When is a privacy button not a privacy button? When Google runs it, claims lawsuit
(2023/10/24)
- Reference: 1698132605
- News link: https://www.theregister.co.uk/2023/10/24/google_privacy_button/
- Source link:
A recently released video deposition in long-running lawsuit over Google tracking its users has claimed that even the CEO Sundar Pichai isn't clear on what's going on below him.
For the past three years, Google has been fighting a lawsuit that claims the company has a misleading menu that promises privacy but fails to provide it.
It's all about a setting called Web & App Activity (WAA) and a subsetting referred to as sWAA that extends purported privacy protection to "include Chrome history and activity from sites, apps, and devices that use Google services." The relevant menu button is available via one's [1]Google Accounts web page.
[2]
When turned on, as currently described, the WAA button "saves your activity on Google sites and apps, including associated info like location" to personalize searches, recommendations, and other Google services. But when it's turned off Google still saves people's data, or so it's alleged in the complaint filed in July 2020, and amended for the fourth time in January 2023.
[3]
[4]
"Google had promised that by turning off this feature, users would stop Google from saving their web and app activity data, including their app-browsing histories," the [5]fourth amended complaint [PDF] says. "Google’s promise was false."
Jonathan Hochman, an expert witness for the plaintiffs, provided a technical analysis of Google data collection, but his report remains [6]under seal . As is common in such cases, Google has pushed for sensitive documents obtained during the discovery process to be redacted or sealed. This has become [7]an issue in the US government's ongoing antitrust trial against Google, where much of the testimony and many of the documents have been withheld from the public.
[8]
However, a transcript of Hochman's video [9]deposition [PDF] posted to the court docket sheds more light on claims. "... the WAA/sWAA switch, I have called it a fake control, because it doesn't do – technically doesn't do what it seems it should do," he explained.
Hochman in his deposition contends that even Google insiders, including Alphabet CEO Sundar Pichai, misunderstand the WAA control.
"It looks like even Sundar Pichai is confused about how this control works because he testified in front of Congress and told them something that is just wrong from a technical perspective…," he said.
[10]
This is spelled out more explicitly in a more recent [11]court filing [PDF]: "For example, Google CEO Sundar Pichai testified to Congress that, within 'My Account' user can 'clearly see what information is collected, stored.' That supposedly 'clear toggle' Mr Pichai was referring to could only be WAA."
That document goes on to state: "Contrary to Mr Pichai's Congressional testimony, the founder of Google's Privacy and Data Protection Office testified in this case that he is 'not aware of any setting' that users can employ to prevent Google from collecting data related to their app activity."
Much of the issue, allegedly, is that WAA, rather than saving data when on and not saving it when off, simply saves data in a different place – not in the Google Account data set. Addressing the confusion about the bounds of Google Accounts, Hochman said, "So I'm aware that Google may save data in different locations, depending on where that WAA/sWAA switch is set. It is still collecting the same data and still saving it, but it may save it in different places."
Firebase burns through personal firewall
The complaint alleges that Google still collects data from users who disable the WAA setting "through various backdoors made available through and in connection with Google’s Firebase Software Development Kit, including not only Google Analytics for Firebase but also without limitation AdMob and Cloud Messaging for Firebase."
Firebase, a cloud database, was acquired by Google in 2014, and as of 2021 was said to be incorporated into three million mobile apps. Third-party app makers can integrate Firebase using the Firebase Software Development Kit, which adds support for Google Analytics for Firebase, as well as mobile ad service AdMob and Cloud Messaging for Firebase.
Google, it's claimed, collects data from mobile third-party apps, even those who disable WAA, using Firebase SDK code, as well as Google Mobile Ads SDK, AdMob+ SDK, and browser "WebView" technologies.
"All of these products surreptitiously copy and provide Google with app activity data while WAA is turned off, including personal browsing data," the complaint claims.
[12]Google - yes, that Google - testing proxy scheme to hide IP addresses for privacy
[13]What's unconstitutional about Google keyword search warrants? Nothing, says Colorado Supreme Court
[14]Google's third-party cookie culling to begin in Q1 2024 ... for 1% of Chrome users
[15]Online tracking is alive and well in link decoration
The complaint cites statements from Google's own employees that suggest WAA is confusing and poorly understood.
