I look at Site A and it has adsense on the page. Google knows my IP when it serves the advert to me. Later, I look at Site B, and Google serves me another advert on the page. They know it is me again, without me ever having been near a Google search box.

There are even a couple more issues in this area I would be interested in learning/hearing more about. The first area related to 3rd parties and privacy. In this day and age of web services and mashups, what happens when more than one company is responsible for your privacy information? How are privacy conflicts resolved? Who is responsible, ultimately, when there is a muck-up?

For example, you remember the kerfuffle last year around AOL’s release of “anonymized” search data. Well, while it is true that searchers went to AOL’s site to do the search, the search itself was a Google search. Complete with Google branding, right there on the AOL page. When I see the Google logo, and I see the search box, there is an expectation that my searches will be held in the utmost Googalian privacy respect; because I am using the Google engine, Google will fight for the privacy of those searches, like when they stood up to the DOJ.

And yet Google was 100% unable to keep AOL, their partner, from releasing this data. Most of the blogosphere counted this as a AOL screwup, not a Google screwup. But given the strong Google branding of the search box itself, it is not unreasonable to expect that Google is going to protect my privacy. Protect it from AOL as much as from the DOJ. But Google did not.

So, again, how should privacy operate in this era of distributed web services and multiple companies through which your data passes?

And the second issue is not completely unrelated. Hand-in-hand with data privacy is data ownership. Companies make money off of the data they collect from us, whether by reselling that data directly, or by using it to tune their algorithms to better target ads. And this is not just search data; it is web-page visiting data, AdSense click data, etc. Either way, that data is gold. And yet, we are not seeing any of that money. We are at least co-owners, if not solitary owners, of that data, correct? So how do we ensure that we get paid?

Some may argue that free search services are payment enough. Maybe that’s true; maybe that is a fair trade. But what if I never use Google search, or any other Google product? Google would still be collecting data about me through their Analytics and AdSense services. I am still not seeing any money from my data. I never had the chance to agree to that deal. I never signed any agreement, entered into any contract. My data is still used and profitted from.

So hand-in-hand with privacy is the issue of data ownership and data reuse and profit made from that data. I’d be interested in learning more about the issues around both of those areas.

http://searchengineland.com/070612-041042.php

Toward the end, I have a section called “Beyond The Obvious” and point out some things like:

“That’s just some of my accounts. If I delete my web history, I know that data is destroyed, though what’s kept on offline archives currently is not destroyed, from what I was last told. If I go to the Gmail privacy FAQ (far more useful than the Gmail privacy policy, which fails to link directly to the FAQ), I’m told deleting my mail really deletes it, even off backups, though that might take time. But then again, are these deleted from online backups only? What about offline?”

Most of the privacy groups — as does the congressman — seem stuck in this what do you do with cookies and IP world that made sense in the 1990s. Today, it’s much more about the data collected from when you are logged in. That’s data Google and others collect with a much better idea of who you are. How do you kill it? How long is it retained (with Web History at Google, forever until the user themselves decides to kill it). If the company changes management, can you keep control of your information?

We need a comprehensive look at the type of data gathered about online activities — not just by Google — and probably some federal laws backing up our protection. I wouldn’t mind seeing some better protection of our much more personal data in the real world, as well.

But what do you mean by “go beyond the obvious”? Most Americans do not even realize that search engines track their activity, much less the issues around the wide base of cookies that the DoubleClick merger allows. It might be obvious to you, it might be obvious to me, what the potential pitfalls are; but it is not obvious to the average Joe, and probably not obvious to lawmakers. They’re not experts on these sorts of things. And they’re not experts on knowing which places to look to find all the answers.

So I honestly do not ask this question as any sort of rhetorical challenge. I ask because I do not understand. What do you mean for the congressman to go beyond the obvious?

R McCarley: It’s not over if there are “worse” things that could happen. Google’s had this surface check already by many others, plus some of the things being asked aren’t even substantial. Read the questions again. I don’t want a “perceived” value to be doing something. I want something to actually be done of substance.

Jordan: I guess if you’ve been covering search privacy issues as long as I have, you realize that most of what’s asked has been answered plus there’s a lot that should be asked that isn’t covered. I want the politician to have educated themselves beforehand, ask substantial questions, and do a proper review. This kneejerk, oh, we didn’t get to meet so answer this stuff in six days is stupid. Call a committee together on search privacy in general, and when you have hearing, let’s talk about the entire footprint of what happens to search logging from your desktop (do you have desktop search privacy rights?) through your ISP (no one ever mentions them, and they see all), to Google and other search engines.

