Google has agreed to settle Federal Trade Commission charges it violated with its own privacy policies, when it launched the social network, Google Buzz, including implementing the first-ever FTC requirement of employing a "comprehensive" privacy program, one that that will get independent audits for the next 20 years.
"When companies make privacy pledges, they need to honor them," said FTC chairman Jon Leibowitz. "This is a tough settlement that ensures that Google will honor its commitments to consumers and build strong privacy protections into all of its operations."
According to the FTC, when Google launched the site in 2010 through its Gmail product, the choice of declining to join that social network or to leave it were ineffective, and the controls for sharing info were "confusing and difficult to find." The settlement is still subject to a final vote after public comment.
As part of the settlement, Google is barred from "misrepresenting the privacy or confidentiality of individuals' information or misrepresenting compliance with the U.S.-E.U Safe Harbor or other privacy, security, or compliance programs." It also requires Google to affirmatively obtain consent [opt in] "before sharing their information with third parties if Google changes its products or services in a way that results in information sharing that is contrary to any privacy promises made when the user's information was collected."
The settlement will be open to public comment through May 1, after which the FTC will vote to finalize it, which is likely since the vote on the settlement was 5-0, though with one commissioner concurring rather than voting yes.
In a separate statement, that commissioner, Republican J. Thomas Rosch, explained that he was troubled by the new "opt in" provision for future use of information for any change in product or service. While saying Google could speak for itself, he said that it seemed the FTC was setting up that opt-in condition for more widespread application.
"[T]he Ã¢â‚¬Ëœopt in' requirement in Part II is seemingly brand new," he wrote. "It does not echo what Google promised to do at the outset. In the separate statement that I issued when the staff issued its preliminary Privacy Report, I expressed concern about whether an Ã¢â‚¬Ëœopt in' requirement in these circumstances might sometimes be contrary to the public interest. Then, as now, I was concerned that it might be used as leverage in consent negotiations with other competitors."
The FTC and Obama Administration have encouraged industry to give Web surfers more control over the use of their information, though stopping short of recommending a mandatory opt-in, rather than opt-out regime.
"One of my top priorities is protecting consumers' privacy and I appreciate that the Federal Trade Commission and its dedicated staff is taking this issue so seriously," said Senate Commerce Committee chairman Jay Rockefeller (D- W. Va.), who has made online privacy a priority for his committee. "As chairman of the Commerce Committee, I will continue to take an aggressive stance to make sure consumers have adequate control over their personal information. Google was just plain wrong when it opted people into Buzz without their consent. This should be a wake-up call for online businesses-both large and small-of the need to be clear and honest about how the personal information of consumers is collected and used."