Part one of this series, "When Fear turned to Loathing," addressed Google's history of abuse and the current status of investigations of the company. Part two of this series, "Forms of Abuse and Forms of Remedy," characterized and classified the types of Google's abuse of power and outlined some of the remedies that will prove necessary. Part three, "Deception and Abuse of Market Power -- Harm and Remedies," provided more detail on the remedies for deception and the abuse of monopoly power. The final part will deal with abuse of privacy and provide some concluding remarks.
7. Privacy
Problems with Google's persistent abuse of personal privacy, of the users of its services, of the members, of people who send text and email to users of its services, and, indeed, of anyone else who crosses its path, will not be solved by proper labeling of search results. This will be solved only by changes in the law, requiring changes to Google's policies and practices. Indeed, Google's abuse of the privacy of consumers around the world will be ended only by laws, by punishments severe enough to be taken seriously, and by the introduction of a compliance function and internal governance practices within Google.
We suggest that the following privacy practices be mandated by law:
- Tracking and integration of search history within a search vendor's own site should be permitted, but tracking of any form should require explicit opt-in from the search users that are going to be tracked. Based on our surveys of populations within the U.S., Japan, and Korea, the default privacy setting of a browser or search engine should be that users' search history should not be tracked. Many users are likely to grant permission to be tracked, in order to achieve improved search engine performance, but tracking should be their choice.
- Drive-by snooping and electronic eavesdropping, like the Wi-Spy incident, should in the future be treated as a felony, much like breaking and entering in order to read first-class mail.
- Any other form of unauthorized snooping without explicit prior informed consent should also be treated as a felony. Google Analytics was described as a service that allowed website operators to track the origin of incoming traffic, which is not an invasion of privacy. Users' IP addresses were reported back to Google, without informed consent by consumers, who did not know that their data was being shipped to Google, and without informed consent by websites and business owners, who did not know that their consumers' data was being shipped to Google. Many users of corporate websites and university websites likewise have had consent for detailed snooping of incoming and outgoing communications implicitly granted by their web administrators. This must not be permitted.
- Pre-announced snooping of outgoing messages should be permitted, but only after the sender explicitly opts-in and grants permission for outgoing messages to be scanned. A Google user may choose to allow his own outgoing texts and email messages to be read. A Google user may even choose to allow his voice communications to be digitized, stored, and analyzed. Allowing the mining of these activities should never be the default. Mining a user's outgoing communications of any form should require the user's explicit permission.
- Predatory snooping of the communications of individuals who send to users of Google systems should be prohibited. It goes without saying that Google should not have the right to read, analyze, or data mine any incoming messages without permission from the sender; the recipient of a message cannot give permission for the invasion of someone else's privacy. Google should not be permitted to read incoming messages, texts and emails sent to Gmail users or to Android phones, or to store and analyze the text version of voice communications sent to Android phones. Regardless of the intentions of the recipient of these messages, this is a violation of the senders' rights, as senders may not have agreed to have their communications scanned and may have been unaware that their communications were going to be saved for an unspecified duration and used for unspecified purposes.
- Compromising communications are those sent from a compromised sender, namely one who has agreed to have his communications mined. All net citizens should have the right to the privacy that comes from refusing to accept communications that they believe have been compromised. Just as a financial adviser is required to announce "this call may be monitored and recorded," a potential recipient should be able to identify texts and emails for which storage and mining have been authorized, and should be able to reject them without reading them. The sender would receive a message that said something like "Your message has been approved by you for storage and mining by your system operator. Your message has been rejected by the recipient's system and has not been delivered."
8. Conclusions
Finally, we suggest that these practices be consistent and uniform across nations. This is not a matter for the U.S. Congress, the FCC, the U.S. Department of Justice, or the Federal Trade Commission. This is a matter for the International Telecommunications Union, or for multilateral negotiations among the U.S., the EU, China, Japan, and Korea, as the largest Internet communities in the world.
We pay for telephony. We pay for text. We pay for cable TV. Many of us actually pay for the music we listen to, the software we use, and the news we read. There seems to be no argument against paying for search. Yes, libraries, the poor, and students might qualify for special pricing, but a competitive market for search would lead to more innovation in search, rather than our current situation, in which innovation is largely focused on find ways to charge for search, or on finding ways to abuse privacy to push ads out on the search page.