case study - mt

Case 4 Google Searches for Solutions to Privacy Issues 425

This material was developed by Kelsey Reddick, Jennifer Sawayda, Michelle Urban, and Isaac Emmanuel under the direction of O.C. Ferrell and Linda!Ferrell, © 2019. This case is intended for classroom discussion rather than to illustrate effective or ineffective handling of administrative, ethical, or!legal decisions by management. All sources for this case were obtained through publicly available material.

Google Searches for Solutions to Privacy Issues CASE 4

Introduction Google’s ease of use and superior search results have propelled the search engine to its number one sta- tus, ousting former competitors such as AltaVista and WebCrawler. Even later offerings by other large tech companies using comparable algorithms, such as Bing by Microsoft, have failed to make significant inroads with internet users, with Google retaining an impressive 90 percent of the global market share of mobile, web, and in-app searches. Each day, more than 3.5 billion searches are processed by Google. As the search engine gained popularity, it began expanding into several dif- ferent ventures, including web analytics, advertising, and digital book publishing. It has spent billions to acquire hundreds of companies in a variety of industries, from robotics to smart home devices to intangibles such as voice recognition technologies.

As may happen with any large company, Google has experienced their share of ethical issues. Their mantra “Don’t Be Evil” was called into question after they worked with the Chinese government on a secret project called Dragonfly to censor aspects of some of their sites to enter the market. Though Dragonfly was ultimately terminated, Google’s vice president of public policy would not commit to the U.S. Senate to not engage in censorship in China in the future. Google has also been investigated and sued by multiple governments based on concerns that their widespread reach and market power violate antitrust laws.

The hot ethical topic for many internet users, how- ever, is the company’s approach to internet privacy and collection of user information. To improve their services— including customized search results, targeted ads, and more precise integration of their various offerings— Google tracks and leverages user information without explicit permission (although Google’s privacy statement informs users about the recordkeeping, and Google does allow users to opt out of some forms of tracking). Such tracking is common practice for internet companies, but Google’s deep access to so many different types of user information has led people to question whether Google violates user privacy. Considering the increasing amount of cyberattacks and the U.S. government’s determination to crack down on these illegal attacks, consumers also worry their private information, tracked and stored by Google’s algorithms, might be compromised.

This case analyzes Google’s efforts to be a good corporate citizen and the privacy issues the company has faced. The analysis starts by providing background on Google, their technology, and their initiatives. Google’s efforts to be a socially responsible company is dis- cussed. We then discuss the criticisms levied against Google, including their initial attempts to break into the censored Chinese market, their tracking of users, and more recent changes to their privacy policies. We examine how Google has sometimes clashed with gov- ernment authorities. Finally, we review some of the legal methods that have been proposed to regulate internet data collection practices and Google’s response to the proposals.

Company Culture Google adopted a decentralized approach to empower their employees. Their corporate headquarters in Mountain View, California, is known as the “Googleplex” and consists of a campus containing such amenities as on-site gymnasiums, swimming pools, a bowling alley, an outdoor volleyball court, and even high-tech “nap pods” for optimized downtime. When Sergey Brin and Larry Page founded the company, they recognized employees had to put in long hours to make the company not only successful but flexible enough to adapt to the changing environment. Thus, Google employees are provided with fringe benefits to make the campus seem like their second home. They built a sense of community with break-out zones and micro-kitchens around the campus in addition to their peer-to-peer coaching program, Googler to Googler. The company strives to make their corporate culture fun and innovative.

At the same time, Google works to ensure they have top talent. While they reinvent the office experience, they also take different tactics in recruiting to ensure they hires the most creative, talented individuals. For instance, Google recruiters take a bottom-up approach when reading résumés. Recognizing that top items such as education and work experience do not always guarantee the applicant is innovative, some Google recruiters start at the bottom of the résumé where applicants put more creative information. Google’s innovative approach to company culture is one of the reasons why they have become successful in so many different market niches.

C B P _ F errell_ C a s e _ Studie s.indd 425 12/9/2019 6:23:04 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society

426 Case 4 Google Searches for Solutions to Privacy Issues

Products Although Google started out as a search engine, they have since branched out into a variety of fields, including consumer electronics and productivity tools. While it would be too long to list all of Google’s products, some of the more popular offerings are described below.

Search Engine According to Larry Page, a good search engine “under- stands exactly what you mean and gives you back exactly what you want.” This philosophy was the founding principle behind the creation of Google and is a fundamental reason why the Google search engine surpassed competitors.

