Internet giant Google has reached a settlement with the Federal Trade Commission over the launch of its Google Buzz social networking service. Although the settlement does not have Google paying any money to the feds, the agreement does contain a clause that opens a whole new arena for federal regulation of Internet businesses: Google will be required to implement a comprehensive privacy program, and will be subject to regular, independent privacy audits for the next 20 years.
“When companies make privacy pledges, they need to honor them,” said FTC chairman Jon Leibowitz, in a statement. “This is a tough settlement that ensures that Google will honor its commitments to consumers and build strong privacy protections into all of its operations.”
The move marks the first time the FTC has ever ordered a company to implement consumer privacy protection.
A little over a year ago, Google ignited a firestorm of criticism when it launched its Google Buzz social network as an adjunct to its popular Gmail service, both because it enrolled users in aspects of Google Buzz without their fully informed consent but also automatically disclosed details of users’ contacts and correspondents. Although Google scrambled to offer more privacy options shortly after launching the service, the damage was done: Google was subjected to class action suits from consumers, and the FTC launched an investigation.
The FTC charged that the Google Buzz launch violated the company’s own privacy policies and amounted to engaging in deceptive tactics by using information provided for one purpose—Gmail—for launching a new social networking service. As an example, when Google launched the service, Gmail users were offered a choice between checking out Buzz and going straight to their inbox. However, nothing informed users that checking out Buzz would expose their contacts to other Buzz users, and users opting out and choosing to go to their inbox had certain Buzz features activated for them without their consent. The FTC also alleged that features that enabled users to turn off Buzz and control how they appeared to others were misleading and did not disclose what information would be shared with others.
The proposed settlement bars Google from misrepresenting the privacy of users’ information, or misrepresenting the company’s compliance with U.S.-EU Safe Harbor and other privacy programs, and requires users to obtain explicit consent before sharing their information in ways that contradict or weren’t covered in initial privacy representations made to users. Google will also be subject to 20 years of independent audits on its privacy and data protection practices.
The settlement isn’t a done deal yet: once published in the Federal Register, there will be a 30-day public comment period, after which the commission will rule on whether to make the settlement order final. The public can comment on the settlement agreement online or via postal mail.
Late last year, Google paid $8.5 million to settle a class action lawsuit brought against it over the Buzz launch.
