San Francisco — In an attempt to avoid lengthy legal procedure, search engine giant Google on Wednesday agreed to a historic settlement with the Federal Trade Commission over charges that its Google Buzz social-networking service employed “deceptive tactics” and violated user privacy when it introduced the service in 2010.
Not that Google is off the hook, but the search engine giant’s settlement is remarkable, not only because it marks the first time the FTC has accused a company of violating privacy rules spelled out under the U.S.-EU Safe Harbor Framework.
The proposed settlement is the first of its kind that would task Google to institute a “comprehensive privacy program” as part of the agreement to settle allegations that last year’s launch of Google Buzz, a foray by the Web giant into social media networking, and require that the company submit to independent privacy checkups once every two years.
The FTC wrote in a statement, that the Mountain View, Calif.-based company has entered into a settlement agreement, which prohibits the company from future privacy misrepresentations, requires it to implement a regular reports on its privacy practices prepared by an independent privacy audits for the next 20 years.
In a blog post, Google apologized for the “blunder we made with Buzz” and noted that the FTC’s announcement “thankfully put this incident behind us.”
The stringent action against Google is meant to ensure that companies honor privacy pledges, the FTC said. The company will also be required to obtain “affirmative consent” from users before changing how it shares their personal data with third parties.
“When companies advocate privacy pledges, they need to honor them,” said Jon Leibowitz, the Democratic chairman of the FTC. “This is a tough settlement that ensures that Google will honor its commitments to consumers and build strong privacy protections into all of its operations.”
The settlement, approved 5-0 by the commissioners, is subject to public comment and final approval. Commissioner J. Thomas Rosch, a Republican, suggested in a separate statement that he has “substantial reservations” about the scope of the settlement.
Did Google agree to it “because it was being challenged by other government agencies and it wanted to ‘get the commission off its back?'” Rosch wrote.
“Given that Google did not intentionally try to deceive people with Buzz, the 20-year privacy audit is a severe penalty,” said Greg Sterling, principal analyst at Sterling Market Intelligence. “I think that the FTC is trying to make an example of Google and signal that it is really serious about privacy.”
When the company unveiled Buzz, it automatically forwarded Gmail members’ address books to anyone included in their list, a shocking move that infuriated many. In one of the more notorious cases (NSFW), a Google Buzz user hiding from her allegedly abusive ex-husband unintentionally sent him her contact (and location) info.
Google is certainly feeling compromising — Google privacy director Alma Whitten wrote on the company’s official blog that “the launch of Google Buzz fell short of our usual standards for transparency and user control–letting our users and Google down.” Indeed.
However, “We will receive an independent review of our privacy procedures once every two years, and once the new privacy features becomes effective, we will ask users to provide us affirmative consent before changing how we distribute their personal information,” Whitten wrote in the post.
Furthermore, there is no monetary penalty, but Jessica Rich, the deputy director of the FTC’s Bureau of Consumer Protection, explained that the agency considers the settlement as a “tough order that will inflict substantial costs,” particularly as Google will have to hire an outside auditor to monitor their privacy policies.
Google will also be charged $16,000 per violation to the FTC’s order. Rich said that the Google Wi-Fi incident, in which Google inadvertently accumulated passwords and other personal information from users via its Street View project, would have constituted a violation to the FTC’s order.
“I think that many provisions in this order are good business practices that we would expect to see followed throughout the industry,” Rich said of the settlement.
Google released Buzz in February 2010. It consists of a “news feed” feature to Gmail and was also integrated with Google’s mobile offering on Android phones and the iPhone. Amidst concerns over what information was displayed publicly, however, Google soon refined Buzz to give user more control over their settings.
This did not satisfied all users, however, and a class-action suit was born. The Electronic Privacy Information Center (EPIC) also filed a complaint with the FTC, resulting in this landmark settlement, which EPIC said is “far-reaching.”
“It is the most significant privacy decision by the Commission to date,” EPIC said in a statement. “For Internet users, it should lead to higher privacy standards and better protection for personal data.”
Moreover, this settlement comes as Google is under pressure from government competition agencies, with antitrust allegations in Europe and an ongoing Justice Department review of a $700 million bid to acquire airline flight and ticket information provider ITA Software. In addition, rivals are intensifying their anti-Google efforts, including objecting to the Google Book Search settlement and lobbying against what was a proposed partnership with Yahoo.