Quoting specific exhibits in the case, the complaint says, "Google’s employees recognize, internally and without disclosing this publicly, that WAA is 'not clear to users,' 'nebulous,' 'not well understood,' 'completely broken,' and 'confuses users,' where people 'don’t know what WAA means' and Google’s promise of control is 'just not true.'"
The complaint cites internal Google communication about the true nature of the WAA control: "As summarized by a Google employee in an internal email, 'WAA (or any of the other controls) does not actually control what is stored by Google, but simply what the user has access to. This is really bad. … I for one didn’t realize Google actually stored all of my activity even if those controls were off and I work at Google! Seems sort of silly to turn them off as I’m not any safer with them off than on.'"
An Orwellian landscape
The complaint points out that related allegations have come up in recent government litigation against Google. It cites documents produced by Google in a 2020 case brought by Arizona's Attorney General that mention Web & App Activity by name. Google [16]settled that claim last year for $85 million.
"When users turned off their Location History in settings, Google continued to surreptitiously collect their location through other settings such as Web & App Activity and the company used that information to sell ads," the Arizona AG's office said when it [17]announced the deal.
Google declined to comment but has disputed many of the allegations in its [18]answer [PDF] to the fourth amended complaint.
The company in its filings has characterized the employee messages cited as "cherry-picked" communications that mischaracterize the technology or are taken out of context. Google maintains that the sWAA setting, through which third-party apps receive data, is so developers can understand app behavior and isn't saved to Google users' marketing profiles. Essentially, Google maintains that any data gathering is adequately disclosed and that app developers implementing Google Analytics are bound by the company's Terms of Service.
Coincidentally, earlier this year, Google [19]began [20]notifying some users of its services that they have Web Apps & Activity turned on. The message insists, "You're in control," and insists no action is required but allows that the setting can be changed.
Hochman in his assessment of WAA is unsparing.
"The situation I found upon the technical investigation was counterintuitive, it was not what I expected to find, and it is, frankly, kind of Orwellian, it is just very strange that you have a privacy switch that when you flip it, it just means we don't tell you that we're spying on you," he said.
"It is almost like the party slogan from 1984, you know, ignorance is strength, that's like what this is. That's what this control is. You flip the switch, you can remain ignorant of the fact that you're being spied on."
Yet whether Google has actually violated any laws here has yet to be decided. Last year, the judge hearing the case [21]dismissed [PDF] claims that alleged violation of the California Invasion of Privacy Act and breach of contract. What remain are three claims under California's Comprehensive Computer Data and Access Fraud Act, invasion of privacy and intrusion upon seclusion. ®
Get our [22]Tech Resources
[1] https://myactivity.google.com/activitycontrols
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZTeVxCCqGG57Ui2H97LiigAAABA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZTeVxCCqGG57Ui2H97LiigAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZTeVxCCqGG57Ui2H97LiigAAABA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://storage.courtlistener.com/recap/gov.uscourts.cand.362381/gov.uscourts.cand.362381.289.0.pdf
[6] https://ecf.cand.uscourts.gov/doc1/035123359512
[7] https://www.nytimes.com/2023/09/26/technology/google-antitrust-trial-secrecy.html
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZTeVxCCqGG57Ui2H97LiigAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://storage.courtlistener.com/recap/gov.uscourts.cand.362381/gov.uscourts.cand.362381.344.0.pdf
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZTeVxCCqGG57Ui2H97LiigAAABA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://storage.courtlistener.com/recap/gov.uscourts.cand.362381/gov.uscourts.cand.362381.293.0.pdf
[12] https://www.theregister.com/2023/10/23/google_ip_proxy/
[13] https://www.theregister.com/2023/10/18/google_keyword_search_warrants/
[14] https://www.theregister.com/2023/10/12/googles_cookie_killing_timeline/
[15] https://www.theregister.com/2023/10/06/link_tracking_privacy/
[16] https://www.azag.gov/press-release/attorney-general-mark-brnovich-achieves-historic-85-million-settlement-google
[17] https://www.azag.gov/press-release/attorney-general-mark-brnovich-achieves-historic-85-million-settlement-google
[18] https://storage.courtlistener.com/recap/gov.uscourts.cand.362381/gov.uscourts.cand.362381.305.0.pdf
[19] https://www.mbsdirect.com/mbs-blog/article-what-is-google-web-app-activity-and-should-you-leave-it-enabled
[20] https://support.google.com/accounts/thread/196248961/i-keep-getting-reminder-you-have-web-app-activity-turned-on-emails?hl=en
[21] https://storage.courtlistener.com/recap/gov.uscourts.cand.362381/gov.uscourts.cand.362381.209.0.pdf
[22] https://whitepapers.theregister.com/
For the past three years, Google has been fighting a lawsuit that claims the company has a misleading menu that promises privacy but fails to provide it.