Google could not have gained such prominence without an in-depth search index of the web’s content. The company creates this index using programs called “Googlebots”—automated web crawlers that visit web- pages, add their content to the index, and then follow the links on those pages to other parts of the internet. This process is ongoing, with every indexed page periodically revisited to ensure the index contains the most updated material. Google’s index is one of the most extensive in the world, with well over 100 million gigabytes worth of information.

A good search engine’s index must not only be comprehensive but also easily accessible. To achieve easy access, Google uses algorithms to organize search results according to their perceived relevancy. Google constantly searches for new pages in a process called crawling. When a new page is crawled, Google analyzes its contents and catalogs it, a process called indexing. When a user types a search term into Google’s search box, Google’s index matches the term with what is deemed the most relevant materials and creates a list of these materials for the user, a process called serving. The order in which the results are served to users is called ranking. Factors considered in ranking include user’s location, language, device, site load speed, and more. Each search result is followed by a few sentences describ- ing the webpage (called a “snippet”). To maintain a competitive edge, Google responds quickly to their users’ queries, with a typical response time of approximately one-fourth of a second.

Advertising Google’s main source of revenue is advertising. The company earns approximately $116 billion in advertis- ing revenue. Google’s signature advertising platform is Google AdWords, first introduced in 2000. Google AdWords differs from traditional advertising in that advertisers do not pay Google anything upfront, but only pay when customers take action—either by viewing the ad (pay-per-impression), clicking on the ad (pay-per- click), or performing a certain predefined action such as

making an online purchase (pay-per-conversion). This model is attractive to advertisers because they only pay when their ad is effective, as determined by the metric of their choice. The twist, however, is that Google does not set ad prices, but rather puts their limited advertising space up for auction; companies submit “bids” for how much they will pay per customer action, and higher bids generally get more ad time (other factors are also considered, such as how popular an ad has been so far). Since Google makes no money from even a very high bid if customers do not engage with the ad, advertisers are incentivized to bid high, which benefits Google’s bottom line. Google promotes the model as a win-win; the company makes a profit and customers get more bang for their advertising buck.

Google leverages their various product offerings to provide a variety of attractive advertising options. Companies can choose to have their ads displayed as “sponsored links” alongside search results for certain keywords, or as banners on any of the more than two million websites that display Google ads in return for a cut of the profits (known as the Google Display Network). Google continuously expands placement options to improve ad performance. YouTube is another option, offering video ads before, during, or after videos, as well as traditional banner space on the site. Mobile is also becoming a critical advertising space, through searches on both mobile devices and apps that allow advertising. Improving the effectiveness of their AdWords service is a key driver of Google’s collection of user information—the more they know about their users, the more targeting options they can provide to advertisers and the more precisely they can serve targeted ads to desired consumer segments.

Web Browser Google Chrome is the most popular web browser in the world with about two-thirds market share. When Google Chrome was released, it was praised for its unparalleled speed, support, and security. The Chrome browser is known for loading within seconds and maintaining a simplistic design to make it easier for users to navigate. Chrome is also updated more frequently than most of the other browsers, allowing Google to quickly push out new features and security improvements. With more than 1 billion monthly active users, the web browser has a vast audience. The Chrome Web Store contains a wide selection of apps and extensions, providing additional flexibility and functionality for users.

Email Account Google’s email account service, called Gmail, has more than 1.5 billion monthly active users and is the world’s largest email service provider. Gmail was initially revolutionary for the huge amount of space it offered—1 gigabyte per user when rivals were only

C B P _ F errell_ C a s e _ Studie s.indd 426 12/9/2019 6:23:04 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society

Case 4 Google Searches for Solutions to Privacy Issues 427

offering 100 mega bytes or less—and the integration of Google search, which gave users a robust way to search within their stored emails. Since then, Gmail has continued to offer popular features such as snoozing, email “nudge” reminders, email scheduling, clickable attachments, two-factor authentication, predictive Smart Compose, a variety of add-ons, and deep integration with other Google products such as Hangouts, YouTube, Maps, Drive, and Calendar.

YouTube In 2006, Google acquired video sharing site YouTube for $1.65 billion. YouTube allows users to upload and share original videos and has become the second most visited of all websites (Google.com is the most visited site in the world). Everyone from global corporations to consumers uses YouTube to share videos ranging from video blogs to parodies, to corporate messages to news events. By selling video advertising slots before, during, and after videos, as well as placing banner ads in free space on the site, Google has made billions in advertising revenue. Additionally, YouTube content creators can share in advertising profits from their videos through YouTube’s Partner Program, allowing popular “YouTubers” to make careers out of their channels.

