Privacy Complaint Against Google's GMail Service

CRCates writes "Privacy groups in the UK have filed a complaint against Google over its new Gmail service. Privacy groups said they were concerned about Google's ability to link a user's personal details, supplied in the Gmail registration process, to Web-surfing behaviour through the use of a single cookie for its search and mail services. "

Comments

How can they do this?

[Pingular]

It hasn't even been launched yet, it's in beta. I'd imagine the people in this beta have signed some kind of agreement where they say they cannot do anything if they are adversly affected by Gmail, so what's the problem? Of course it's a different matter when it's launched to the public.

Re:How can they do this?

[darien]

Presumably this group wants Google to get it right before it's released to the public! Which seems fair enough to me. Isn't that what being in beta is for?

Re:How can they do this?

[Oriumpor]

[quoteblock]It hasn't even been launched yet, it's in beta. I'd imagine the people in this beta have signed some kind of agreement where they say they cannot do anything if they are adversly affected by Gmail, so what's the problem? Of course it's a different matter when it's launched to the public.[/quoteblock]

Or more like they signed an agreement that made sure they agreed to complete and total lack of anonymity and privacy.

Re:How can they do this?

[orthogonal]

I'd imagine the people in this beta have signed some kind of agreement where they say they cannot do anything if they are adversly affected by Gmail, so what's the problem?

The problem is those pesky "inalienable" (or "unalienable" as one source writes it) rights: inalienable simply means that something can't be given away or sold -- alienated -- even if you want to give it away or sell it.

Just as you can't, regardless of contract, sell yourself into slavery in most countries, Google's GMail quite possibly violates European law (but not U.S. law, which protects privacy very little if at all).

So a contract is no defense, as contracts for illegal activities are unenforceable.

Re:How can they do this?

[los furtive]

Beta tests technical issue not privacy issue.

That's a narrow view of things. Beta tests are for ANY issues that arrise, whether they be usability or functionality. The likeliness for usability changes to occure as a result of beta testing are much lower than in alpha testing, but they are by no means excluded (they just piss of the developers more).

And the issue of privacy is certainly a usability issue.

Re:How can they do this?

[MillionthMonkey]

Okay...
it's really simple.
If Intel implants a tracking number in the CPU's, buy AMD.
If A bios manufacturer hard-codes DRM into it's motherboards, don't buy those motherboards.
If (free) Gmail violates your privacy, don't use (free) Gmail.
what exactly is the problem?

The problem is when-

• All CPU manufacturers include tracking numbers
• All BIOS manufacturers hard-code DRM into their motherboards
• All (free and non-free) web-based mail services violate your privacy

This "vote with your feet" argument works for pizzas, but not markets where there are high barriers to entry. A web-based email system isn't a very good example (who can't code up one of those over a weekend?) but the other two are.

Re:How can they do this?

[throughthewire]

...you can generally be more confident that this information is more transient than it will be on the Gmail system

Confident? That's a very dangerous assumption if you're that concerned about your privacy. I maintain quite a few corporate e-mail systems, and one of the biggest problems is convincing people to delete anything - even crap. It's not uncommon for the executives to have mailboxes which exceed 1GB.

I have every business email I have sent or received in the last six years. My assumption is that every email I send is more than likely still out there.

Don't want your messages to be readable by the 'wrong' people? Encrypt 'em real good, or don't use email.

"Don't send anything over email that you wouldn't want published on the front page of USA Today."

Re:How can they do this?

[jarich]

It's very different.

You pay money for your CPU and this service is free.

I take great exception to someone tracking me and having me pay for the technology. (I know, but let's ignore my ISP for the moment).

But if someone wants to provide a free service, then you get what you pay for. Be sure you read the terms of service. If you don't like it, use something else.

Intel put their tracking into something you paid $$ for. That's different.

Erase the cookie

[Anonymous Coward]

Erase the cookie. Don't use the service. How do you know Yahoo! doesn't read all it's mail?

Welcome to paranoia.

Re:Erase the cookie

[sgtron]

Hotmail, Yahoo, GMX.. they all *read* your email.. let me explain. All these services have "anti-spam" measures in place. They scan all your email for certain terms that would identify it as spam. Now, what is Google doing differently? They also scan your email, not only for spam words, but for ad keywords. I don't see the big problem here honestly. If you don't want your email scanned for spam terms or ad words, just use a real isp and run your own anti-spam software.

Re:Erase the cookie

[Sethb]

It gets even dumber. People have privacy concerns about Google scanning the e-mail to deliver the AdSense ads, and now this, but they're sending their e-mail around the internet, through god knows what relays, in plain text? Uh, here's an idea, if you're worried about privacy in regards to your e-mail, wrap it in GPG/PGP and be done with it. You don't send important correspondence on a postcard, do you?

Re:Erase the cookie

[0x0d0a]

Erase the cookie.

Doesn't do anything if I voluntarily sign into an account.

Heck, if Slashdot partnered with DoubleClick (and I didn't block ads), it'd be pretty easy to track whatever I do on the Web as well.

Don't use the service.

Doesn't mean it's not a legitimate complaint, though, about the service.

How do you know Yahoo! doesn't read all it's mail?

We don't, though it seems like the whole Yahoo Mail thing is at least as intrusive as Google -- and Yahoo tries to handle all manner of services as well.

I use Google on a "session cookies only" basis, and block ads, which makes it at least somewhat difficult to tie different online personas together.

I do have one (IMHO) legitimate privacy grievance with Google's operation. Google does not let you save preference options in the content of an URL -- language, results size, image content filtering, etc. It is technically possible (and really, pretty easy) to do so, but they prefer to force me to retain a permanent cookie on my system if I wish to use these features (or set the content each time I visit their site). There's a constant nag to give the degree of privacy that I *do* have, which I'm less than thrilled about. I consider search engine cookies pretty much unacceptable based on the sheer amount of data they hand out. You don't have to be searching for how to defraud your employer or for child porn to be uncomfortable with someone having a complete record of everything you're looking for. I view search engines as a tremendous data leak out of companies. Do you Google for things that you're doing research on, or companies that you might be doing business in, or areas/markets that you might be entering? That's sensitive data. What about having a "terrorist keyword red flag list"? Search engines would be an incredibly rich resource for fishing expeditions to find suspicious folks, simply because of the sheer amount of data involved. You think you ever mind wind up in politics? Do you want your opponent to ever be able to dig up the fact that you searched for images of a gay porn actor fifteen years ago? There's an awful lot of very nasty things that can be done with search engine data. Google, on the whole, might be currently playing nice, but that's no guarantee that they will do so in the future, post-IPO, when shareholders are demanding more profits and a partnership with DoubleClick could net Google a loooot of money...