It's all about a setting called Web & App Activity (WAA) and a subsetting referred to as sWAA that extends purported privacy protection to "include Chrome history and activity from sites, apps, and devices that use Google services." The relevant menu button is available via one's [1]Google Accounts web page.
[2]
When turned on, as currently described, the WAA button "saves your activity on Google sites and apps, including associated info like location" to personalize searches, recommendations, and other Google services. But when it's turned off Google still saves people's data, or so it's alleged in the complaint filed in July 2020, and amended for the fourth time in January 2023.
[3]
[4]
"Google had promised that by turning off this feature, users would stop Google from saving their web and app activity data, including their app-browsing histories," the [5]fourth amended complaint [PDF] says. "Google’s promise was false."
Jonathan Hochman, an expert witness for the plaintiffs, provided a technical analysis of Google data collection, but his report remains [6]under seal . As is common in such cases, Google has pushed for sensitive documents obtained during the discovery process to be redacted or sealed. This has become [7]an issue in the US government's ongoing antitrust trial against Google, where much of the testimony and many of the documents have been withheld from the public.
[8]
However, a transcript of Hochman's video [9]deposition [PDF] posted to the court docket sheds more light on claims. "... the WAA/sWAA switch, I have called it a fake control, because it doesn't do – technically doesn't do what it seems it should do," he explained.
Hochman in his deposition contends that even Google insiders, including Alphabet CEO Sundar Pichai, misunderstand the WAA control.
"It looks like even Sundar Pichai is confused about how this control works because he testified in front of Congress and told them something that is just wrong from a technical perspective…," he said.
[10]
This is spelled out more explicitly in a more recent [11]court filing [PDF]: "For example, Google CEO Sundar Pichai testified to Congress that, within 'My Account' user can 'clearly see what information is collected, stored.' That supposedly 'clear toggle' Mr Pichai was referring to could only be WAA."
That document goes on to state: "Contrary to Mr Pichai's Congressional testimony, the founder of Google's Privacy and Data Protection Office testified in this case that he is 'not aware of any setting' that users can employ to prevent Google from collecting data related to their app activity."
Much of the issue, allegedly, is that WAA, rather than saving data when on and not saving it when off, simply saves data in a different place – not in the Google Account data set. Addressing the confusion about the bounds of Google Accounts, Hochman said, "So I'm aware that Google may save data in different locations, depending on where that WAA/sWAA switch is set. It is still collecting the same data and still saving it, but it may save it in different places."
Firebase burns through personal firewall
The complaint alleges that Google still collects data from users who disable the WAA setting "through various backdoors made available through and in connection with Google’s Firebase Software Development Kit, including not only Google Analytics for Firebase but also without limitation AdMob and Cloud Messaging for Firebase."
Firebase, a cloud database, was acquired by Google in 2014, and as of 2021 was said to be incorporated into three million mobile apps. Third-party app makers can integrate Firebase using the Firebase Software Development Kit, which adds support for Google Analytics for Firebase, as well as mobile ad service AdMob and Cloud Messaging for Firebase.
Google, it's claimed, collects data from mobile third-party apps, even those who disable WAA, using Firebase SDK code, as well as Google Mobile Ads SDK, AdMob+ SDK, and browser "WebView" technologies.
"All of these products surreptitiously copy and provide Google with app activity data while WAA is turned off, including personal browsing data," the complaint claims.
