Google Books: Policy Without Privacy
- EPIC Launches "Fix Google Privacy" Campaign: In response to the recent announcement that Google has agreed to adopt a "Comprehensive Privacy Plan," EPIC has launched "Fix Google Privacy," a campaign to encourage Internet users to offer their suggestions to improve safeguards for Google's products and services. Submissions to EPIC will be forwarded to the Federal Trade Commission and considered by the agency as part of the final Privacy Plan. All comments must be sent before May 2, 2011. For more information, see EPIC - In Re Google Buzz and FTC - Analysis to Aid Public Comments. (Apr. 5, 2011)
- Courts Rejects Google Books Settlement as Unfair, Also Finds that "Privacy concerns are real": Judge Denny Chin struck down a proposed settlement between Google and copyright holders that would have imposed significant privacy risks on e-book consumers. Google's proposal would have entitled the company to collect each users' search queries as well as the titles and page numbers of the books they read. In a February 2010 hearing before the Court, EPIC President Marc Rotenberg explained that this settlement would "turn upside down" well established safeguards for reader privacy, including state privacy laws, library confidentiality obligations, and the development of techniques that minimize privacy intrusions. Judge Chin determined that the proposed opt-out settlement was "not fair, adequate and reasonable." He further stated that "the privacy concerns are real" and that "certain additional privacy protections could be incorporated" in a revised settlement. For more information, see EPIC Press Release: EPIC Urges Court To Reject Google Books Settlement; EPIC: Google Books Settlement and Privacy. (Mar. 22, 2011)
- EPIC Urges Court to Reject Google Books Settlement, Warns that Privacy Problems Cannot Be Fixed: In federal district court in New York, EPIC President Marc Rotenberg urged Judge Denny Chin to reject the revised settlement now before the court in Authors Guild v. Google. Mr. Rotenberg said that the settlement would "turn upside down" well established safeguards for reader privacy, including state privacy laws, library confidentiality obligations, and the development of techniques that minimize privacy intrusions. Mr. Rotenberg warned that the settlement would eviscerate legal safeguards for library patrons, commercialize access to information, consolidate Google's control of the Internet, and put in place an elaborate system of user authentication and watermarking. "A person at any library or any university in the United States that attempted to retrieve information from Google's digital library would be uniquely tagged and tracked. There is simply no precedent for the creation of such power." For more, see EPIC: Google Books and Privacy, EPIC: Google Books Litigation, and EPIC: Google Books: Policy Without Privacy, EPIC: Google Books Hearing Press Release. (Feb. 19, 2010)
- EPIC to Defend Readers' Privacy at Google Books Hearing: On February 18, 2010, EPIC President Marc Rotenberg will appear in federal court in New York to represent readers' privacy and right to read anonymously. EPIC will urge Judge Chin to reject Google's deal with publishers, which requires readers to provide sensitive personal information to view digital books offered by Google, but fails to protect their privacy. EPIC previously moved to intervene in the case, observing that readers' interests are not represented, and warning that the settlement "threatens well-established standards that safeguard intellectual freedom," "imperils longstanding Constitutional rights," and "threatens to eviscerate state library privacy laws that safeguard library patrons in the United States." For more, see EPIC: Google Books and Privacy, EPIC: Google Books Litigation, and EPIC: Google Books: Policy Without Privacy. (Feb. 9, 2010)
- Revised Google Books Settlement Fails to Fix Key Problems: Even after revisions, the Google Books Settlement still fails to address antitrust, privacy, and copyright concerns, according the the US Justice Department, privacy advocates, and academic authors.On February 4, the Justice Department filed a brief and issued a statement opposing the revised settlement. The Department said the revisions still ran afoul of authors' copyrights and did not fix antitrust problems. EPIC also continues to object to the settlement because it does not contain adequate privacy protections for readers. On February 4, EPIC informed the court of its intent to appear at the February 18 Fairness Hearing on behalf of users' privacy interests. For more information, see EPIC: Google Books and Privacy, EPIC: Google Books Litigation, and EPIC: Google Books: Policy Without Privacy. (Feb. 5, 2010)
- Revised Google Books Settlement Announced, Privacy Problems Remain: The parties in the Google Books Settlement have filed an amended settlement. The Department of Justice, authors, EPIC and other privacy advocates criticized the original settlement. The revised settlement attempts to address price fixing and concerns about orphan works. However, the revised settlement does little to address privacy. Professor Pamela Samuelson stated “There are dozens of provisions in the settlement agreement that call for monitoring of what users do with books and essentially no privacy protections built into the settlement agreement.” For more information, see EPIC Google Books Settlement and Privacy, EPIC Google Books Litigation, and EPIC Google Books: Policy Without Privacy. (Nov. 17, 2009)
