Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/31/2012
04:20 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Defends Privacy Policy Consolidation

Google sends letter to congressional representatives to clarify pending privacy policy revisions.

Responding to concerns expressed by members of Congress about its forthcoming privacy policy consolidation, Google on on Monday sent a 13-page letter to eight members of the House of Representatives.

Pablo Chavez, Google's director of public policy, characterized the letter in a blog post as an attempt to clear up confusion about what the company is trying to do by combining more than 60 separate privacy policies into a single policy and similarly unifying multiple terms of service documents.

When Google last week announced its intent to clean up its privacy policies on March 1, Google privacy director for products and engineering Alma Whitten explained that the company "may combine information you've provided from one service with information from other services." This will allow service personalization in one Google service to be informed by data from a different Google service, and hopefully provide a better user experience across products.

As an example, Google in its letter notes that its current privacy policies would not allow it to recommend cooking videos on YouTube to a signed-in user who had previously been searching for cooking recipes.

[ Google's service policies don't please everyone. Read Google+ Name Policy Leaves Users Unsatisfied. ]

Harmless though that may sound, Google's plan has elicited concern from government officials, in part because Google is under the microscope at the moment. Regulators in the U.S. and Europe are presently investigating whether the company is conducting its search business in an anti-competitive manner. Google has also invited such scrutiny through the introduction of a search feature called Search plus Your World, which mixes Google+ posts and images in Google search results, to the potential detriment of competitors like Facebook and Twitter.

Congressman Edward J. Markey (D-Mass.), among others, issued a statement last week questioning how much control Google users have over their personal information and asserting that users must be able to decide whether they want their information shared across Google services.

Google's letter assures lawmakers that its commitment to protecting the privacy of its users has not changed and that the upcoming changes will lead to a better experience for users. At the same time, the letter confirms that users will not be able to opt-out of the forthcoming change.

"If people continue to use Google services after March 1, they'll be doing so under the updated privacy policy," the letter states in response to a question about the possibility of opting out. "The use of a primary privacy policy that covers many products and enables the sharing of data between them is an industry standard approach adopted by companies such as Microsoft, Facebook, Yahoo, and Apple."

But the letter goes on to point out that more than 30 Google services, such as Google Search and YouTube, can be used without signing in to a Google Account, thereby precluding the collection of personal data beyond the user's IP address.

It also points out some of the tools Google provides to help users control how their personal information is stored and used, like Google's Dashboard and Ad Preferences Manager, the privacy features supported in Chrome and Gmail, and the company's Data Liberation service, which provides a way to export most Google data.

How can companies find and fix vulnerabilities before they lead to a breach? Better yet, how can software developers identify flaws in their applications before the new software is ever deployed? In this report, Eliminating Vulnerabilities In Enterprise Software, Dark Reading offers a look at some tips and tricks for software development and vulnerability assessment. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27132
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVE-2021-3144
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2021-3148
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVE-2021-3151
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...