Re:Erase the cookie

[LnxAddct]

Just encrpyt all your emails, they'll have a great profile of random bits :). And they said they'll probably let you use outside clients for free so it makes it even easier to encrypt, no biggy. Regards, Steve

Tit for Tat

[Fortress]

Seems to me that if they give you a free gig of space, some targeted ads aren't too much to pay. Why not use some other mail and store it on your PC if you feel this is too invasive?

Re:Tit for Tat

[sphealey]

Seems to me that if they give you a free gig of space, some targeted ads aren't too much to pay.

That's the current line of thought, particularly on the libertarian side of the Internet.

I will note, however, that at least in the United States we went ahead and outlawed indentured servitude, even though (a) it was usually entered into voluntarily (b) it often had a net benefit to the indentured party. Still, we felt that the moral and social cost of the "servitude" part was too high to allow individuals to enter into that sort of contract.

Perhaps the privacy advocates are arguing along the same lines here.

I will also note that while Google claims that one of their corporate policies is "don't be evil", they also absolutely refuse to discuss or explain almost any facet of their operations. Just a thought.

sPh

Re:Tit for Tat

[orthogonal]

Seems to me that if they give you a free gig of space, some targeted ads aren't too much to pay.

"Seems to me, Mr. Jefferson, if England gives you the security of their navy, a little taxation without representation isn't too much to pay."

"Seems to me, Mr, Franklin, if we can give up a little liberty for security, that isn't too much to pay."

"Seems to me, Mr. Churchill, giving up 'a distant country of which we know nothing' in order to get 'peace in our time' isn't too much to pay"

Do you write no email that is personal enough that you'd object to Google looking through it in order to serve up ads?

If you're willing to give up your privacy for mere convenience, what else are you prepared to give up?

How much for your right to vote? A gigabyte of space? Two?

How much for that freedom of speech -- I mean, when did you last need that? And freedom of assembly, will you throw that in too, for say, three gigabytes?

You're not hiding anything in your email, so you're probably not hilding anything your house either -- let's install some free anti-crime cameras in your bedroom -- for your protection of course.

Did I miss the memo telling me that Americans had become so lazy we can't even get up off the couch to protect our privacy anymore?

Alles in Ordnung, Herr Reichsminister!

Re:Tit for Tat

[Fortress]

Wow, I think you're getting fired up on a non-issue here. Your rights aren't being violated, if you feel that Googol's scanning your mail for ads is invasive, then don't sign up. The analogies youhave madew are all coercive, whereas Gmail is voluntary.

I can CHOOSE to give up my right to privacy in this matter to a company I trust without giving up my Right to Privacy in general, let alone my free speech, voting and assembly.

You seem to be strong on rights. What about Googol's right to offer a service for no money in exchange for policies they lay out in their eula? They are by no means being coercive, they have no monopoly on email and are merely trying to float a new internet service. They are not even being deceitful about it, as we all know about their advertising policy before the service is released to the public.

This is not some mandatory big government service here, merely a private company trying something different.

Re:Tit for Tat

[Theaetetus]

Do you write no email that is personal enough that you'd object to Google looking through it in order to serve up ads?

Do you Yahoo? Do you notice their auto-quoting feature that adds the > brackets in different colors? Do you write no email that is personal enough that you'd object to Yahoo looking through it in order to serve up that feature?

The point, and the answer, is the same. There is no person reading your email at the company, merely an automated script, and it's looking for keywords. Additionally, the results are blindly served back up to you through the same automated process. If you talk about 'golf balls' in your email, you'll see 'golf ball' ads. However, the golf ball manufacturers don't get a note in the mail saying that orthogonal@gmail.com is interested in their services. No one gets that note, not even anyone at Google. The manufacturers do get charged for the ad, and know merely that 1 person looked at their ad (or more likely several hundred looked at their ad each week/month, the same way that the ads work now).

So what privacy have you given up?

Finally, unlike your other examples, there is no requirement to use Gmail, and no clear benefit to using it over other services except for the specific features it provides - Google's searching through your archived emails. As many have pointed out, there are hundreds of other email providers, and several, including Spymac.com, are offering or will be offering 1 gig storage. If Jefferson could choose the benefits of England's navy, France's navy, Spain's navy, etc., then that would make more sense in your example... But wait, he did, and he chose France, who had terms more acceptable to him.

-T

Re:Tit for Tat

[William Tanksley]

But nobody's giving up privacy -- we're talking about a company that publicly states that it does what every mail server has to do as a matter of course.

Yes, they parse your email. That's part of SMTP (HELO, mcfly). They store it; that's part of webmail. They go through it; that's part of syntax highlighting. They index it; that's part of search capability. They may not wipe it out when you delete it; that's part of the cost of a distributed system.

Google isn't the only one that does ANY of this; all of the others do as well, including your ISP and _certainly_ including the big webmail providers (because they ALSO throw in advertising). The difference is that Google tells you EXACTLY what they're doing.

This is honesty, plain and simple. They should be rewarded for it.

-Billy

Eternal cookie

[JosKarith]

This would be the cookie that doesn't expire till 2038 yes?

Two Cookies Would Fix it

[PetoskeyGuy]

After all not even a company like google could keep track of that much information. :P

These providers can't just do as they please...

[Anonymous Coward]

"These providers can't just do as they please and hide behind a contract," Privacy International's Davies said.

YES they can! it's called an eula...

Er...

[Inuchance]

If you don't want them to have your personal info, then don't provide it! GMail is a service, not a requirement.

Re:Er...

[DroopyStonx]

Hahaha, it's funny how you people say, "It's a service, not a requirement," but when invasion of privacy actually happens to you it's suddenly not okay.

Example: Tivo. Tivo isn't required, but people got all up in arms because they captured info about what people watched (which is kind of a bullshit thing to do). They aren't exactly identifying YOU, just your data, so it's not REALLY an issue. Either way, it's still not cool to know that something you bought that is yours is sending data about the shit you watch to someone else.

Just because a company violates privacy issues doesn't make it "okay" simply because it's "a service, not a requirement," because you know as well as I that there are a ton of braindead computer users who sign up for things not knowing what they are.