- Federal Trade Commission Issues Statements on Google Books Settlement and Privacy: With the Google Books Settlement now under consideration in federal court, FTC Chairman John Liebowitz today issued a statement, calling attention to privacy concerns and the vast amount of consumer information that could be collected. The Chairman expressed the Commission's commitment to evaluating the privacy issues presented by Google Books, a sentiment that was echoed by Commissioner Pamela Jones Harbour in her statement. In a separate letter, FTC Consumer Protection Director David C. Vladeck urged Google to address consumer privacy concerns and to limit the secondary use of user data. For more information, see EPIC Google Books Settlement and Privacy. (Sep. 4, 2009)
Google Says: "When you use Google Books, we receive log information similar to what we receive in Web Search. This includes: the query term or page request (which may include specific pages within a book you are browsing), Internet Protocol address, browser type, browser language, the date and time of your request and one or more cookies that may uniquely identify your browser."
EPIC's Response: Google acknowledges that it collects and stores extremely detailed log information on every single access to Google Books. This includes not only what you are searching for, but also unique identifiers, such as IP address and cookies, that make it possible for Google or others to link your interests and your identity. The settlement should include a provision which states that the parties agree that no personally identifiable information, including cookies or IP addresses, may be obtained from any user of the Google Book Search.
EPIC's Response: This is the main privacy concern with the Google Books Settlement: that Google will create massive profiles of users of Google Books by linking Google Book activities with other Google Services. This provision shows the company's intent to do just that: to be a central repository, storing vast amounts of user information gleaned from email accounts, book searches, mapping inquiries.
"Deletion" of Information: While Google maintains that users will be empowered to delete this information, the policy does not clarify what “delete” means in this context. If the user deletes the information, is it cleared from the central server, or does it remain stored on the central server, but not appear when the user looks at his own account? This is an important distinction because the huge databases of information Google holds could exist indefinitely and be easily accessible to law enforcement authorities and other third parties. In order to address this, the settlement term described above should include the following provision: the parties should further agree that all log data will be destroyed (from Google's records, and not just the user's view) once the users request is fulfilled.
PRACTICES SPECIFIC TO THE CURRENT GOOGLE BOOKS PRODUCT
Google Says: "The My Library feature lets you maintain a public online list of your favorite books and your reviews of those books. This information is stored with your Google Account. You may review and delete the information stored in the My Library feature at any time."
EPIC's Response: The language in this provision indicates that this is an opt-out feature. But, as in Blockbuster and numerous other opt-out schemes, many users who are not aware of the opt-out program will unintentionally broadcast personal and private information about what they are reading. In order to protect user privacy, features like this need to be opt-in, not opt-out. The settlement should include the terms of "My Library", which make the feature expressly an opt-in feature.
Google Says: "Special legal privacy protections for users may apply in cases where law enforcement or civil litigants ask Google for information about what books an individual user has looked at. Some jurisdictions have special "books laws" saying that this information is not available unless the person asking for it meets a special, high standard - such as proving to a court that there is a compelling need for the information, and that this need outweighs the reader's interest in reading anonymously under the United States First Amendment or other applicable laws. Where these "books laws" exist and apply to Google Books, we will raise them. We will also continue our strong history of fighting for high standards to protect users, regardless of whether a particular "books law" applies. In addition, we are committed to notifying the affected user if we receive such a request that may lead to disclosure of their information; if we are permitted to do so by law and if we have an effective way to contact the user, we will seek to do so in time for the user to challenge the request."
