Focusing public attention on emerging privacy and civil liberties issues

In re: Google Search Plus

Top News

  • EPIC Urges FTC Investigation of WhatsApp Sale to Facebook: EPIC has filed a complaint to the Federal Trade Commission concerning Facebook's proposed purchase of WhatsApp. WhatsApp is a messaging service that gained popularity based on its strong pro-privacy approach to user data. WhatsApp currently has 450 million active users, many of whom have objected to the proposed acquisition. Facebook regularly incorporates data from companies it has acquired.The Federal Trade Commission has previously responded favorably to EPIC complaints concerning Google Buzz, Microsoft Passport, Changes in Facebook Privacy Settings, and Choicepoint security practices. However, the FTC approved Google's acquisition of Doubleclick over EPIC's objection. Facebook is currently under a 20 year consent decree from the FTC that requires Facebook to protect user privacy and to comply with the US-EU Safe Harbor guidelines. For more information, see EPIC: In re Google Buzz, EPIC: Microsoft Passport, EPIC: In re Facebook, and Privacy? Proposed Google/DoubleClick Merger. (Mar. 6, 2014)
  • States Reach $17 Million Settlement with Google Over Privacy Violations: The Maryland Attorney General Douglas Gansler, joined by attorneys general in 36 states and the District of Columbia, has reached a $17 million settlement with Google over privacy violations. Google violated state consumer protection and privacy law by placing advertising tracking cookies on Safari browsers despite telling users that it would honor the default Safari privacy settings, which prevented the placement of such cookies. The Federal Trade Commission fined Google $22.5 million last year over similar practices which violated an earlier settlement that was the result of a complaint filed by EPIC. EPIC previously objected to the Google-DoubleClick merger on privacy grounds and specifically warned that Google’s use of Doubleclick techniques would lead to impermissible tracking of Internet users. Earlier EPIC had urged the Federal Trade Commission and other consumer protection agencies to support advertising models that are not linked to actual user identity. For more information, see EPIC: Google Buzz, EPIC: Google/DoubleClick Merger. (Nov. 18, 2013)
  • Google Announces Plan to Post Names and Photos of Users for Advertising Without Consent, May Violate 2011 FTC Consent Order: Google announced changes to its Terms of Service that will allow “your Profile name, Profile photo, and actions you take on Google or on third-party applications” to be used in advertisements. The changes will not require Google to seek the affirmative consent of users before putting their personal information to commercial use. Minors, however, will not be subject to the changes. A 2011 Consent Order with the Federal Trade Commission prohibits Google from making misrepresentations and requires the company to obtain user consent before disclosing information to third parties. EPIC recently objected to similar practices by Facebook that would allow the company to routinely use the names, images, and content of Facebook users for commercial advertising without consent. For more information, see EPIC: Federal Trade Commission and EPIC: In re Google. (Oct. 11, 2013)
  • NSA Attacked Tor, a Privacy Enhancing Network: The NSA and GCHQ have attempted to break the privacy protections of the Tor anonymity network, according to a series of documents published in The Guardian today. The documents describe the efforts of the NSA to de-anonymize Tor users by compromising their computers and Tor software with viruses. The NSA also relies on Doubleclick advertising cookies to identify Tor users. Despite their efforts, the documents reveal that the intelligence community has had limited success compromising the Tor network. One presentation, titled "Tor Stinks," concludes that they will "never be able to de-anonymize all Tor users all the time." In May 2013, EPIC filed a FOIA request seeking evidence of government interference with the Tor network. In 2000, EPIC had also filed a complaint with the FTC about Doubleclick's efforts to merge users' browsing activity with personally identifying information. And in 2007, EPIC objected to Google's acquisition of Doubleclick, warning that it would place at risk the privacy of Internet users. For more information, see EPIC v. BBG; EPIC: Privacy? Google/Doubleclick Merger. (Oct. 4, 2013)
  • FTC Opens Investigation into Google Advertising Dominance: The Federal Trade Commission has reportedly opened a new antitrust investigation into Google’s display advertising business. The Commission is investigating whether Google used its dominant position in the display advertising market, following the acquisition of Doubleclick, to harm competition. EPIC previously opposed Google's acquisition of online advertiser Doubleclick, which was approved by the FTC over the objection of former FTC Commissioner Pamela Harbor. EPIC later testified before the Antitrust committee on Google's growing dominance of essential Internet services. Earlier this year, the Commission closed an antitrust investigation into Google’s search practices. For more information, see EPIC: Federal trade Commission and EPIC: Google/DoubleClick. (May. 29, 2013)

Background

Google

Google is a company created by Larry Page and Sergey Brin in 1998. Originally, Google was a search engine service, but since its inception, the company has expanded to create several web applications that encourage sharing of information. These applications include Gmail, Google Calendar, Google+, and Google Docs.