Re:Er...

[caitsith01]

This is similar in a sense to the 'if you've got nothing to hide, you shouldn't mind having a video camera in your house/giving a DNA sample/signing this confession/having Palladium in your computer/letting the government see what you're watching on DivX' type reasoning, and with all due respect it is bunk.

The point is not that something bad is definitely going to happen as a result of Google's policy. The point is that this moves the _presumption_ from automatic assumption of privacy to an automatic assumption of non-privacy, which is a dangerous precedent, especially if this is even a small fraction as popular as the search engine itself.

This reasoning, which I have seen a number of times already in GMail discussions, also smacks of 'if you don't like it, move to Russia,' or in this case, Hotmail.

Re:Er...

[Simon Lyngshede]

So it is okay to provide a service which breaks the law, because poeple aren't being forced to use it?

Is it the okay to encourage to steal, kill and rape, because they don't need to do it, it is just a suggestion? As far as I know this is also illegal in most countries.

So?

[System.out.println()]

You want a gig of email but with privacy? Go sign up at Spymac. It's also free, and it's already here - and not in beta. And they don't read your email.

Re:So?

[fetus]

"And they don't read your email."

spy mac?

Re:So?

[System.out.println()]

The name is much older than the email service - it used to be just forums, probably for rumor reporting and discussion back in the day.

Now it functions very well as a replacement to .Mac - free, even. 100MB webspace FREE, a gig of email FREE, iCal hosting, 250MB for pictures - yes - FREE. I'm amazed they turn a profit at all. (They have paid web hosting as well, something like $17/month for a couple domains and 1GB webspace... still a pretty good deal.)

Re:So?

[Anonymous Coward]

> Yea, THERE'S a reputable organization reknown for their datacenters, data integrity, and long-term stayability.

> How long will this service last at SpyMac? A month?

You don't get it. Spymac don't offer imap or advance search, hence 1Gb is useless there.

also in the BBC

[tuxette]

BBC Article

Nobody's forcing you...

[LinuxOnHal]

If someone has a problem with the way the advertising is done, then they shouldn't use it. It is not like Google is hiding all of this information from their users.

All of this complaining and bickering for a service that is not yet released...

Re:Nobody's forcing you...

[InodoroPereyra]

If someone has a problem with the way the advertising is done, then they shouldn't use it. It is not like Google is hiding all of this information from their users. I strongly disagree:

• If Google terms of service violate European law, it is appropriate for Europe based people to complain.
• Google listens. If they are taking a wrong turn, it is wise to let them know.
• So, if a company offers to do something illegal to its customers, do you think the company is untouchable, because you are not forced to be its customer ? This is just nonsense.
• Yes, they are honest, and you can probably trust their current management. But what will happen to your personal data in future under new management ?

It's funny. Your same argument has been used to death by microsofties before: what's wrong with microsoft ? Nobody forces to use their products. Yeah ...

I wish to register a complaint

[minus9]

I wish to complain about the post I am going to make half an hour from now. It is inflammatory and totally uncalled for.

Gmail - Opt-In

[Silwenae]

I can understand the concerns Europeans may have, but then again, this is an opt-in procedure.

If you don't want to use Gmail, you have other options through your ISP, other free services, etc.

It just seems to me this is an extension of social networking, but from a business perspective. - target based advertising based on what you surf for based on your cookie.

It seems similar in a way to what Gnome's Nat Friedman wants to do with Dashboard. Based on your email & IM, having the desktop provide you with links to what you're talking about.

To me, the pro's at this point from what we know may outweight the cons - yes they'll target me with ad's based on my surfing behavior, but the ability to index and search my email rather than using "To" "From" and "Subject" headers is definitely a step forward in email management.

Re:Gmail - Opt-In

[Throtex]

I, on the other hand, have serious trouble understanding anything the Europeans do. I'm glad you've figured them out. :)

Can I file a complaint against MS now?

[jamonterrell]

Since by the same measure, Microsoft can track a user by the personal information given through the passport/hotmail registration procedure through every website you visit using THEIR browser, every program you run on THEIR operating system, every document you read/write with THEIR office application.
Innocent until proven guilty. When they start using this for an invasion of privacy, then you can complain, at this point they haven't even offered the service, how can you complain that they've invaded your privacy.

Besides, if you don't like it, don't create an account and go back to wearing your tinfoil hat. They aren't using strongarm tactics to force you to use their product.

Jamon.

Oh For The Love Of God

[Talez]

If you don't the terms and conditions go with another mail provider.

But I suppose when Google is the only mail provider providing a gig of space, it's no wonder why privacy advocates are jumping up and down.

You can't have your cake and eat it too. Google is a private company. They own the servers and the bandwidth. These privacy advocates can go jump as far as I'm concerned.

Why shouldn't google be able to link data?

[Chris_Jefferson]

I'm still not entirely sure what everyone's complaint is here. You don't have to join Gmail to use google. They openly admit that they may combine data (unlike everyone else who do combine data but refuse to tell anyone about it)

If you don't want google using your data, don't give it to them. Personally, I'm happy for google to have all my data if it will improve my browsing and emailing experience, and that is my personal choice to make.

What people should be complaining about is insurance and credit card companies which buy incomplete and incorrect sets of data and judge your credit rating based on it (it's happened to me). Now thats dodgy.

Re:Why shouldn't google be able to link data?

[Bandman]

and the government could sell our SSN's to the highest bidder to bring down the debt.

It's at least as likely. Look at the track record of Google versus the track record of the Govt. Which one would you rather play poker with?

Microsoft Exchange?

[Wingchild]

"Residual copies of email may remain on our systems, even after you have deleted them from your mailbox or after the termination of your account," Google's Gmail says in its privacy and terms of use sections.

snip

"If a person deletes an email, he should be confident that email is actually deleted," said Maurice Westerling, co-founder of Bits of Freedom, another privacy interest group, based in the Netherlands.

MS Exchange has settings for the email retention period. If you delete something from your mailbox in Outlook, then empty your Trash folder, it's effectively gone from your view and you've no way to retrieve it. It is however stored in Exchange for as long as the administrators wish to hang onto it (and that "deleted" email is, indeed, backed up and restorable).

