Canada curious about Google Buzz, EPIC accuses Google of deception

The office of Canada's Privacy Commissioner, Jennifer Stoddart, confirmed to Betanews this afternoon that she has contacted Google officials by telephone, in an informal inquiry regarding its Google Buzz social networking service. Although Comm. Stoddart's office acknowledges the changes the company has already made, and is continuing to make, since Buzz's rollout last February 9, she says she asked a conference of Google officials why they released Buzz service to Canada without any advance notification to government regulators there.

Stoddart's office has not reported the nature of Google officials' response, or whether they responded at all. The phone call does not appear to be, at least at this point, the full-scale investigation implied by a CBC News report yesterday. But a statement issued by Stoddart's office in response to Betanews' inquiry this morning indicates that she may have told Google that, had they consulted with her first, she might have noticed the potential for privacy issues, enabling them to make changes prior to launch.

The process she describes resembles one Google did follow with respect to previous products, called "beta testing."

"We have seen a storm of protest and outrage over alleged privacy violations, and my office also has questions about how Google Buzz has met the requirements of privacy law in Canada. My office has a variety of resources available to help companies build privacy into their products and services," reads Comm. Stoddart's statement. "When companies consult with us at the development stage, they can avoid the problems we've seen in recent days."

The Commissioner's questions come as one of Google's frequent opponents in the US, the Electronic Privacy Information Center, issued a new formal complaint against Google to the Federal Trade Commission (PDF available here), accusing the company of outright deception. Essentially, EPIC accused Google of creating a two-click process whereby Gmail users ended up sharing their lists of contacts with not only the outside world, but with search engines, all without notifying them what was going on.

"Gmail contact lists routinely include deeply personal information, including the names and email addresses of estranged spouses, current lovers, attorneys and doctors," the complaint reads. "The frequency with which a user communicates with a given contact is also deeply personal and demonstrates the closeness of the user's relationship with that contact. The activation of Buzz disclosed not only portions of users' contact lists, but more specifically disclosed the contacts with whom users communicate most often. The fact that the auto-following lists were composed of users' most common Gmail contacts was widely known and publicized, as well as easily deduced by individual users. As such, anyone looking at a newly-activated Buzz user's 'following' list would know that the list indicated which people that user communicated with most often."

The details of Buzz's alleged transgressions as EPIC portrays them, however, did not always match our experience in Betanews tests. For example, EPIC states that Gmail users were not warned that their list of followed Buzz contacts would be pre-assembled from Gmail. Yet the formal complaint actually contains a screenshot of the Buzz welcome screen that contains these words: "No setup needed: You're already following the people you e-mail and chat with the most in Gmail."

EPIC also states Google failed to warn users that they would be creating public profiles that are searchable using search engines. However, Betanews tests revealed that the Google profile created when a new user, without a pre-existing Google profile, launches Buzz, the newly generated profile does not use a publicly searchable URL. The user must go into the profile manually to make it searchable.

The advocacy group also claims Google activated Buzz service for Gmail users even when they clicked on "Nah, go to my inbox," in response to the company's invitation. This is something Betanews tested first, while we had the opportunity to do so: In our experience, Buzz was not activated for any account where we refused the invitation.

Though EPIC acknowledges Google began making changes to Buzz just four days after its introduction, it characterized the act of un-selecting suggestions of members to follow as an undue burden on consumers. Public opposition to the current scheme was represented with citations of bloggers' reports over the past few weeks, including from CNET, Silicon Valley Insider, Lifehacker, and one major blog whose headlines included for a time, "F--- you, Google!"

EPIC also cited comments posted by Austin, Texas-based appellate attorney Don Cruse (misspelling his name), whose contribution last Thursday to the official blog of his state's Supreme Court warned officials of the possible repercussions of joining Buzz and accepting all of its defaults. Cruse wrote, "Assume for just a moment that this concerns you. Assume, perhaps, that some other people might expect to be able to contact you in confidence -- as a lawyer, a blogger, a journalist, or even (gasp) a friend. Assume that part of your professional responsibility is keeping the confidences of others."

Surprisingly, EPIC appears to have missed the context of Cruse's warning: not so much that Buzz could expose potentially confidential contacts, as much as the fact that users who do manage to separate their work e-mail from their private e-mail (unlike a certain former governor of another state) may not have been given adequate tools by Google to continue doing so, once they began experimenting with Buzz for personal purposes.
"This is not your first rodeo, so you click on the 'Settings' menu at the top right of your Gmail," reads Cruse's following paragraph, not cited in the EPIC complaint to the FTC. "You expect to see be offered privacy options for this new Buzz service, but you see that there aren't any. Although Google has integrated Buzz directly into your Gmail, it has hidden the controls (feeble as they are) somewhere else."

Cruse goes on to explicitly instruct users who have already begun Buzz experiments, as to how to find and use privacy controls that were not made obvious by Google. Spokespersons from Google have informed Betanews that such controls will be made obvious in a new round of changes still to be implemented this week. One of those changes did go live this afternoon: a new link (shown above) added to your Google profile editing page, allowing you to discontinue your use of Buzz. Again, this has been added to the profile page, not yet to Buzz itself. However, we do expect to see a new Buzz settings tab to be added to Gmail this week.