As for answering things in one place, I along with others have suggested that Google beef up their privacy area, and they’ve actually made some progress. And it is well within the capabilities of this congressman to find it. But I might very well do another open letter to show it myself.

Stone: I make a living writing about search, to an audience that depends on me. I was writing about search before Google existed, and I don’t need to be cozy to them in any way, shape or form. I won’t drop a million links here, but I’ve covered in some detail that Google is already menacing without DoubleClick, so if that’s a concern, the congress reps should just get on with things. And back to being cozy, this is what I said the last time we had a bunch of lameness from congress:

“Indeed, so instead of blowing the wad of investigating Google-DoubleClick, why not investigate whether Google is trampling laws by both being a leading traffic source for some web sites while also being their leading revenue generator? Or whether Google simply has too much insight into the web that gives it an unfair advantage; i.e., if it offers free tracking tools, ads, free wireless, free web acceleration tools, and more, does that mean it effectively knows everything happening on the web operating system, so that it can improve the quality of its search and other products in a way that no one else can match.”

http://searchengineland.com/071120-100056.php

That’s substance. That’s something they aren’t looking at. This let’s ask about 1999 cookie issues is tiring, not when issues have progressed so far beyond that.

JG: I didn’t advocate any policy other than a politician shouldn’t waste time asking for answer that have already been given. That’s time they are not spending getting into real issues. I totally agree — there’s nothing wrong with this information being given officially by Google. The thing is, much of it has been. They can organize it better, but I can’t stress enough how much of it is not difficult for this congressman to already find, so that he can GO BEYOND THE OBVIOUS.

Jordan writes: I don’t think it matters that various answers could be arrived at via fragmented bits and pieces across the Web. The more fragmented the answers, the less accountability? (or at least the greater the opportunity for spin)

I think have to strongly agree with Jordan, here. So long as all the pieces of the Google puzzle are fragmented, outdated, inconsistent, scattered, changing, and otherwise not nailed down in any accountable way, Google has room to wiggle, avoid, change, spin, deny, and otherwise avoid accountability.

Note here that I am not claiming that Google necessarily has any accountability to avoid. They may not. But if so, then, like Jordan says, the CEO of GOOG should put the answers all in one place, answer them at one time, and make it very clear to anyone who uses any Google-owned service when any of those policies change.

Because otherwise, Danny, the approach you advocate means that, if Google breaks any policy that they have supposedly written in some blog post, or talked about in some YouTube video, they retain a “plausible deniability” in that they can say that the employee that wrote that post or made that video was not authorized to do so.

Or, they can claim that the inferences that you or I made, when culling together all the disparate puzzle pieces, were not correct inferences. Certainly you have to agree that there are conceptual or informational gaps in Google’s blogpost answers to many of the Congressman’s questions, eh? So when you or I pull together various blogposts, and try to infer what Google is actually doing, try to fill in the gaps, we might not necessarily get it right. So what is so wrong with asking for a full, complete statement?

Do you ever listen to “This American Life” on NPR? You should download this week’s (last weekend’s) episode. It recounts the 10-month long experience that one woman had with her phone company, trying to deal with billing charges that were mistakenly levied against her. Over and over, she calls up the phone company, and gets a different story from almost every employee she talks to. Something that appears to be set in stone one week turns out never to have been a policy the next week. By the end of the story, some of the information that she has gleaned from her interactions (“basic homework”) does turn out to be true, but a lot of the information is not. How much easier would her life have been if she had just had the proper information to begin with?

So what is wrong with wanting all the relevant information officially culled by Google, directly and (more importantly) officially?

If Google really has set out its policies in all these blogs and public statements and videos, and there really are no gaps or conceptual missing areas between all these pieces of information, then Google should have zero trouble with simply packing all that info together into one bundle, right? I mean, Google is an information organization company. Its job is to keep things like that organized.

The one thing that Google does that they will need to stop is their use of restrictive, anti-competitive language in publisher contracts. I’ve heard that they used to, and still might, basically prevent publishers from working with certain other companies because they’re working with Google. That is NOT appropriate behavior and is really something that you’d expect to hear coming from Microsoft.

I don’t think it matters that various answers could be arrived at via fragmented bits and pieces across the Web. The more fragmented the answers, the less accountability? (or at least the greater the opportunity for spin)

I think a lot of people (myself included) would like the CEO of GOOG to issue in ONE place an answer to ALL of these questions. That would be far more powerful, and the ball is in his court …

I also think FB is next, given their obvious coupling of PII with distributed browsing behavior.

Jordan at http://kickstand.typepad.com