If you shift-delete an object out of your Inbox, using that wonderful permanent-kill technique that the tech-savvy thinks protects and anonymizes their email... it's stored for the email retention period listed by the sysadmins, is backed up, and is restorable. It looks very dead to /you/, but not to /us/.

(fyi, the only real way around this is to edit your Outlook client so that you can get the Recover Deleted Items option on every object in your inbox [as opposed to just the Recycle Bin], then habitually view -- and purge -- that information on a schedule that is more frequent than the one used for our backups. That'd work.)

Anyway, the shorter point is, this kind of thing happens. The reason is happens is liability. If a criminal organization is using Google's GMail system for planning a robbery, or if a terrorist group decides they want to attack rail systems in Europe and wants to do so by using random public terminals to sign into email accounts that someone else hosts, it's a problem. If law enforcement comes looking and Google has to say "Oh, sorry - we respect privacy so much that we absolutely and permanently delete all traces of all email the second you touch the delete object!", it will not be a pleasant thing. The investigators will not be happy.

Alternate question; do you really think that your email is permanently gone from Yahoo! and Hotmail?

Do you really think they can't restore to an arbitrary point in time?

Do you think they wouldn't turn that info over to law enforcement in a heartbeat if a court order came down? :)

Are the rules /that/ different in Europe?

Re:Microsoft Exchange?

[Rick Zeman]

Anyway, the shorter point is, this kind of thing happens. The reason is happens is liability. If a criminal organization is using Google's GMail system for planning a robbery, or if a terrorist group decides they want to attack rail systems in Europe and wants to do so by using random public terminals to sign into email accounts that someone else hosts, it's a problem. If law enforcement comes looking and Google has to say "Oh, sorry - we respect privacy so much that we absolutely and permanently delete all traces of all email the second you touch the delete object!", it will not be a pleasant thing. The investigators will not be happy.

That's an interesting point. They might not be happy, but so? Does anyone have a legal (vs. moral) obligation to retain every piece of data Just In Case There's A Terrorist Hiding Under The Bed? Same with corporations. There's no law saying you need to have an email retention period of x, right? Companies do it for business reasons, not because it's mandatory (and in many cases [hello, Microsoft] it's come back to bite them in the ass).

Re:Microsoft Exchange?

[dave420]

The real reason they're keeping the data is the way google's distributed file system works.

It uses 64mb-chunks of disk space, and instead of erasing data from within the chunk, it just flags it as deleted, thereby not fragmenting the filesystem fantastically. That method means it's practically impossible to delete the email.

It has to be kept on their filesystem as the inbox is searchable, and 1gb large - raid arrays just wouldn't cope with that stress (and it'd take 3 days to search your mail). The filesystem is the real genius of google - their system is made of hundreds of terabytes of storage on a distributed system. Thousands of servers running redundantly. When one dies (with that many it's a regular occurance) it gets swapped out seamlessly. The processing on the data also requires huge bandwidth throughput.

To me, it looks like the google boys found a great use for their systems, but the very methods that make them great contradict local law in some areas they're selling in.

Oh, and the rules are that different in europe ;)

Re:Microsoft Exchange?

[duffbeer703]

That argument is bunk.

With a system like that, you could implement a system where "deleted" chunks get purged or overwritten on some semi-regular basis.

Re:Microsoft Exchange?

[HidingMyName]

The real reason they're keeping the data is the way google's distributed file system work

That argument is bunk.

With a system like that, you could implement a system where "deleted" chunks get purged or overwritten on some semi-regular basis.

It is possible that the grand parent poster did not get the motivation for making the users agree to allow google to maintain the data correct. However, his assertion that backups, checkpointing, caching and distributed storage cause privacy concerns is accurate, and it is a hard problem.

HIPAA (U.S. law which includes penalties for disclosing confidential health information)and other regulations have caused serious concerns in the database and data mining research community (contrary to popular opinion not all data miners want to strip you of your privacy). Rakesh Agrawal, Jerry Kiernan and Ramakrishnan Srikant (major data base researchers, Srikant and Agrawal made groundbreaking contributions to the field of data mining) published recently (well about 2 years ago or so) on Hippocratic Databases (in gzipped PostScript), where he describes the hard problem of making the database forget information to conform to legal and ethical restrictions.

Read it.

[mystery_bowler]

Here is the privacy policy.

I didn't see anything in there about this particular topic, although there is a bit about the fact that they will be using cookies (natch).

Personally, I find it hard to be too concerned about this. My web-surfing patterns are already recorded in a "soft" way via my browser history and a much "harder" way via my ISP's access logs. I can go out of my way to use proxies and make it difficult to trace, etc, but it isn't like you can't figure out what my machine is doing (unless I'm doing some fairly advanced stuff).

Americans, wake up!

[Infonaut]

This is about European Union privacy laws, which are different than those in the United States. It says so multiple times, quite clearly in the article.

One rule for some...

[plumby]

It seems like most of the comments so far are along the lines "it's voluntary, google should be allowed to do what they want."

It would be interesting to see the reaction on /. if this had been a Microsoft service.

Re:One rule for some...

[System.out.println()]

If this had been a Microsoft service, it would be (crappily) integrated into the OS and locked out from any other competitors.

Re:One rule for some...

[AlecC]

It would be interesting to see the reaction on /. if this had been a Microsoft service.

I don't think most people would have a problem, as long as it was not useable only from Windows, or only with MSIE, or other lock-in strategy.

Hotmail doesn't work with Opera: I wonder why. Accidental "We cannot possible test with every browser"? Or deliberate "We don't want to encourage browsers other than ours"? Or between "Opera compatability is bottom of the list"? It looks to me as if M$ is trying to use Hotmail as a lever against any competitor. If Google shows a sniff of such an attude, I will criticise it - but not till then.

Data Protection Act

[Aardpig]

Look, they aren't charging for the service, nor are they forcing you to use it.

Whether its free or not is irrelevant. In the UK, there is legislation (the so-called Data Protection Act ) which places tight constraints on how personal data is archived and managed. If the Google mail service falls foul of this act, then it does not matter whether or not the service is free; it is still breaking the law.

Re:Data Protection Act

[AlecC]

But the DPA prevents usage of personal information for purposes other than that for which it was collected. If anybody explains why they are collecting information about you, and receives your OK to do so (opt-in, not opt-out), it does not seem to me that they are breaking the DPA. Google is very open. If they put all this clearly (as they do) in their Terms and Conditions, and then keep to their word, I don't see that the DPA being involved.

