EPIC Sues FTC Over Google's Planned Privacy Changes

angry tapir writes "The Electronic Privacy Information Center has filed a lawsuit against the U.S. Federal Trade Commission, asking a court to force the agency to take action against Google over planned changes in the company's collection of personal data. EPIC, in briefs filed Wednesday, asked the U.S. District Court for the District of Columbia to require the FTC to enforce a 2011 privacy agreement between the agency and Google over the company's fumbled rollout of its Buzz social networking service."

Comments

Re:Slashdot is dead

[leoplan2]

Tl;dr: If you don't like this site, stop visiting it. Go and read WMPowerUser, Microsoft News, Gizmodo, Macrumors, Cult of Mac, etc. There is a lot of choice out there

EPIC

[Narcocide]

What on earth... why are all these trolls so angry?

Re:EPIC

[NeutronCowboy]

Ok, I don't understand. On the one hand, Google is forced to implement a comprehensive privacy program. On the other hand, EPIC complains that Google's new privacy rules are.... too comprehensive? Can someone point me to what is actually changing in the privacy terms that is actually so bad? As far as I can tell, everyone's just complaining that the policies are going to be merged. So instead of having 20 separate privacy policies, now each service is governed by the same. How is that bad?

Just wondering, cuz I seriously don't get the outrage.

Re:EPIC

[c0lo]

What on earth... why are all these trolls so angry?

Maybe it is not because Google will combine the privacy policies into a single one, but also all the users data across all its services?

Perhaps the move will no longer let you share individual services data, like sharing your Google+ data but withhold your Calendar?
If so, would you still be considering trolls the guys at EPIC?

Re:EPIC

[martin-boundary]

So instead of having 20 separate privacy policies, now each service is governed by the same. How is that bad?

Well, IANAL but a priori, it's rather obvious that if you have several privacy policies that aren't exactly the same, then when you replace them all with a single one, you must lose some rights that you had for some services, and possibly gain some other rights that you had for some other services. So you end up with a different mix from what you initially signed up for in a given service. If you were happy with the original policies, you may not like the new ones.

Aw crap! That reads like a lawyer's explanation. When I die, I'll go straight to Hell, and the only computer languages allowed will be Javascript....

Re:EPIC

[buback]

Meanwhile: Facebook changes it's privacy policy for the 20th time since the announcement of google's policy change.

Re:EPIC

[NeutronCowboy]

How is that a surprise? I thought that was already done. Especially considering you log into the calendar and G+ service with the same username.... again, how is that a friggin surprise, or a problem?

Re:EPIC

[mgiuca]

Maybe it is not because Google will combine the privacy policies into a single one, but also all the users data across all its services?

Yep, that's certainly the idea. Note that most of Google's existing privacy policies already did give them the ability to share user's data across all its services. For example, YouTube already shows videos that your friends share on Google+. The problem was that they were inconsistent. Google cannot currently share data from YouTube with other sites. Their new policy allows them to do that. This is all explained in their letter to U.S. Congress.

Now what exactly is the problem with this? It seems to me that if Google is going to share my data, there are three sets of people they could share it with:

• Third-party companies, such as advertisers (e.g., selling your personal data for profit)
• Your social connections (e.g., sharing your personal information without your permission)
• You (e.g., showing you ads relevant to your interests)

I see a significant harm if they were to engage in the first two. I don't really have a problem with the third. And this privacy policy specifically prevents them from doing the first two. So what this allows them to do is share my information, from one Google service to another, for the purposes of showing me relevant links and ads. In that case, where is the harm? Further, how am I worse off having, for example, Google search results informed by what YouTube videos I've been watching. It sounds like it could give me more relevant search results.

Further, I would much rather know that anything I upload to any Google service might be used by any other Google service, than have to remember a complex set of rules about which products' privacy policies allow Google to share data with which other products.

Perhaps the move will no longer let you share individual services data, like sharing your Google+ data but withhold your Calendar?

What does this mean? What do you mean by "share" in this context? Withhold your Calendar from whom? As far as I am concerned, the only people who have access to my calendar are me and Google's servers. If the Google+ app had access to my calendar (for example, it might show appointments on the side), that doesn't increase the people who have access to my calendar: It's still just me and Google's servers.

Since when did any company give you explicit control over how the data is stored on their servers? With Google's new policy, it is simple: if you use a service, your data for that service will be stored on Google and may be used by any other service within that company (and not sold to third parties). How is that harmful? How is that different to any other company?

Re:EPIC

[tlhIngan]

Ok, I don't understand. On the one hand, Google is forced to implement a comprehensive privacy program. On the other hand, EPIC complains that Google's new privacy rules are.... too comprehensive? Can someone point me to what is actually changing in the privacy terms that is actually so bad? As far as I can tell, everyone's just complaining that the policies are going to be merged. So instead of having 20 separate privacy policies, now each service is governed by the same. How is that bad?

