Google Buzz accused of EPIC FAIL
By Cade Metz
The Electronic Privacy Information Center (EPIC) - a high-profile public advocacy group - has filed a complaint with the US Federal Trade Commission over Google Buzz, the Tweetbook-esque “social networking” service that Mountain View bolted onto Gmail early last week.
“The argument is that Google could have violated federal law by disclosing address book contacts without getting proper consent,” EPIC privacy counsel Kim Nguyen tells The Reg.
Like Facebook or Twitter, Buzz is a means of sharing personal info and media with others across the web in (near) real-time. But unlike a Facebook or a Twiiter, it’s not a standalone service. It’s an add-on for Gmail, designed to dovetail with Google’s existing online email service and tap users’ existing Gmail and Google Chat contacts.
Introduced last Tuesday and pushed out to an estimated 32.1 million Gmail users beginning that same day, Buzz automatically identified users’ most frequent email and chat contacts as people they’d like “to follow” - i.e. people you’d like to receive posts from. By default, it exposed this list to the world, and many complained that the checkbox that allowed users to hide this list was far from prominent.
After a firestorm of criticism over the service, Google agreed to move the checkbox to a more prominent position. Then, over the weekend, it announced that it would change the way the service handled user Gmail contacts. At set-up time, rather than automatically identifying email and chat contacts for following, it would “suggest” people to follow and give the user the opportunity to make changes.
But with its complaint, EPIC says the service still goes too far. The complaint urges the FTC to require Google to make Buzz “fully opt-in” - meaning it would only be added to Gmail if users specifically asked for it. “Sites like Facebook and Twitter are first and foremost social networking sites,” Nguyen tells us. “Gmail users sign up for email addresses, and for most users, email is private. With Buzz, Google made a private email service into a social networking site, and that violates user expectations.”
The complaint also urges the FTC to require Google to stop using Gmail users’ private address books to build its social networking lists and to give users “meaningful control over their personal data.”
Over the weekend, Google also added a Buzz tab to a user’s central Gmail “settings” that let them disable Buzz entirely, and it provided a link to this tab from the initial Buzz setup screen. Earlier this week, in a blog post, the Electronic Frontier Foundation - another privacy advocate - said Google’s weekend changes were “a significant step forward.” But it was still critical of the way Google has handled the service and it at least indicated the service should be opt-in.
“Google leveraged information gathered in a popular service (Gmail) with a new service (Buzz), and set a default to sharing your email contacts to maximize uptake of the service.”
Regardless, the fact remains that for all the changes Google made over the past week, Buzz is an opt-out service. And fundamentally, it’s designed to hook into users’ existing private email accounts and encourage them - in one way or another - to instantly expose more data than they would on a new standalone service.