Not that simple

[GreenCrackBaby]

The article is very clear: privacy groups aren't just arguing that Google is violating privacy, they are arguing that Google is violating the law (by violating privacy).

It seems that European privacy law is much more strict than US law, and by retaining a subscriber's email even after they have deleted it or cancelled their account Google is breaking those laws.

Huge difference.

Re:Not that simple

[jaaron]

It seems that European privacy law is much more strict than US law, and by retaining a subscriber's email even after they have deleted it or cancelled their account Google is breaking those laws.

Cool. Looks like the rest of us won't have to compete with all the Europeans for cool gmail addresses. :)

Another option is that gmail just won't be available in Europe.

Re:Not that simple

[Chris_Jefferson]

It would be interesting to see if they are simply the first people to admit this.

Do you think AOL, Hotmail, Yahoo! mail and every other ISP in the world dig through their backups when you quit and make sure they delete all copies of your mail? I'd be very, very, very surprised if they do.

Re:Not that simple

[Tony Hoyle]

Presumably you haven't read the "Declaration on Combating Terrorism" that the EU member states ratified without any fanfare (or public consultation) a week or so ago.

It makes the US Patriot act look like a walk in the park. gmail is just a distraction.. whilst we're bickering over that our 'privacy' is lost anyway.

One of its measures is the *mandatory* retention of all communications data within europe (inc. email, phone calls, mobile phone calls, faxes and internet usage). No idea how they're going to do that... it'll require a damn big SCSI disk :)

Add to that the compulsory fingerprinting of everyone in Europe, the introduction of biometric passports, tracking all travel in, out and within Europe and retaining this data, oh and the government gets automatic right to inspect your back accounts too...

http://www.statewatch.org/news/2004/mar/swscoreb oa rd.pdf

Fighting initial reactions...

[Valejo]

When I first heard about the privacy concerns involved in the Gmail project, my initial reaction was to trust Google no matter what to "Do no evil." However, perhaps we should put aside our love for the company and ask critically whether this breeches acceptable advertising practices. For me, I'm uneasy with the idea of saving "deleted" mail.

Privacy Groups

[Fortress]

Any one else think it's odd that a privacy group is complaing about a service that isn't available to the public yet? I'm all for privacy, but let's pick the reasonable battles. It will be repeated ad nauseum here, but you don't HAVE to sign up for Gmail.

I would much rather that privacy groups spend their finite resources fighting the stuff we don't have the option of avoiding, Big Government and such.

Seems like any other organization, privacy groups have to justify their existence by creating problems where none exist.

Knee Jerk reaction

[AlecC]

This seems to me to be very much a knee-jerk reaction. Provided that Google is up-fromt will all this, why shouldn't I be given the opportunity to opt-in to such a service? I entirely agree that this should not be done secretly - but Google is very upfront. Surely it is not an invasion of privacy if I explicitly accept that Google will scan my mail as part of paying for the service.

I like Google Adwords. Given that advertising is an endemic part of life, and is not going to go away, Adwords is the way I want it. Let Google take all the advertising revenue with Adwords, and may the popup merchants go broke. If Google want to offer a paid-for non-Adwords service, I shall think about it - and probably not buy it.

As to keeping some of your email when you delete it - I don't think this is intentional. AFAICS Google has a "weak delete" policy - they try to recover deleted space, but if they don't recover it all, too bad - disks are cheap. So there may well be old copies of your emails hanging round. What the hell - they are not indexed, so it will take a deep search to find it. Do Yahoo, Hotmail & Co guarantee a destructive overwrite when they delete your mail? I doubt it - in which case they might have an old copy lying round on their disks.

So, privacy people, don't spoil what looks like it might (subject to confirmation, of course) be a useful, opt-in service because of arcane potential privacy problems.

Re:Knee Jerk reaction

[admbws]

On subject of deletion, I was thinking a similar thing myself.

The term in question is,

"Residual copies of email may remain on our systems, even after you have deleted them from your mailbox or after the termination of your account."

On most filesystems, deleted files are not deleted completely, they remain physically on disk and, provided the now-free space has not been subsequently overwritten, could potentially be retrieved with appropriate tools. This is what Google means by "residual copies", and I wouldn't be at all surprised if that is the case with Yahoo!, Hotmail or any other free email provider, Google is just being honest about it! Good on you Google!

I know

[nickol]

Every day I'm sending them about 30 emails
in spam report. The same spam keeps coming
again and again.

Well, even if they wanted... They'd have to
hire at least the whole population of China.
Or invent a REAL artificial intelligence, which
itself has more value than all our Yahoo mails.

Re:Hello?!

[Martin Blank]

Thank you.

I have several credit cards attached to my frequent flier program. I get a couple more e-mails and a couple more snail mails a month, but for no additional effort on my part (except for skimming through a couple of offers each month), I get a few thousand extra frequent flier miles each year. It's not enough for a free flight on its own, but it can push me over the edge if I'm close enough.

They have all kinds of information on me -- spending habits, information on where I live and where I travel -- but I entered into the contract willingly. I gave up a small part of my privacy in exchange for a benefit to me.

Every service "reads" your mail

[rjstanford]

I mean, think about it. Let's say that you have webmail with one of the other major providers. Somebody sends you mail. You reply. They reply. Now your email has a couple of levels of ">" in it. Wouldn't it be nice if they highlighted those in different colors or something?

Oh, wait - they already do that? (Note: at least, this was common the last time I bothered with webmail which was some time ago). Guess what - that's "reading" your mail as well. In fact, they're just changing your display - without changing the verbal contact of your message - to make it more convenient for you.

Isn't that also a (reaching, but legitimate) description of providing targetted advertising? I mean, how many times have people here on /. said about ads that if they made sense, they wouldn't mind 'em? Guess what - that's targetting. And how they're supposed to make sense and be timely without some kind of processing is beyond me.

As for the article's complaint, it seems to focus around the fact that when you "delete" an email, Google doesn't guarantee that it goes away immediately. Their message seems to be talking about cache updates though - if they were willing to amend it with a service guarantee that within xx hours your email would be deleted, that would probably do the trick. Of course, then people would be arguing that they needed to provide complete file-trashing (triple overwrite, etc) as well, even though your regular email client and ISPs email account probably don't do that.

