After failing to disclose user data leaks, Google is shutting down Google+ and improving APIs

The private data of nearly half a million Google+ users was exposed to third-party developers, and Google failed to notify anyone. A bug in Google+ APIs meant that users' names, email addresses, occupations, gender and age were accessible from 2015 until Google discovered and patched the problem in March this year.

Despite the data possibly having been accessed by 438 apps, Google chose not to go public about the security breach until now. And in a dramatic move, the company has announced that it is shutting down Google+ for consumers. Google has also revealed details of Project Strobe, an audit program through which it discovered the problem.

See also:

• UK court blocks iPhone users' privacy case against Google
• Google Safety Centre arrives in Europe -- or Safety Center... Google hasn't decided
• Block more Google tracking with the latest Privacy Badger extension

The data breach was revealed by the Wall Street Journal today, and it wasn't long before Google published a detailed blog post outlining its own findings and the action it is taking. Google says that a bug in the Google+ People APIs "meant that apps also had access to Profile fields that were shared with the user, but not marked as public".

Apparently trying to play down the significance of the matter, Google says that Google+ has not proved particularly popular or successful: "it has not achieved broad consumer or developer adoption, and has seen limited user interaction with apps. The consumer version of Google+ currently has low usage and engagement: 90 percent of Google+ user sessions are less than five seconds".

In what many will regard as a somewhat drastic move, Google is shutting down Google+:

The review did highlight the significant challenges in creating and maintaining a successful Google+ that meets consumers’ expectations. Given these challenges and the very low usage of the consumer version of Google+, we decided to sunset the consumer version of Google+.

To give people a full opportunity to transition, we will implement this wind-down over a 10-month period, slated for completion by the end of next August. Over the coming months, we will provide consumers with additional information, including ways they can download and migrate their data.

Google+ will now pivot to an enterprise-only service -- although building up trust after this incident may prove tricky -- and Google says it will provide more information in the coming days:

We have many enterprise customers who are finding great value in using Google+ within their companies. Our review showed that Google+ is better suited as an enterprise product where co-workers can engage in internal discussions on a secure corporate social network. Enterprise customers can set common access rules, and use central controls, for their entire organization. We've decided to focus on our enterprise efforts and will be launching new features purpose-built for businesses.

The company also says that it is introducing a number of changes to address user concerns, the first of which is more granular control for Google Account permissions. This means that permissions will not all be thrown at users in one dialog:

Instead of seeing all requested permissions in a single screen, apps will have to show you each requested permission, one at a time, within its own dialog box.  For example, if a developer requests access to both calendar entries and Drive documents, you will be able to choose to share one but not the other.

Secondly, access to the Gmail API is going to be limited to only those apps that directly enhance email functionality. New data-handling rules will be introduced and -- like for Chrome extensions -- more rigorous security assessment will be carried out.

Finally, Google will limit apps' ability to receive Call Log and SMS permissions on Android devices, and the Android Contact API will no longer provide access to contact interaction data. Google explains:

Some Android apps ask for permission to access a user's phone (including call logs) and SMS data. Going forward, Google Play will limit which apps are allowed to ask for these permissions.  Only an app that you’ve selected as your default app for making calls or text messages will be able to make these requests. (There are some exceptions—e.g., voicemail and backup apps.) Developers can find more details in the Google Play Developer Policy Center and in the Help Center.

Additionally, as part of the Android Contacts permission, we had provided basic interaction data so, for example, a messaging app could show you your most recent contacts. We will remove access to contact interaction data from the Android Contacts API within the next few months.

Image credit: dennizn / Shutterstock