Google has agreed to
settle Federal Trade Commission charges it violated with its own privacy
policies when it launched the social network, Google Buzz, including by
implementing the first-ever FTC requirement of employing a
"comprehensive" privacy program, one that that will get independent
audits for the next 20 years.
"When companies make
privacy pledges, they need to honor them," said FTC Chairman Jon Leibowitz.
"This is a tough settlement that ensures that Google will honor its commitments
to consumers and build strong privacy protections into all of its
operations."
According to the FTC, when
Google launched the site in 2010 through its Gmail product, the choice of
declining to join that social network or to leave it were ineffective, and the
controls for sharing info were "confusing and difficult to find." The
settlement is still subject to a final vote after public comment.
As part of the settlement,
Google is barred from "misrepresenting the privacy or confidentiality of
individuals' information or misrepresenting compliance with the U.S.-E.U Safe
Harbor or other privacy, security, or compliance programs." It also
requires Google to affirmatively obtain consent [opt in] "before sharing
their information with third parties if Google changes its products or services
in a way that results in information sharing that is contrary to any privacy
promises made when the user's information was collected."
The settlement will be
open to public comment through May 1, after which the FTC will vote to finalize
it, which is likely since the vote on the settlement was 5-0, though with one
commissioner concurring rather than voting yes.
In a separate statement,
that commissioner, Republican J. Thomas Rosch, explained that he was troubled
by the new "opt in" provision for future use of information for any
change in product or service. While saying Google could speak for itself, he
said that it seemed the FTC was setting up that opt-in condition for more
widespread application.
"[T]he ‘opt in'
requirement in Part II is seemingly brand new," he wrote. "It does
not echo what Google promised to do at the outset. In the separate statement
that I issued when the staff issued its preliminary Privacy Report, I expressed
concern about whether an ‘opt in' requirement in these circumstances might
sometimes be contrary to the public interest. Then, as now, I was concerned
that it might be used as leverage in consent negotiations with other
competitors."
The FTC and Obama
Administration have encouraged industry to give Web surfers more control over
the use of their information, though stopping short of recommending a
mandatory opt-in, rather than opt-out regime.
"One of my top priorities is protecting consumers' privacy
and I appreciate that the Federal Trade Commission and its dedicated staff is
taking this issue so seriously," said Senate Commerce Committee Chairman
Jay Rockefeller (D- W. Va.), who has made online privacy a priority for his
committee. "As Chairman of the Commerce Committee, I will continue to take
an aggressive stance to make sure consumers have adequate control over their
personal information. Google was just plain wrong when it opted people
into Buzz without their consent. This should be a wake-up call for online
businesses-both large and small-of the need to be clear and honest about how
the personal information of consumers is collected and used."