I think its just a case of being too cautious in their terms of use. In this case, being too honest where the other major providers are being "honest enough," and not worrying about caches, et cetera. Of course, they may be planning to use your old email for nefarious purposes, but somehow I doubt it. Either way, they should clarify their statement.

Email is not private

[lordbios]

Email in its basic form is not, nor has never been, private. There have never been any promises that email was private. I remember from the first time I used email that it was always likened to mailing stuff on a postcard, not in a sealed envelope. It's also not like Google is trying to hide the fact that they are scanning your emails. It is right out in the open in the terms of agreement. If you don't agree, don't sign up...

moreover...

[moviepig.com]

The retiree who lives across my street is able to watch me leave my house each morning. She thus can chronolog my work-habits, mood, weight, fashion-sense, etc.

I've petitioned the town council to have her windows boarded up.

You get what you pay for

[HarveyBirdman]

Am I the only one with ZERO sympathy when users of FREE services whine?

April Fools

[doublesix]

Is it just me or is this whole GMail thing an April Fools prank gone horribly wrong?
Read the Google news release again:
The inspiration for Gmail came from a Google user complaining about the poor quality of existing email services, recalled Larry Page, Google co-founder and president, Products. "She kvetched about spending all her time filing messages or trying to find them," Page said. "And when she's not doing that, she has to delete email like crazy to stay under the obligatory four megabyte limit. So she asked, 'Can't you people fix this?'"
The idea that there could be a better way to handle email caught the attention of a Google engineer who thought it might be a good "20 percent time" project. (Google requires engineers to spend a day a week on projects that interest them, unrelated to their day jobs). Millions of M&Ms later, Gmail was born.
Kinda fishy.

so don't use it

[hekal]

if you're so concerned about gmail, stick with M$ hatemail and the 1mb limit or whatever that piece of crap gives you.

Re:Don't Like it, Don't Use It

[blane.bramble]

As has been stated elsewhere, this isn't about whether or not Google's policies state what they are doing, it is about whether such a policy breaks European privacy laws. Would you let a European company offer a service in the US that was illegal, as long as it wasn't compulsory to use it?

The conflict is with EU law

[viralbus]

As it is clearly stated in the article, the problem is with EU law, which among other things states that individuals are in charge of information about them; this means that they can request to see all information held about them and to get it deleted. Storing private emails after the user has deleted them seems to run counter to this law.

Furthermore, in many EU countries there are certain rights that you cannot sign away in a contract, so Google cannot just point to the terms and conditions.

The solution might be to prevent EU residents from signing up to Gmail.

Re:The conflict is with EU law

[eetiiyupy]

The EU law which might cause the conflict is the Data Protection Directive (95/46/EC). The policy of this law is to try to give citizens some control over what happens to personal data about them. In particular I can consent to some company controlling my personal data within limits which we agree but constrained by law. Google can collect that data, and I expect that the local spooks will want them to hang on to it even when an account is deleted. As long as it is clear that the retention of data following deletion of an account is only for law enforcement and not for commercial purposes they might be OK. Suppose Google is bought by a mega-corp we don't like, it's going to be a real pain for us all to change our email addresses, and what is this new owner going to be able to do with all of that personal data. Data Protection law is not such a bad idea.

At least SOMEONE is concerned about this

[goldspider]

Like I said yesterday, it's time people stopped thinking of Google as a purely benevolent, community-oriented provider of goodness, and started to think of them as a company out to make money (especially with the impending IPO).

We don't give Microsoft a free pass, and it's time we stopped giving Google the benefit of the doubt. This whole GMail thing REEKS of privacy abuse potential.

Re:At least SOMEONE is concerned about this

[wheany]

Around here there are people who think that Microsoft is evil. There are also people who think that Google is evil. These groups might have some overlap.

Slashdot is not a collective mind. You are not the only free thinker.

Re:At least SOMEONE is concerned about this

[mdfst13]

"Microsoft is just trying to make money too. So why then do people around here believe Microsoft is EVIL, when they have the choice to simply use something else (like LINUX)."

Microsoft actively tries to destroy companies that it thinks might interfere with their monopoly. Further, it uses its monopoly position to force deals upon other companies (for example, if you sold *any* PCs with Microsoft OSes, you had to pay a licensing fee even for those machines that did *not* have the Microsoft OS installed). Google has never done anything like this, AFAIK. Microsoft leverages its monopoly by requiring people who accept one piece to accept others (e.g. their EU case). Google offers people the *option* of using this service (and it is possible that they may not be able to offer the *option* in Europe if this is a real limitation; more likely, they will just tweak their service to bring it in line).

It's not making money/not making money. It's living honorably when you're at the top. Google traditionally has; Microsoft traditionally has not.

Re:At least SOMEONE is concerned about this

[Orne]

Repeat after me, We are all free thinkers...

We are all free thinkers...

Re:At least SOMEONE is concerned about this

[Richthofen80]

purely benevolent, community-oriented provider of goodness, and started to think of them as a company out to make money

why are the two mutually exclusive? Why can't google make a good service, and be paid for providing that service?

It is not from the benevolence of the butcher, the brewer, or the baker, that we expect our dinner, but from their regard to their own self-interest. We address ourselves, not to their humanity but to their self-love, and never talk to them of our own neccessities but of their advantages."
-- Adam Smith

Re:At least SOMEONE is concerned about this

[Catbeller]

Repeat after me, We are all free thinkers...

So, if... we do question Google's future use of private information... we are... groupthinkers? And if we don't, we are... free thinkers! Got it. Thanks. Free is good, groupthink bad.

Slavery is freedom, ignorance is strength, up is down, we are saving Iraq for noble purposes...

We have a winner

[HarveyBirdman]

I will note, however, that at least in the United States we went ahead and outlawed indentured servitude

You just won silliest analogy on Slashdot for the day.

A coupon for a free "dinner for one" at the Country Kitchen Buffet is headed you way, and will arrive in a year or two.

Lots of ways to get yourself in the GMail database

[Anonymous Coward]

OK fine. So you don't have a GMail account, but what if you send mail to one?

Your boss: "I'm on the road - send me your status report IMMEDIATELY to yourboss@gmail.com"

Recruiter: "I have a job for you - send me your resume at somerecruiter@gmail.com..."

Hosted at Yahoo?

[cgenman]

Does anybody else find it creepy that this article is posted at Yahoo?