Google Search Plus

On January 10, 2012, Google announced that it would include personal data gathered from Google+ in the results of users' searches, including photos, posts, and business pages of users and their contacts. In addition to the personal information of a user’s contacts, search will also display Google+ business pages and notable Google+ users on the right-hand column of the results page.

Experts have noted that Google’s changes implicate concerns over whether the company prioritizes its own content when returning search results. Incorporating results from Google+ into ordinary search results allows Google to promote its own social network by leveraging its dominance in the search engine market. Search Engine Land’s Danny Sullivan wrote that Google’s changes favor Google+ “even more than [he initially] thought,” by “turn[ing] Google+ into an essential social network for any search marketer.” For example, the right-hand display of notable business and Google+ users replaces highly-visible advertising space, even for consumers who have no Google+ accounts and are not logged in to Google.

Benjamin Edelman, professor at the Harvard Business School, wrote that “Google is favoring its own ancillary services even when other destinations are objectively superior, and Google is using its dominance in search to compel users to accept Google’s other offerings.” He concluded by saying that “Google’s dominant position in search requires that the company hold itself to a higher level of conduct, including avoiding tying its other products to its dominant search service. Google has repeatedly crossed the line, and antitrust enforcement action is required to put a stop to these practices.”

Furthermore, although data from a user’s Google+ contacts is not displayed publicly, Google’s changes make the personal data of users more accessible. Users might, for example, “com[e] across an unexpected photo or post from a friend, [and] might reshare it to the world” or “[t]hings that people may have forgotten sharing with others will begin to show up serendipitously through ordinary Google searches.” James Grimmelmann, an associate professor at New York Law School, said that Google’s change “breaks down a very clear conceptual divide between things that are private and things that are public online.” Google allows users to opt out of receiving search results that include personal data, but users cannot opt out of having their information found by their Google+ contacts through Google search. In contrast, Google allows content owners to remove pages from Google’s public search results.

EPIC's FTC Complaint

EPIC’s letter to the FTC highlights several aspects of the Google Search Plus service that implicate the implementation of the FTC's consent order as well as concerns over whether the company prioritizes its own content when returning search results.

EPIC’s letter begins by detailing Google's history with the FTC, particularly in regards to Google Buzz and Youtube (a Google owned web video company) search results. EPIC’s 2010 complaint concerning Google Buzz, filed with the support of other privacy and civil liberties groups, provided the basis for the Commission’s investigation and October 24, 2011 subsequent settlement concerning the social networking service. In that case, the Commission found that Google “used deceptive tactics and violated its own privacy promises to consumers when it launched [Buzz].” The settlement prohibits the company from future privacy misrepresentations and requires it to obtain the affirmative consent of users prior to “new or additional sharing” of personal information with any third party. The settlement also requires Google to implement a comprehensive privacy program and calls for biennial, independent privacy audits for the next 20 years.

EPIC also cited its own experience with Google's search algorithm. In September of 2011, EPIC asked the FTC to investigate Google’s use of its search engine criteria to give preferential treatment to its own YouTube videos on “privacy.” EPIC explained that following Google’s acquisition of YouTube, Google revised the YouTube search criteria such that Google’s subjective “relevance” rankings became the default for returning search results. As a consequence, Google's own online videos on “privacy” are more likely to be ranked highly, and therefore viewed by internet users, than if the original search criteria had remained as the default. EPIC, which also makes videos concerning “privacy” available through YouTube, noted that it was specifically disadvantaged by Google’s preference for its own content. Google’s recent changes to its search results raise similar competitive issues.

The letter goes on to describe the anti-competitive aspects of Google's changes in business practices. EPIC argues that "[i]ncorporating results from Google+ into ordinary search results allows Google to promote its own social network by leveraging its dominance in the search engine market." Antitrust experts, such as Benjamin Edelman of the Harvard Business School, have also stated that "Google has repeatedly crossed the line, and antitrust enforcement action is required to put a stop to these practices." Edelman notes that "the top-most result [of a Google search] enjoys 34%+ of all clicks -- so when Google takes that position for itself, there's far less for everyone else."

Finally, the letter notes that "although data from a user’s Google+ contacts is not displayed publicly, Google’s changes make the personal data of users more accessible. . . . Google allows users to opt out of receiving search results that include personal data, but users cannot opt out of having their information found by their Google+ contacts through Google search. In contrast, Google allows content owners to remove pages from Google’s public search results."

FTC Authority to Act

The FTC's primary enforcement authority with regards to privacy is derived from 15 U.S.C. ยง 45, commonly known as section 5 of the Federal Trade Commission Act (FTCA). Section 5 of the FTCA allows the FTC to investigate "unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce." This law provides a legal basis for the FTC to regulate business activities that threaten consumer privacy.

Legal Documents

News Stories and Blog Items