In May, CNBC discovered that Google tracks your purchase history through a little-known Purchases page that pulls information from Gmail emails like order confirmations. It tracked both physical purchases and online ones, and there is no setting in the Data & Personalization page on Google Account to turn the feature off.
Google claimed that the data could be deleted if users didn’t want the company to know everything they bought online. But in practice, deleting purchases was not so easy. Purchases cannot be deleted in bulk, and the only way to remove an item from the Purchases page is to delete the email from your Gmail inbox.
This was bad enough, but it gets worse. CNBC’s Todd Haselton, who first reported the story, went through his Gmail inbox to delete every single purchase email, one by one, in order to remove the purchases from his Purchases page. He went back three weeks later and found that the Purchases page still has a list of all his purchases, going back years, even after he deleted the emails. This is particularly concerning as it indicates that Purchases aren’t just being pulled from Gmail, but rather they must be cached or stored elsewhere.
In our testing, the Purchases page originally showed one recent purchase and a handful of older items. We were able to delete one item from the Purchases page by deleting the original email. The page then said “You don’t have any purchases,” and strangely, the older items no longer showed up. Testing with another account, the page seems to load one month’s worth of receipts at a time. If you have no receipts from this month then the page will claim to not have any purchases stored. But the older items don’t seem to have been actually deleted; they are simply no longer shown on the page.
Between Haselton’s experience of deleted emails not deleting Purchases items, and our experience of items more than one month old being hidden, it seems that it is essentially impossible to permanently delete these records. Google keeps a record of every single item you purchase from any source if a recognizable receipt is sent to your Gmail address.
This is yet another example of Google’s dismissive attitude to user privacy, despite its claims to the contrary.