I don't want to jump on the SlashThink wagon, but does anyone storing e-mails on a free remote server have an expectation of privacy about automated searches and indexing? After all, your e-mail has to be read by machine at some point or another, or it isn't an e-mail. And is should be backed up. The only thing I can see about this is Google stuck their foot firmly in their mouth about basically accepted industry practices.

Unable to delete the past...

[lewko]

It's hardly a new problem on the Internet that one can't delete messages from the past...

Deal

[caitsith01]

Ok, that's fine. But when I decide the deal is off, I want a guarantee that you will personally go through every marketing database on earth and delete my details, so I am totally free and clear.

No? Well maybe we could just REGULATE IT NOW BEFORE IT'S A FUCKING PROBLEM THEN.

Sorry, but I am sick to death of this 'well then don't use it then' argument. 'Complaining' has another name, and it's 'telling a company what the consumer wants.' In this case the geek user market wants better privacy, so why do you insist on defending Google?

Re:Deal

[JordanH]

• But when I decide the deal is off...

Why do you get to decide unilaterally when the deal is off?

• 'Complaining' has another name, and it's 'telling a company what the consumer wants.' In this case the geek user market wants better privacy, so why do you insist on defending Google?

"Defending Google" here is defending the right to enter into agreements. You, apparently, want to be protected from your decisions by being able to change the terms of service if you don't like them at a later date and you want the force of law, through regulation, to enforce your preference.

You don't need regulation, you need to be responsible for your decisions.

Your concerns might be valid, I don't know. But, and I know you are sick to death of this, if you feel this way, "DON'T USE IT THEN". That would be a way of 'telling a company what the consumer wants'. But, you don't really want to tell a company what the consumer wants, you want to force the company to provide a service that you want.

Obvious

[Rotting]

Is it not obvious that there would be something like this associated with their service? They are offering far more than the norm as far as space for the email is concerned (I believe 5mb is roughly the norm).

How naive would someone have to be to believe that they are simply offering 1gb to anyone and everyone for absolutely nothing in return.

It started as google.com, not google.org ;)

They're all watching me

[minus9]

I'm sure the first thing the hotmail staff do when they get into work on a morning is read all my mail to find out what a fascinating life I lead.

As soon as Bill Gates and his henchmen manage to reconcile the facts that I am a 104 year old man from Zimbabwe, lots of hot teens want to meet me and I have a massive interest in cable descramblers then I am sure they have some evil plan to oppress me.

Re:They're all watching me

[TheSpoom]

Y'know, someone complained about this. Just thought you should know.

To much tin foil in the air

[cyberlotnet]

Whats the diffrence between Hotmail, Yahoo, Every other free email provider out there And Google..

Nothing, google is just upfront and honest about whats happening to your emails.

They have to "scan" through them to provide virus and spam protection.

They will use there distributed approach to searching to provide fast web based email services. This means your email could be on 100's of there servers at the same time. When you hit delete it might take a while for it to be removed from all systems.

Here a company steps forward and is 100% honest about what they are doing and we flame them.

No wonder we have to deal with lame support and excuses from companys every day.

Re:PGP anyone?

[1u3hr]

If you're concerned about privacy in your emails, why not use encryption? The freeware PGP-type solutions are reasonably secure and quite simple to use.

I got excited about this almost ten years ago. I installed PGP in my email client, made my keyring (or whatever it's called) and sent a few test messages to myself. After a couple of years in which time I never found anyone who even understood the idea, I gave up, never bothered to reinstall when I moved to a new PC.

Re:Legal rights can usually be waived

[Gumshoe]

Not even the UK Data Protection Act (which exists in various implementations throughout the EU) prevents people from voluntarily submitting information about themselves and allowing Google to store that information indefinitely, if they so like.

I don't think that's the problem. The UK Data Protection Act requires that personal information be purged if the person in question requests it. Google seem to be saying that there is no assurance that this will happen. From Google's privacy policy "[Google does not] guarantee the deletion of emails that are archived even if you cancel your account."

It's good that Google are being up front about this but even so, it simply isn't compatable with UK law.

An advantage of not using IE.

[BCW2]

I use Netscape and Mozilla. I started each off with an empty cookie file and visited the sites I wanted to not log into later, like /. . I saved a copy of this file as cookies2. n=Now when I'm done I delete the cookie file and save cookies2 as cookies and avoid all the spyware crap everyone thinks they deserve.
Also if you block all third party cookies, you much less crap to delete anyway.

Re:Privacy policy is here

[scrm]

btw. I tried to sign up, but they send an email to you with a link to activate your account, but I still didnt get the mail (its been 6 hours)...

This happened as soon as I had to submit my reg form:

Warning: mail(): Could not execute mail delivery program '/usr/sbin/sendmail -t -i ' in /var/www/www.spymac.com/classes/global_class.inc on line 617

So it would seem registrations aren't really working on their end. Sorry but I wouldn't say SpyMac isn't looking like a viable alternative to something Google can put out (yet)...

Government-backed blocking of services?

[Anders Andersson]

I was intrigued by the following statement in the article:

Government-backed privacy agencies in Sweden and Germany, however, have blocked commercial services because personal information required in order to sign up would be stored on U.S.-based computers.

I live in Sweden. I don't know about Germany, but I have never heard of any government-backed agency in Sweden actually blocking access to foreign services for any reason, and in particular not for such a silly reason as sign-up procedures not compliant with Swedish law! If anyone can guess what the article author is referring to here, please let me know.

I have been trying for years to have my employer (a state university) merely consider blocking certain foreign ISPs from pouring junk mail over ourselves, but every suggested policy in that direction has either been rejected with a vague reference to the law prohibiting that, or not seen any response at all. I find it hard to believe that anybody in Swedish public administration would officially approve of blocking third-party traffic, let alone actually do it.

Re:Lots of ways to get yourself in the GMail datab

[robin_j]

OK fine. So you don't have a GMail account, but what if you send mail to one?

Again I would imagine that it is your concern whom you send mail to, if you don't trust a mail domain then you should not send mail to it. This is valid not matter what domain you are sending to.

If you are going to argue about the sender not being aware of what is going to happen to their mail remeber that's the same when you send to Hotmail or whatever, it's up to you to read the fine print when you send mail to someone.

Read the WHOLE article

[spleck]

The slashdot post and the second half of the article point out the complaint that Google has the capability to link all your past searches to the email you input to be kept informed of GMail developments. This would be something that is happening NOW, not later.