In this provision, Google argues that it will assert users' rights for them. But Google’s assertion of users' rights under library privacy laws would be impossible because Google Books does not qualify as a library for the purposes of these statutes. Library privacy laws typically have statutorily created definitions. For example, Michigan’s library privacy law states:
"A library record is not subject to the disclosure requirements of the freedom of information act, unless ordered by a court after giving the affected library notice of the request and an opportunity to be heard on the request, a library or an employee or agent of a library shall not release or disclose a library record or portion of a library record to a person without the written consent of the person liable for payment for or return of the materials identified in that library record." See Mich. Comp. Laws § 397.603 (2009).
The Michigan statute has the following definition:
"Library" includes a library that is established by the state; a county, city, township, village, school district, or other local unit of government or authority or combination of local units of governments and authorities; a community college district; a college or university; or any private library open to the public.
Courts would not protect Google’s users because Google is not a library as defined by the statute. No matter what arguments Google makes in court on its users’ behalf, it would not be a library for the purpose of the statute and would, as a result, be vulnerable to law enforcement requests for records.
Google Says: Google can share information with outside companies and individuals when "We have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request, (b) enforce applicable Terms of Service, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address fraud, security or technical issues, or (d) protect against harm to the rights, property or safety of Google, its users or the public as required or permitted by law."
EPIC Response: As discussed above, there are no laws or contracts that would necessarily prevent Google Books from disclosing user information and records to law enforcement officers and other third parties without a valid court order. The library privacy laws, unless amended, would likely not protect Google Books users in the same ways that they protect library users. Thus, Google would be completely within its rights to disclose user information to other companies or to law enforcement (without a court order). The settlement must establish strict, binding guidelines to prevent Google from aggregating user information into profiles of users and then sharing that information with outside parties.
PRACTICES SPECIFIC TO SERVICES PROPOSED UNDER THE PENDING SETTLEMENT AGREEMENTGoogle Says: "The Book Rights Registry will receive aggregate, non-personally identifiable information about usage of Google Books. Google will not require users to create Google accounts or in any way register their identity with Google, in order to use the following planned services: free online viewing of pages, use of the institutional subscription, use of public access service terminals in public libraries. However, Google will receive IP address and cookie information."
EPIC's Response: This in no way alleviates concerns regarding the collection of information. In order to link usage information to a specific user, Google does not need names or email addresses. A cookie would easily reveal the identity of the user if she logs into a Google account during the same session. This should be addressed in the settlement as discussed above - cookies and IP addresses should not be stored by Google or third parties.
Google Says: Google plans to build protections to limit the information (such as book titles) available to credit card companies about book purchases, and to enable you to delete or disassociate the titles of books purchased from your Google Account.
EPIC's Response: Google does not explain, even in the vaguest terms, how it plans to limit this information. If the company plans on protecting users’ information, the settlement should create a comprehensive plan that will allow users to be billed for book purchases without sending specific titles on to credit card companies. The settlement should also clarify what “delete or disassociate” means. Does it mean that the purchases are simply deleted from the users’ view, or are the records of purchases actually deleted from Google’s own servers?
Google Says: "Users will need to have Google Accounts in order to purchase books because such information is necessary to provide access to the user who bought the book. However, we plan to build protections to limit the information (such as book titles) available to credit card companies about book purchases, and to enable you to delete or disassociate the titles of books purchased from your Google Account."
EPIC's Response: There is no "necessary" reason that users need to have a Google Account to purchase a book from the Book Rights Registry. Other payment systems could be used. Also, this provision indicates that the title of your book purchases will be tied to your Google account, unless you opt-out, possibly for each title.
In order to protect user privacy, the following provisions must be added to the settlement agreement:
Under ARTICLE I — DEFINITIONS, New Section 1.104 (p. 13)
"Personally Identifiable Information" is any name or number that may be used, alone or in conjunction with any other information, to identify a specific individual, including any: (A) name, social security number, date of birth, official State or government issued driver's license or identification number, alien registration number, government passport number, employer or taxpayer identification number;(B) unique biometric data, such as fingerprint, voice print, retina or iris image, or other unique physical representation; (C) unique electronic identification number, address, or routing code; or (D) telecommunication identifying information or access device (as defined in 18 USC§ 1028).
