Slashdot Mirror
EU Authorities To Demand Reversal of Google Privacy Policy
judgecorp writes "Google's privacy mechanism, which combines personal data from around 60 products, and gives users only one opportunity to opt out, was rolled out in March against requests from privacy regulators in Europe. Now they want the policy reversed, and user data from the different Google products, including Gmail, Search and YouTube, to be separated. The EU attack is lead by French regulator CNIL, which has historically taken a tough line on privacy matters."
The French may save us yet.
"Yeah, so what if YouTube let you register with a user name before we bought it. We see you don't use a real name. WTF is up with that? Are you a criminal?
[x] My name is ___________________________
[ ] I'm a criminal."
Really, I don't see this as an issue if you're volunteering your personal info to Google anyway. I'm more worried by the tracking that Google does even if you're not logged in, say, via its ad and recaptcha services.
Really though, unlike with Intel or Microsoft, I've never felt like I have been wronged by Google, which is probably why my knee jerk reaction is that this is just another extortion racket and an organization hired to cause a stir.
while(1) attack(People.Sandy);
All these web sites are owned by the same people. Are the EU saying a company can't mine the data the EU says it is allowed to collect? How on earth do you even police that?
Besides, it's a non-issue, as it is under the users control anyway. If you don't want Google tying the data together use different use names on each site. It is not like it is rocket science.
What does opting out of a privacy policy mean? "I refuse to be bound by this policy, so there is no policy and you can do whatever you want with my data"? "I refuse to be bound by this one policy, I prefer a different policy on every google service I use"? And do you expect google (or anyone) to maintain code to implement every privacy policy they've ever had? How would that work?
Opting out of a privacy policy means not using the service. Wanting to use the service but refusing the privacy policy is much like wanting to eat at a restaurant but not wanting to pay your bill.
Interesting, why don't they also require Microsoft to reverse its recent privacy policy change which is essentially the same (unification of the company's services).
We have had law about privacy and IT and database for about as long as it started to become a phenomenon, I think back in the 80ies. For example you may not in certain circumstance do a join on database, or have races, skin color, religion, political affiliation, or whatnot mentioned in some database (I don't recall exactly when it is allowed, but you can take for granted that in a commercial database it is msotly not allowed). There is something similar on EU level.
That you in the US (or any other country) don't care that you are the "product" is your problem. but if google want to have a commercial presence in EU it better respect our privacy laws. And No it is not YOUR responsibility to use different usernames, it is google responsibility to respect law and not join DB.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Dude, take off the foil hat. I work at the big G (not on anti phishing) and all these concerns have been discussed publicly before. There is a cookie for anti-DoS purposes. Google has the ability to sink large amounts of HTTP traffic using smart load balancers which can handle way more requests than the backends they balance on to. During a DoS attack legitimate cookies that have been observed behaving in a non-abusive manner for a long time can be serviced whilst excluding requests that come in with no cookie or a freshly minted cookie. And let's face it - the anti-phishing system is designed to frustrate criminals, the kind of people who wouldn't hesitate to use DDoS attacks against a blacklisting service.
The list is updated frequently because phishing sites appear and disappear very fast.
If there was no partial server-side matching you could defeat the blocklist by simply using random filenames or ?q=abc suffixes on the phishing page (eg every spam you send with a phishing link could have a unique URL). Then a list of even a million URLs would be insufficient. By having partial/prefix matches that trigger a server side lookup more advanced logic can be used that doesn't require protocol changes to every client, in extreme cases you could even imagine hand crafted code that understands how to spot patterns in particularly tricky campaigns.
CAPTCHA: explains
uhh.. many of these services WERE different services, like youtube.
buying services and integrating data from them to google main db is googles business. that's not entirely within eu laws though.
world was created 5 seconds before this post as it is.
say you were paying a certain amount of money to live in an apartment. now imagine each year the landlord wants to raise the the rent. suddenly the initial ratio of cost to benefit has eroded, yet moving out is not a trivial decision.
oh wait. that's kind of the standard rental situation.
i spent five minutes thinking and all i got was this crappy sig
Moving out is a trivial decision though.
Just pack up and go. Tell your closest friends and family you've moved and where you've moved to. Set up an auto responder for the old address for a month or so that simply says "I've moved to [new address]". You can close the account or not (they dont care). Go update accounts that use the old email address. If you miss one it probably wasn't that important and you can check the old account occasionally.
It's not brain surgery.
A fool throws a stone into a well and a thousand sages can not remove it.