While I optimistically doubt Google will ever do anything heinous by linking my searches for "home construction photos" and "windows 2000 webdav locks up" to my email account, I recognize that some people don't want their searches for "cat snuff films" and "dog attacks cat" linked to their email, catlover@mail.com.

Could be same complaint vs other surveilancegimick

[SgtChaireBourne]

You could make similar complaints against the other surveilance services that Google is getting into. The privacy statement for their 6-degrees/friendster ripoff amounts to that any data you're dumb enough to enter about yourself or others is private unless a laywer asks for it and mentions DMCA in the request.

Basically between the archived e-mail, the search engine cookies and the social networking engine, there is an excellent, detailed data set.

European privacy law is, for the time being, much stricter than in the U.S. and it would be a good thing to bring the U.S. up to standard. Likewise, some countries are years (238 years) ahead of the U.S., Britain, France and a few others in regards to keeping public records accessible. If the U.S. and the EU had the same public access as Sweden and Finland have written into their constitution, more than a few expensive scandals could have been prevented.

Crybabies

[lo_fye]

Boo hoo!
Somebody call the whaaaaambulance!

First: If you read the EULA before you checked the box, you'd know about how they're going to use the info. So, it's not an invasion of your privacy. You told them they could do it! You 'signed the contract'.

Second: They're not trying to hide what they're doing AT ALL. They should be commended for that. It's stated right there on the main page.

Third: You should know by now that privacy doesn't exist. If you need to hide something, don't hide it on a cheapass server owned by someone else. Get your own co-located box and encrypt your mofo-email! PGP, baby. Or get a Hushmail account.

Fourth: It really is a genius revenue model. Minimally invasive. Text-ads are acceptable. Unlike Hotmail & Yahoo, Gmail won't have any annoying banner ads or pop-ups. That is awesome.

Re:NSA

[wulfhound]

The problem is not so much one of monitoring by governments and ISPs. Western governments by and large really do not care that much, and, in any case strong crypto and spoofing of all varieties is readily enough available that those who want privacy for high-value matters relating to, say, business, or national security, that it's not such a worry in those spheres.

For me it's more a case of - these days, once the Govt., or the intelligence and security services, have this monitoring infrastructure, it goes something like this:-

Year 1: The tax and benefits departments in the Govt will ask the spooks to start sharing. The police will ask for access also.

Year 2: The entire Government - health, pensions, local govt. etc., education - will all want it. Schools will use it to vet new employees.

Year 3: Security-conscious corporations like banks and airlines will demand access.

Year 4: The whole damn lot will be available on a couple of DVDs at your friendly local market... at least if you live in Moscow or Jakarta.

Year 5: "Check Other Peoples' Email" toolbar appears on Google. The dying embers of the snailmail service are suddenly brought back to life by the return to fashion of the traditional love letter.

Damn you, Slashdot!

[feidaykin]

I saw that headline and I thought, "OH my god I can sign up already? 1GB here I come!" and bashed gmail.com into my keyboard with great fury in an effort to get my free gigabyte, and what do I see but a FAQ that tells me they are in a closed testing phase.

Dumb slashdot gets me all worked up over nothing. Now granted, I suppose I could do things like, read beyond the headline, but, well, it's slashdot.

Anyway, yeah, privacy complaints, sure. For a service that nobody can use yet. You know, I'd like to register a privacy complaint for Duke Nukem Forver, there's some nasty DRM in that. And I think my sky car is bugged with a hidden camera.

You know, I honestly don't know why I'm even typing this crap. I mean, I'm trying to be funny I guess, but ever since they took the funny karma bonus away, you know, what's the point? The Slashdot FAQ tells me that I have to be smart, not just a smart ass. Well, sorry Taco, I don't know how to do that. So I, like the smartass I am, will now click the "Submit" button, and watch my karma cook!

Re:Lots of ways to get yourself in the GMail datab

[tricops]

So you send email to their address at GMail, and... okay...

I suppose it could link the contents of the email to your email address/name
(which they could already anyway), but it can't place a cookie of any type on
your system by receiving an email from you. So, the person you're sending to
might be profiled from the email, but that was happening anyway. They made
the choice to subject themselves to it.

You're still personally as safe from that as you ever were.

Re:NSA

[rjelks]

Privacy isn't just an issue of "Big Brother." Identity theft is a real concern here in the US.

"More than 27 million Americans have been victims of identity theft in the last five years, a survey released today by the Government estimated, including nearly 10 million in the last year alone. " (Source: NYTimes, September 3, 2003)

"According to the [2003 FTC] survey, 67 percent of the respondents said their credit card accounts had been misused in the past year. Another 19 percent said thieves had tapped into their checking or savings accounts." (Source: NYTimes, September 3, 2003)

"Around 80% of computer crime is committed by 'insiders'. The 20% that is not done by insiders, manage to steal $100 million by some estimates; $1 billion by others." (Source: Web Crime Statistics. www.intergov.org)

Europe has much stricter privacy laws and as a result, they have much less identity fraud. I'd welcome more restrictions in the US about privacy. The bottom line is, Google does business in Europe, and their privacy statement may conflict with their laws...complaint filed.

-

It's because they know your search history

[seaton carew]

...and can link it to YOU as soon as you "register" for Gmail.

I felt pretty dumb, having given them my prime email address (myfirstname@mylastname.net), then realising afterwards that through the magic everlasting cookie I had just enabled Google to link every search I had ever done back to ME personally. Like, DUH!
Heck, I don't even know what "interesting" data might be in there, but seeing as it's about ME, I damn well ought to be able to get access to it (under UK law).

More here.

That is what people are getting annoyed about - not the email service itself, just the registration process.

Re:PGP anyone?

[Bitseeker]

That's exactly the problem on two fronts:

1. User's seem to think email is private. It's nothing more than an electronic postcard. Who in the general public thinks a postcard is private?
2. Why don't email clients have built-in PGP/GnuPG? It should be completely transparent to users and just work in order to get everyone to use it.

Re:Lots of ways to get yourself in the GMail datab

[Octagon Most]

"OK fine. So you don't have a GMail account, but what if you send mail to one?"

Additionally, it won't actually be that easy to tell if you are sending to a gmail.com domain. For example I own my own domain and simply redirect email to my ISP email account rather than pay for email hosting. So if you send email to any of my email addresses (something @ mydomain.com) you have no idea where it is actually going. Not currently to any webmail service, but in the future, who knows?