[12]Google - yes, that Google - testing proxy scheme to hide IP addresses for privacy
[13]What's unconstitutional about Google keyword search warrants? Nothing, says Colorado Supreme Court
[14]Google's third-party cookie culling to begin in Q1 2024 ... for 1% of Chrome users
[15]Online tracking is alive and well in link decoration
The complaint cites statements from Google's own employees that suggest WAA is confusing and poorly understood.
Quoting specific exhibits in the case, the complaint says, "Google’s employees recognize, internally and without disclosing this publicly, that WAA is 'not clear to users,' 'nebulous,' 'not well understood,' 'completely broken,' and 'confuses users,' where people 'don’t know what WAA means' and Google’s promise of control is 'just not true.'"
The complaint cites internal Google communication about the true nature of the WAA control: "As summarized by a Google employee in an internal email, 'WAA (or any of the other controls) does not actually control what is stored by Google, but simply what the user has access to. This is really bad. … I for one didn’t realize Google actually stored all of my activity even if those controls were off and I work at Google! Seems sort of silly to turn them off as I’m not any safer with them off than on.'"
An Orwellian landscape
The complaint points out that related allegations have come up in recent government litigation against Google. It cites documents produced by Google in a 2020 case brought by Arizona's Attorney General that mention Web & App Activity by name. Google [16]settled that claim last year for $85 million.
"When users turned off their Location History in settings, Google continued to surreptitiously collect their location through other settings such as Web & App Activity and the company used that information to sell ads," the Arizona AG's office said when it [17]announced the deal.
Google declined to comment but has disputed many of the allegations in its [18]answer [PDF] to the fourth amended complaint.
The company in its filings has characterized the employee messages cited as "cherry-picked" communications that mischaracterize the technology or are taken out of context. Google maintains that the sWAA setting, through which third-party apps receive data, is so developers can understand app behavior and isn't saved to Google users' marketing profiles. Essentially, Google maintains that any data gathering is adequately disclosed and that app developers implementing Google Analytics are bound by the company's Terms of Service.
Coincidentally, earlier this year, Google [19]began [20]notifying some users of its services that they have Web Apps & Activity turned on. The message insists, "You're in control," and insists no action is required but allows that the setting can be changed.
Hochman in his assessment of WAA is unsparing.
"The situation I found upon the technical investigation was counterintuitive, it was not what I expected to find, and it is, frankly, kind of Orwellian, it is just very strange that you have a privacy switch that when you flip it, it just means we don't tell you that we're spying on you," he said.
"It is almost like the party slogan from 1984, you know, ignorance is strength, that's like what this is. That's what this control is. You flip the switch, you can remain ignorant of the fact that you're being spied on."
Yet whether Google has actually violated any laws here has yet to be decided. Last year, the judge hearing the case [21]dismissed [PDF] claims that alleged violation of the California Invasion of Privacy Act and breach of contract. What remain are three claims under California's Comprehensive Computer Data and Access Fraud Act, invasion of privacy and intrusion upon seclusion. ®
Get our [22]Tech Resources
[1] https://myactivity.google.com/activitycontrols
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZTeVxCCqGG57Ui2H97LiigAAABA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZTeVxCCqGG57Ui2H97LiigAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZTeVxCCqGG57Ui2H97LiigAAABA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://storage.courtlistener.com/recap/gov.uscourts.cand.362381/gov.uscourts.cand.362381.289.0.pdf
[6] https://ecf.cand.uscourts.gov/doc1/035123359512
[7] https://www.nytimes.com/2023/09/26/technology/google-antitrust-trial-secrecy.html
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZTeVxCCqGG57Ui2H97LiigAAABA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://storage.courtlistener.com/recap/gov.uscourts.cand.362381/gov.uscourts.cand.362381.344.0.pdf
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZTeVxCCqGG57Ui2H97LiigAAABA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://storage.courtlistener.com/recap/gov.uscourts.cand.362381/gov.uscourts.cand.362381.293.0.pdf
[12] https://www.theregister.com/2023/10/23/google_ip_proxy/
[13] https://www.theregister.com/2023/10/18/google_keyword_search_warrants/
[14] https://www.theregister.com/2023/10/12/googles_cookie_killing_timeline/
[15] https://www.theregister.com/2023/10/06/link_tracking_privacy/
[16] https://www.azag.gov/press-release/attorney-general-mark-brnovich-achieves-historic-85-million-settlement-google
[17] https://www.azag.gov/press-release/attorney-general-mark-brnovich-achieves-historic-85-million-settlement-google
[18] https://storage.courtlistener.com/recap/gov.uscourts.cand.362381/gov.uscourts.cand.362381.305.0.pdf
[19] https://www.mbsdirect.com/mbs-blog/article-what-is-google-web-app-activity-and-should-you-leave-it-enabled
[20] https://support.google.com/accounts/thread/196248961/i-keep-getting-reminder-you-have-web-app-activity-turned-on-emails?hl=en
[21] https://storage.courtlistener.com/recap/gov.uscourts.cand.362381/gov.uscourts.cand.362381.209.0.pdf
[22] https://whitepapers.theregister.com/
Re: Who can you trust...