I think the outrage is simple.

Google has a different privacy policy for each of its services, and if it decides it wants to share the data between services, the conflict makes it a legal nightmare.

Unifying the privacy policy - a great idea, because it simplifies life for everyone. However, one of the changes is that Google will also unify your profile data among all services (it could once the new policy was in place, but I believe afterwards, it said it will).

So now everything you've ever done (your youtube, your browsing (double click, google ads, CDN, any site that uses a Google-hosted javascript or something), picasa, your searches) will be available in one, all linked nicely to your details you put on your G+ page. Even what Android or iOS apps you used and how long you used them.

It's like the supermarket cards - all the juicy details of your shopping habits is pure gold to insurance companies.

Basically, you cannot use the Internet without Google - even if you use Bing exclusively, never go to YouTube and other Google projects, there's a ton of other crap hosted by Google that your web experience would suck worse than with NoScript.

If you've put up a carefully written Facebook pages, carefully choose your friends, your real self will be exposed to Google I'm sure employers and marketing ages will be anteing up lots of money to see your real self - what websites you view, what you've searched, what kind of videos you browsed. A veritable gold mine.

Re:EPIC

[mgiuca]

Okay, so those approximately match my first and second sharing types in my list of three. For #1, they state that they will not do this in the new policy:

We do not share personal information with companies, organizations and individuals outside of Google unless...

The "unless" includes a bunch of exceptions, which I don't see as a big deal but you may disagree. In summary, a) if you give them permission, b) if you have a domain administrator (doesn't apply to normal users), c) with a third party affiliate for "processing", which must also agree to the privacy policy (not quite sure what that means), d) if compelled to by a court.

For #2, that isn't what they meant at all by "sharing information between services". It does NOT imply that, for example, your calendar would be randomly shared on Google+. It only means that they will share data with you and you alone, across services (for example, to give you relevant results and ads). If you haven't used Google+, the sharing is very straightforward and very tightly controlled: only things you explicitly post on there get shared, and every time you share something, it explicitly asks that you nominate a group of people or individuals to share it with, and once posted, that group of people cannot be changed.

Re:EPIC

[icebraining]

your real self will be exposed to Google I'm sure employers and marketing ages will be anteing up lots of money to see your real self - what websites you view, what you've searched, what kind of videos you browsed. A veritable gold mine.

Please tell me how can I as an hypothetical employer access that information about a person without her or his consent.

Google is fucking scary in how much they know about you, but lets not throw lies with it. They offer no way to access that information unless you're law enforcement. Which, again, is bad enough, but not so bad as you're claiming.

Re:EPIC

[DarwinSurvivor]

Actually yes, if the same username and password is used to log into 2 websites owned by the same company, why would you expect the information NOT to be shared?!?

Re:EPIC

[Guidii]

We do not share personal information with companies, organizations and individuals outside of Google unless... The "unless" includes a bunch of exceptions, which I don't see as a big deal but you may disagree. In summary, ...c) with a third party affiliate for "processing", which must also agree to the privacy policy (not quite sure what that means)

c) means that you might, for example, buy something from Google, and they might have to ship it to you. When they put your name on that envelope, they are "sharing" your personally identifiable information with the postal service. This escape clause allows them to do that.

I can't remember ever reading a privacy policy that didn't have this clause in it. The clause usually says that they will only share this PII with responsible types who also have a good privacy policy... and it looks like Google uses the same language.

So I opt out? Consider Tmo

[gearloos]

So, I'm a Tmobile Customer. I opt out. So am I still bound by my contract? I don't particularly need Google snooping any more than they already do, which is considerably. What is the average Joe Android User to do? This is interesting. I know it has no implication if I prefer to not use Google + but they are making Google Plus a mandatory part of using their service. So.. again.. Tmo user opting out. Will Tmo get me out of my contract? interesting...

Re:So I opt out? Consider Tmo

[basotl]

You can still opt out of the data sharing. In addition you can remove Google+ from search results. As far as Google+ it self as long as you don't enter data there is nothing really there.

Re:So I opt out? Consider Tmo

[theshowmecanuck]

Search using Yahoo. Or Bing. Hell, Microsoft is starting to look a lot less evil than Google. Nothing forcing anyone to use Google. So I says fuck 'em. Can't believe I now wish I'd bought an iPhone instead of an android. Next time. Anyway, if people really want to send Google a message, stop using them. Maybe a mass one day general boycott, like on February 15 to protest. Everyone use yahoo or Bing on that day. Just an idea. Spread da word if you think it worth it.

Oops. Principals and principles tainted.

