policy team given "travel schedules and other obligations of both Google employees and your busy staff."

Kovacevich said Google would answer all of the congressman's questions, though he said most had already been answere in public statements, testimony to Congress and at a Federal Trade Commission town hall meeting in November.

But saying that he wanted the responses by no later than Dec. 18, or less than one week, Barton launched his own data-collection effort with the following laundry list of questions from the letter:

• 1. Please describe Google’s retention policy with respect to the following data. Include in your response a description of the type of data retained (for example, URL, Internet-protocol address, date, time of connectivity); the length of time the data are retained; where the data are retained; who has access to the retained data; and how the data are removed, deleted, or anonymized once the retention period lapses.

a. Search queries on Google Search;

b. Search queries on Google Maps;

c. Search queries on Google News;

d. Search queries on Google Images;

e. E-mail sent, received, or drafted on Gmail;

f. Information or data collected or retained through a Web site’s use of Google Analytics;

g. Information or data collected or retained from an individual’s use of Google Desktop Search, including the Google Desktop Search feature and Search Across Computers;

h. Google Maps for Mobile;

i. Google Web History Program for registered Google users/Google users with sign-in accounts;

j. Information or data collected or retained from an individual’s use of Picasa;

k. Information or data collected or retained from an individual’s use of Calendar;

l. Cookies.

• 2. Please explain how Google uses the information or data described in Question 1 (a)-(l), including, but not limited to, the following uses: perfecting Google’s search algorithm; operating Google’s advertising programs such as AdWords and AdSense; and research or analysis of user activity on www.google.com.

• 3. Please explain the need to retain collected information for the length of time described in your response to Question 1.

• 4. Please explain how Google uses the information or data described in Question 1 (a)-(1), or any additional data, to drive or target advertisements to individual users’ computers.

• 5. In particular, please explain whether Google Maps directs advertisements to IP addresses based on that user’s Google Maps search-query history.

• 6. Please explain how and why information is combined or shared across platforms when consumers opt in for personalized services and whether Google first requires consent prior to such information sharing. (For instance, whether search-query data are shared with or linked to a user’s Gmail account.)

• 7. Please identify the sections of Google’s privacy policy that address the retention and use of the data described in Question 1 (a)-(l).

• 8. Please explain the technology called “rich media” or “interactive multimedia,” how this technology works and what information may be collected by its use.

• 9. Please explain whether Google utilizes such technology.

• 10. Please explain whether Google posts a link to its privacy policy on the home page or search results page of www.google.com and, if not, explain why not.

• 11. In Google’s privacy policy, “personal information” is defined as “information that you provide to us that personally identifies you, such as your name, e-mail address, or billing information, or other data that can be reasonably linked to such information by Google.”

a. Please describe how Google interprets “reasonably linked.”

b. Please explain in what circumstances Google links information such that an individual can be identified.

c. Please explain whether Google considers an IP address to be “personal information.”

d. Please explain whether technology exists to personally identify or determine the personal characteristics, including, but not limited to, name; e-mail address; physical address or location; age; gender; or ethnicity of an Internet user based on that user’s IP address.

e. Please explain whether Google is capable of identifying or determining personal characteristics, including, but not limited to, name; e-mail address; physical address or location; age; gender; or ethnicity of an Internet user based on that user’s IP address.

• 12. Please define the term “anonymization” as related to the data collected as described in, but not limited to, Question 1 (a)-(l).

• 13. Are Google’s practices described in response to Question 12 consistent with industrywide practices? If not, please describe any variance.

• 14. Please describe how Google anonymizes IP addresses.

• 15. Please describe how Google anonymizes cookie data.

• 16. Please explain whether Google has the capability or has attempted or plans to attempt to combine or merge the data described in Question 1 (a)-(l).

• 17. Please define tracking cookies, which may track users across multiple Web sites, and how they function.

• 18. Please explain whether Google uses the tracking cookies described in response to Question 17. If the answer is no, please describe how Google’s cookies are distinct from those described in Question 17.

• 19. Please explain whether Google’s cookies reset and, if so, how and when the cookies reset.

• 20. If the merger of Google and DoubleClick is approved, please describe what use Google plans to make of the data retained and collected by DoubleClick (for example, data from DoubleClick’s tracking cookies or DoubleClick click-stream data), and whether Google plans to combine or merge DoubleClick’s data with data Google retains from individual search queries and other user activity on www.google.com.

a. If Google does not intend to merge or combine the data Google retains with the information or data retained or collected by DoubleClick, please describe the efficiencies of the Google-DoubleClick merger.

b. If Google does not intend to merge or combine the data Google retains with the information or data retained or collected by DoubleClick, please explain how the information will be segregated.

• 21. Please describe how Google defines “behavioral targeting.”

• 22. Please describe your understanding of the broader industry’s definition of “behavioral targeting.”

• 23. Please describe Google’s understanding of the Asia-Pacific Economic Cooperation guidelines and how the guidelines would apply to Google’s practices, including, but not limited to, those functions described in Question 1 (a)-(l).

24. The House passed the Securely Protect Yourself Against Cyber Trespass (SPY ACT) in the current and prior two Congresses. The SPY ACT, H.R. 964, sponsored by Reps. Mary Bono (R-Calif.) and Edolphus Towns (D-N.Y.), mandates an opt-in privacy regime by prohibiting the collection of personal information from a computer without a user’s notice and consent prior to the execution of any information-collection program. H.R. 964 also demands that a user be able to easily remove or disable the information-collection program. Please explain whether Google’s applications are subject to H.R. 964’s consent requirements. If the answer is no, please explain why these programs, which collect personal information, are not subject to the consent regime established by H.R. 964.

September
October