Alumoi
When someone says "Trust me with your valuables," then I know that the chances of them being trustworthy are very low.
Nice to know I'm not the only one who doesn't trust banks, corporations and governments.
Killfalcon
Maybe I missed it, but the article could use a clearer explanation of what the WAA is alleged to do.
I think it's saying that if you turn it on, the data isn't saved to your google profile (the one where you can go in and see what adverts Google thinks you want, etc), but to an app-specific bucket that only the app in question can use. Since it's limited tot hat app, whatever data is in there doesn't appear in your Google profile.
However, that there are backdoors that let Google access that data anyway, even if it's not showing in your Google profile.
Is that right? For that to function, Big G would need to have some systems in place for secret profile data, otherwise bringing these two datasets (and any other hidden data sources) together for advertising but ensuring they never merge in a way that shows the user 'shadow' profile stuff.
Dinanziame
As far as I can tell, WAA is this:
[1]https://myactivity.google.com/myactivity?hl=en-GB&utm_source=google-account&utm_medium=web
and this is what Google uses for personalizing your searches. If I understand correctly, the claim is that this Firebase thing which is used for Google Analytics is storing the same data even if you turn WAA off. Definitely Firebase would be storing some data, but I suppose Google's viewpoint is that they are not actually storing the same data and it's fine to store some data for analytics because users accept it in a different place (maybe with a message like "send analytics data to Google to help it make improvements to tools" or something). The lawsuit's viewpoint is that Google should have a master switch which prevents Google from storing any data whatsoever no matter where and how the user accepted it, including analytics data.
[1] https://myactivity.google.com/myactivity?hl=en-GB&utm_source=google-account&utm_medium=web
Anonymous Coward
It's righ there in the article: IT DOES NOTHING FOR YOU!
"even the CEO Sundar Pichai isn't clear on what's going on below him."
jake
Who is surprised? His degrees are in materials engineering and an MBA ... Not exactly what I'd call fields well known for their in-depth knowledge of the Silly Con Valley technical world. Still, I guess he'll make a good scapegoat with well documented plausible deniability when the time comes for whoever is pulling his strings to sacrifice him.
"he testified in front of Congress"
Pascal Monett
Sure. He told them what they needed to hear to get off his back.
I'm sure Congress is really impressive, but it's not a judicial trial. El Zuck has lied his ass off there multiple times and he's still not in jail for it.
So Congress is just a nice little tea-time with barely any consequence, as far as I can see. But hey, it makes the Senators feel (even more) important, so . . .
Who can you trust...
...When it comes to your privacy? Yourself.
"Two men can keep a secret if one of them is dead." -- by Unkown.
"You can trust everyone but the question is: What can you trust them to do?" -- by chuckufarley.
The lesson here isn't that Google wants you to think it's being good and trustworthy because anyone with an ounce of sense knows they just want to make money, which is why they had an IPO. The real lesson is that trust is based on patterns of behavior. I trust my neighbor to play loud music every weeknight for 8 to 9 P.M. If they didn't do it I would know something was not right. When someone says "Trust me with your valuables," then I know that the chances of them being trustworthy are very low.