[symbolset]

Interesting. Marc Rotenberg, President and Executive Director of EPIC served as counsel on the Senate Judiciary Committee to PIPA sponsor Patrick Leahy. The very same unconstitutional PIPA that Google just protested against and helped get shut down with your help and mine.

I don't know about you, but a lawyer at counsel who could advise the Chairman of the Senate Judiciary Committee that he could get away with sponsoring a bill that violates not one, but at least two of our human rights enshrined in the Bill of Rights to suit a tiny minority commercial interest might be a wee bit biased.

Odd coincidence, that he's leading the group now suing Google over something or other. How did they expect us to not know that? Do they not have the Google? Are they living in the 1980's still?

In case you don't remember who Senator Leahy is and how he's working against your free speech and due process rights, here's an article with interesting links. Being as how you're reading this though, it's unlikely you don't know this.

And here's former Senator and chairman of the Democratic National Committee Chris Dodd saying if the politicians took the graft they oughtta pass this bill (PIPA and SOPA): link.

Re:Oops. Principals and principles tainted.

[Anonymous Coward]

Interesting. Marc Rotenberg, President and Executive Director of EPIC served as counsel on the Senate Judiciary Committee to PIPA sponsor Patrick Leahy. The very same unconstitutional PIPA that Google just protested against and helped get shut down with your help and mine.

According to that article, Rotenberg served as counsel to Leahy "after graduation from law school". His EPIC biography says he was admitted to the MA bar in 1987 --- so he worked for Leahy around 1987. He co-founded EPIC in 1994.

PIPA was introduced by Leahy in 2011, around 20 years later.

Given everything EPIC has been doing for the last 17 years, it seems more likely (though less "interesting") that Rotenberg didn't like what he saw from his stint with the SJC, and that put him on the alternate path that led to EPIC.

Math is hard, as they say, but valiantly we try.

simple explanation

[dutchwhizzman]

Google did not do the EULA thing just for private single persons, but they signed actual contracts with business users. Those policies get changed as well, not to the benefit of said business users. Those business users have a much stronger case in court to object to the changes, since there is a clear contract, money at stake and all that.

The biggest underlying change, also for businesses, is that in practice Google now reserve the right to have any bit of data they get on you, no matter how, linked to all the other bits of data on you. This applies to both private and business use, or a combination of both. If you think how much google scrapes and logs, they will probably know more about you than your mother, your best friend and your girl/boyfriend combined. Imagine what could happen to your business or personal life if that data got into the hands of a company that actually knows how to mine raw data.... oh wait....

Re:simple explanation

[Col. Klink (retired)]

Those business users have a much stronger case in court to object to the changes, since there is a clear contract, money at stake and all that.

Yes, a great case, except for the fact that the new policy doesn't apply to them at all.

Google search requires cookies now?

[Anonymous Coward]

For privacy reasons I block all cookies with Firefox using Add-on Cookie Monster (Default Action: Rejected) and only allow certain sites for session cookies via Cookie Monster options.

I did not allow any Google cookies until yesterday and Google search worked fine.

But since yesterday, if I search for something, a left mouse click on a result leads to nowhere, or when i "middle" click, to open result in new tab, I get an empty page with a long URL like http://www.google.com/url?sa=t&rct=j&q=reddit&source=web&cd=1&ved=0CD8QFjAA&url=http%3A%2F%2Fwww.reddit.com%2F&ei=CPsyT_z2IM3esgbw_Z3WDA&usg=AFQjCNGP2I23xwAzzicm-TwmDMKVU72m0w&cad=rja

As soon as I enable cookies for Google in Cookie Monster e.g. via "Temporarily Allow", the results open fine.

Can /. confirm this new annoying cookie requirement?

Is this a new "feature" of the privacy-changes?

A slightly different view

[Dhalka226]

So, I think by now a lot of good conversations (and a fair bit of trolling!) have been started in this thread about Google, the changes they want to make, etc. I see no reason to add to that.

What I want to know is simpler: How in the world does EPIC feel it has standing to sue the FCC?

It could sue Google, certainly -- probably as EPIC, but if not it could do it as individual users because each of those users can claim to be effected. But that's where their beef is, and that's where any perceived harm is. The FCC's not blocking a company's change doesn't make them liable for it and it certainly doesn't make them the cause of a tort that EPIC can sue to redress. If there is a violation of law or rights, it originates from Google.

The FCC and Google have an agreement and this may well be in violation of it -- but that is between the FCC and Google. The idea that you can sue a government agency to force it to act in the way you want is pretty ludicrous on its face. How far do you think I would get if I sued the Department of Justice for not arresting Chris Dodd over his claims that the MPAA basically owns the congressmen it donates to?

In finest Slashdot tradition, I am not a lawyer -- but I fully expect this lawsuit to be slapped out of court in short order for lack of standing.