Let’s read a privacy policy. For fun!

Do you use Google products? Of course you do. You’re probably using one right now. If you do, you got an email last week from Google saying that as of March 1st, you will be covered by their brand-spanking new Privacy Policy. Since there is nothing really exciting in Canadian internet law this week, I thought I’d take some time to read the thing so you don’t have to. As I write privacy policies for a living, I am confident I will be able to handle this task with all the usual straightforward hard hitting legal analysis you’ve come to expect from me. Or I could really pile on the snark. Join me after the jump to find out which one!

Before we dive into the actual text, I should tell you the most important thing to know about the new privacy policy. GOOGLE OWNS YOUR ASS. I keed. Well sort of. But we’ll get to that. The most important thing is that it’s “simplified”. Where you used to have separate policies for all the individual Google products  – Gmail, Google search, YouTube, Google+ (well, if anyone used it), etc. – as of March 1 there will be one privacy policy across all Google products. Simple is better, right? That’s just what they want you to believe.

As this excellent piece from the Electronic Frontier Foundation points out, the principle effect of the “one policy for all services” is that now, data that Google gathers about you from one service will be used when you use another service. So when I search for “methamphetamine recipes” in Google, presumably when I go to YouTube all my recommended videos will be about cooking meth. Or Breaking Bad clips. You get the idea. Google explains this as “enhancing the user experience” or some such BS, and I guess there may be an advantage or two. It’s not like Google had to go to Congress to explain themselves and the new policy or anything. Oh wait, they did. The reality is the ubiquity of Google and its data will soon take over your internet experience.

OK so what does the policy actually say? It’s blockquote time!

When you share information with us, for example by creating a Google Account, we can make those services even better – to show you more relevant search results and ads, to help you connect with people or to make sharing with others quicker and easier.

This is the second sentence of the policy, so at least they’re telling you right up front what’s going on. Honesty is the best policy I guess. So what is Google saying? Basically they’re saying we’ll take every piece of data you give us and throw it back to you in a million different ways. It’s all for the better!

Also, note the clever use of the phrase “for example”. So it’s not just data that you give them when creating an account that they will use like this – it’s any data. So everything you type into a search box, every click on a link in a Google product, every liked YouTube video. All of it. So they are trying to make it sound nice and friendly, but it’s not. That’s the sign of quality lawyering! Don’t believe me that they are collecting any data? They spell it out in the headings of the two sub-sections the “information we collect” section:

1. Information you give us
2. Information we get from your use of our services

Of these, #2 is far more interesting. Like any website, they collect your technical info, like your browser, operating system, links you clicked, time you spent on the site, etc. They may install cookies, blah blah. All the usual standard stuff. The one that caught my eye was this:

we may automatically collect and store… details of how you used our service, such as your search queries.

Again, good use of the “such as”, Google lawyers! Everyone knows that Google tracks your search queries, so this all seems so innocent. But you are not fooling me, lawyers. “Details of how you used our service” could be absolutely anything. Seriously. This should scare you. It scares me.

So what do they do with the info they collect? This is all helpfully outlined in the section “how we use information we collect.” Here’s the part that will get me my meth cooking videos:

We may combine personal information from one service with information, including personal information, from other Google services

All your Googles will be ours! I also liked this one:

We may use the name you provide for your Google Profile across all of the services we offer that require a Google Account.

So much for anonymity. So I am going to appear as “Allen Mendelsohn” on Google sites now instead of my clever Google name, “almendelsohn”? I’m not sure I like that.

So what if some of the personal info you gave Google is wrong? Well, they are happy to let you change or delete it, and will give you every chance to, unless:

we have to keep that information for legitimate business or legal purposes

Hoo boy, I am not sure about this one. Having a legal reason to not allow you to change or delete information is fine imho, but a business reason? Anything can be a business reason. “We make profit off that data” is a business reason. Ick. Oh and by the way, even if you are able to delete the information:

after you delete information from our services, we may not immediately delete residual copies from our active servers and may not remove information from our backup systems.

So it’s not deleted at all! That’s good stuff Google.

As with all privacy policies, it goes on to explain that they will never divulge your personal information to third parties. And like all privacy policies, it then goes on to list the exceptions to that rule. A bunch of them are standard, like when a court orders them to. But then one of the exceptions caught my eye. They will release your personal info to a third party if the disclosure of that information is:

reasonably necessary to… protect against harm to the rights, property or safety of Google

Like that business reason thing above, this would seem to be a really nice catch-all for just about anything that is in Google’s interests. And “safety of Google”??? WTF is that?

It’s Google’s world, and we’ll all be just living in it as of March 1st.