Under ARTICLE III — GOOGLE BOOK SEARCH – RIGHTS, BENEFITS AND OBLIGATIONS, Section 3.10: Specific Prohibitions (p. 38)
"Any and all personally identifiable information gathered, collected, stored, or received by parties to this settlement shall not be disclosed to third parties without either valid court order or express, written permission by the user. Express written permission by user shall in no way be implied by user's decision to make use of Google Books or any other Google product. Nor shall permission be required in order to make use of Google Books or any other Google product. Users whose information is disclosed without a valid court order or express, written permission shall have the right to vindication in a court of law."
"The parties agrees that no personally identifiable information, including cookies or IP addresses, may be obtained from any user of the Google Book Search. The parties further agree that all log data will be destroyed once the user request is fulfilled."
"Google Book personally identifiable information gathered, collected, stored, or received by parties to this settlement shall not be used for the purposes of targeted advertising. Individual user information shall not be disclosed to third party advertisers for any purposes, including the tailoring of targeted advertisements."
"The My Library feature envisioned by Google which would allow users to maintain a public online list of favorite books and reviews of those books shall be an opt-in feature. Users shall not be automatically enrolled in this feature or any other feature that links specific books to individual user accounts. Instead, in order to be enrolled in any feature that links specific books to a user's account, the user must affirmatively agree to this linkage feature separately from any other user agreement or user registration."
Under ARTICLE IV — ECONOMIC TERMS FOR GOOGLE’S USE OF BOOKS, Section 4.1(d) Basic Features of Institutional Subscriptions (p.47)
"The parties agrees that no personally identifiable information, including cookies or IP addresses, may be obtained from any user under and institutional subscription of the Google Book Search. The parties further agree that all log data will be destroyed once the user request is fulfilled."
Under ARTICLE IV — ECONOMIC TERMS FOR GOOGLE’S USE OF BOOKS, Section 4.2(a) Basic Features of Consumer Purchase (p.48)
"Billing and payment shall not create a lasting record that ties a specific book to a specific user. If specific titles must be tied to specific users for the purpose of payment, all records of this transaction shall be destroyed within 48 hours of when the transaction is billed. Credit card companies, Paypal, and other forms of payment shall not receive information regarding what titles or books users are purchasing."
- German Government Opposes Google Book Settlement, Bloomberg, September 1, 2009.
- EU Commissioner Praises Google Books Project, Internet News, August 31, 2009.
- Privacy Missing From Google Books Settlement, Computing SA, August 31, 2009.
- More Questions Than Answers on Google Books, CNET News, August 29, 2009.
- Google Book Search Settlement Plans Questioned, San Francisco Chronicle, August 29, 2009.
- UC Berkeley Librarian Wants Google Books to Nail Down Privacy Commitments, Baynewser, August 28, 2009.
- How Google is Leveraging Our Culture, Forbes, August 28, 2009.
- Sony and Amazon Face Off Over Google Books Deal, The New York Times, August 28, 2009.
- Open Books Alliance to Oppose Google Book Deal, CNET News, August 26, 2009.
- ALA and Allies Should Request More Access in Google Books Settlement, The Library Journal, August 25, 2009.
- Urban Libraries Council Calls for Major Changes in Google Books Settlement, The Library Journal, August 24, 2009.
- Tech heavyweights attempt to close the book on Google, Brisbane Times, Brisbane Times, August 24, 2009.
- Is Google book deal a threat to privacy?, Washington Examiner, August 21, 2009.
- Google Rivals Will Oppose Book Settlement, The New York Times, August 20, 2009.
- Lawyer and Author Adds His Objections to Settling the Google Book Lawsuit, The New York Times, August 18, 2009.
- Google-Publishers Deal Raises Privacy Concerns, NPR, August 12, 2009.
- Library Organizations Urge Department of Justice to Take Proctive Role in Google Books Settlement, The Library Journal, August 6, 2009.
- The Google Book Search Case -- for Dummies, BNET Media, August 5, 2009.
- Google’s Big Plan for Books, The New York Times, July 29, 2009.
