Google Blogoscoped

Friday, April 29, 2005

Search History Privacy

This is just a little clarification to certain My Search History privacy issues which have been discussed lately. Some people said they have problems Google can now connect your name to your searches. The truth is, Google always could, as soon as you log in to any of their services – like Gmail.

How does it work? Cookies which sites can save on your PC can only be read from the domain that writes them. Wouldn’t this mean Google.com and Gmail.com cannot share their cookie? No – Gmail.com will redirect to the Google subdomain gmail.google.com, thus enabling this cookie to be read by both applications, search and email (the same approach is used in e.g. Froogle.com or Googlegroups.com, which redirect to a subdomain of mother Google). This means that when you login to your Gmail on Tuesday, and you close the browser, and on the next day you open Google.com, your searches can be connected to your name. This does not mean Google Inc does do connect the two, neither does it mean anything useful could be done with such a mass of searches (hundreds of millions); it only means that technically, even before My Search History, Google could connect searches to individuals under certain circumstances.

In fact, even when you logout of Gmail (or My Search History, for that matter), there is a chance Google could identify you: if your computer is connected to the internet with a static IP address. Even when there’s a dynamic IP, with some work (a strong legal case and a talk to your provider), someone – say, the NSA, or Homeland Security – could find out who was connected with which dynamic IP at a certain point of time.

Reading the Google Privacy statement you’ll see that Google admits they will share your personally identifying information if they conclude they “are required by law or have a good faith belief that access, preservation or disclosure of such information is reasonably necessary to protect the rights, property or safety of Google, its users or the public.” (Google also says they may share this information with “trusted businesses or persons for the sole purpose of processing personally identifying information on our behalf.”) This privacy statement isn’t new. There are reasons to be concerned, but you should be concerned about your politicians then and the laws they create. Google follows these laws, and if the law turns evil, Google could too.

A last way to identify persons even before My Search History would be to track search patterns. As soon as someone “ego-googles”, future queries can be connected to this person. Ego-googling could consist of searching for one’s name on Google, one’s address on Google Maps, or one’s backlinks*. (You can also connect search query patterns to other patterns such as the ISP used, the languages used in queries, typical access hours, or the IP area.) This individual now never needs to be logged in into Google in the first place to be identified – a single ego-googling would be the missing piece to complete the puzzle.

*For myself, using a dynamic IP at home and without being logged in, Google could know I’m from Germany, I speak German and English, I searched for “link:blog.outer-court.com” (my domain can be connected to my full name using public WHOIS information), and when I now search for “how to build a bomb”, they’d have a very good chance to find me if they wanted to.

So does My Search History really change any privacy issue? No. The only thing different now is that the user can see what Google could always see as well. And of course, the incentive on the user’s side to login has increased, so chances are Google can track even those who never log in to any other Google service like Gmail. In any case – it’s very likely Google, even if they would be evil (I’ve no reason to think they are), couldn’t see any commercial merit in tracking individuals. The sad truth is the big G doesn’t really care that much about you specifically; paranoia, in this case, would just mean being vain.

Advertisement

 
Blog  |  Forum     more >> Archive | Feed | Google's blogs | About
Advertisement

 

This site unofficially covers Google™ and more with some rights reserved. Join our forum!