- EU sets hearing over Google books deal , The Washington Post, July 21, 2009.
- UT, Google alter digital books deal, The Daily Texan, July 13, 2009.
- The long term plans for Google world domination, Pandia, July 10, 2009.
- Irate Japanese authors see Google Book Search as 'black ships' of digital era, The Mainichi Daily News, July 10, 2009.
- Libraries and Google Amend Book Search Agreement, The University of Texas at Austin, July 9, 2009.
- DOJ confirms Google Books investigation, ZDNet, July 6, 2009.
- Google's Dark Day, Reuters, July 6, 2009.
- Justice Looking Into Google E-Books Deal, The Washington Post, July 3, 2009.
- U.S. Probes Google's $125 Million Book-Scanning Settlement, Bloomberg, July 3, 2009.
- U.S. Inquiry Is Confirmed Into Google Books Deal, The New York Times, July 2, 2009.
- Congress pressed to act on Google book settlement, Financial Times, June 30, 2009.
- Publisher: Google book settlement flawed, but essential, Ars Technica, June 30, 2009.
- Authors Guild defends Google Books settlement, Los Angeles Times, June 25, 2009.
- Leader of Authors Guild Defends Google Book Settlement, New York Times, June 24, 2009.
- Judge pushes Google book settlement hearing date to October from June, Washington Examiner, June 20, 2009.
- New Features on Google Books, Official Google Blog, June 18, 2009.
- Google Books Adds New Features And Tools, The Washington Post, June 18, 2009.
- Bezos: We've got issues with Google Book Search, CNET News, June 15, 2009.
- U.S. state AGs looking at Google books deal, The Washington Post, May 8, 2009.
- Google Book-Search Pact Draws Antitrust Scrutiny, The Wall Street Journal, April 29, 2009.
- Justice Dept. Opens Antitrust Inquiry Into Google Books Deal, New York Times, April 28, 2009.
- Internet Archive wants book copyright indemnity like Google, Ars Technica, April 19, 2009.
- Opposition to Google Books Settlement Jells, The New York Times, April 17, 2009.
- From the Mailbag: Illustrating your point with a book, Inside Google Book Search, April 16, 2009.
- Google Book settlement faces legal assault, CNET News, April 10, 2009.
- The Google Book Deal Will Help, Not Hurt, Authors, The Wall Street Journal, April 3, 2009.
- Authors to Google Book Search: Pay up! CNET News, February 11, 2009.
- Google's Book Settlement Is a Ripoff for Authors, The Wall Street Journal, March 28, 2009.
- Google Settles Suit Over Book-Scanning, The New York Times, October 28, 2008.
- Book info where you need it, when you need it, The Official Google Blog, March 13, 2008.
- Google: These books are free, CNET News, August 30, 2006.
- Google Book Search Offers Free Downloads of Public Domain Books, Google Press Release, August 30, 2006.
- Pick up you library pass to Google, The Official Google Blog, May 30, 2006.
- Discovering hard to find books, The Official Google Blog, October 31, 2005.
- Google Checks Out Library Books, Google Press Release, December 14, 2004.
- Southern District of New York Docket
- Peter Brantley on the Google Books Settlement, Knowledge Ecology Notes, April 10, 2009.
- Google Book Search Tour
- Google Books Library Project
- Google Books Partner Program Standard Terms and Conditions
- About Google Book Search
- History of Google Book Search, Google Book Search Beta.
- State Library Statutes
- Policy on Confidentiality of Library Records, The American Library Association.
- Privacy: An Interpretation of the Library Bill of Rights, The American Library Association.
- Library Bill of Rights, The American Library Association.
- Google Book Search, Wikipedia.
- Google Book settlement and privacy, Google Public Policy Blog.
- Google Book Search Library Project.
- Google Book Search Library Partners.
- Settlement Agreement (in English) - Google Books Settlement.
- Google Book Search - Perspectives (Google).
Share this page:
EPIC relies on support from individual donors to pursue our work.
Subscribe to the EPIC Alert
The EPIC Alert is a biweekly newsletter highlighting emerging privacy issues.
by Ryan Calo, A. Michael Froomkin,