Although YouTube opened up new opportunities in marketing and entertainment, it has had its share of controversy. YouTube has been sued by organizations such as Viacom for copyright infringement after find- ing copyrighted content on YouTube’s site. YouTube’s Community Guidelines specifically directs users to respect copyright. However, not all users heed the warning. To detect and eliminate copyrighted material, YouTube enables users to “flag” videos for copyright infringement. If, upon review, the flag is found to be valid, the offending video is removed. YouTube has invested $100 million in automated system called Content ID which automatically compares newly uploaded videos to a database of copyrighted material and notifies the copyright holder if a match is found. To date, Content ID has paid more than $3 billion to rights holders. Google believes providing tools to enable self-interested copyright owners to protect their property is the best way to police YouTube, arguing it is simply not feasible for the company to screen the more than 500 hours of video uploaded to the site every minute.

Android In 2005, Google acquired the startup firm Android Inc., which worked on mobile phone software technology. In 2008, the Android operating system was released by the Open Handset Alliance, a team of organizations led by Google whose mission is to promote development of open standards for mobile devices. The Android operating system is an open source platform, meaning

the source code is available for outside users to view and use. However, Google has copyrighted the Android name and logo, as well as some proprietary features of Google’s version of the software. Companies that wish to claim they make “Android” devices must enter into a licensing agreement with Google. The Android operating system is most often used in mobile devices and tablets but can also be found on other devices, including full computers, game consoles, and digital cameras.

Android has become the most popular mobile operating system in the world, making up over 86 percent of the market. In many countries, Android has more than 90 percent market share. Apple’s iOS, while undeniably a strong competitor with a loyal customer base, trails far behind with 15 percent of the smartphone market. One reason for Android’s larger market share is that, unlike Apple and their iPhone and iPad, Google is not the only company that makes Android phones and tablets; Samsung, HTC, Motorola, T-Mobile, Sony, and many other manufacturers develop Android devices. However, there are disadvantages to this approach. For example, Amazon built their mobile offerings, the Fire Phone and Kindle Fire tablets, off the Android open source code, and now competes directly with Google in the mobile sphere. In Europe, Google’s partners can now offer Android-powered phones without Google apps pre-installed on the devices. Google is also a direct player in the mobile device market with their Nexus line of phones and tablets, placing them in the uncomfortable position of competing with their business partners. Still, Android has been a great success for Google, vastly increasing the company’s reach into electronics. One top Google executive called the initial Android Inc. acquisi- tion the company’s “best deal ever.”

Web Analytics In November 2015, shortly after acquiring Urchin Software Corporation, Google released the free web analytics service Google Analytics which has grown to become the most popular web analytics service on the web with approximately 30 million active sites. Google Analytics tracks and freely reports website traffic statistics, giving businesses a market research tool to understand how customers are interacting with their websites. The dashboard is broken out into five reports: Realtime, Audience, Acquisition, Behavior, Conversions. Google Analytics 360, a premium version, is designed to help companies target potential customers with even more in-depth analytics, tying in data from other Google products such as Tag Manager and Data Studio. The tool identifies the habits of individuals from web and television to mobile, competing with companies like Salesforce and Oracle. Services like Google Analytics helps website owners measure and interpret the effec- tiveness of business activities. Google tracks visits via a user’s IP address, raising some privacy concerns.

C B P _ F errell_ C a s e _ Studie s.indd 427 12/9/2019 6:23:04 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society

428 Case 4 Google Searches for Solutions to Privacy Issues

Expanding the Product Mix Google offers several other popular products to businesses and consumers. Google Translate and Google Maps offer automated translation and mapping/directional services. Google Flights provides flight information including price data from many airlines. Google Drive allows users to store files in the cloud and share them with others. The service offers 15 gigabytes of free storage per user, and more can be purchased if desired. The company is also investing in artificial intelligence (AI) processing and has developed a new chip called the Tensor Processing Unit. This is a breakthrough in the more sophisticated systems needed to run artificial intelligence applications. Google aims to push AI processing into devices like phones and virtual assistants.

Google is also known for their forays into exciting and cutting-edge technologies, especially through their semi-secretive Google X department, whose mission is to develop “moonshots”—science fiction-like technologies that have a slim chance of succeeding but could change the world if they do. Research projects underway at Google X include using machine learning to teach robots new skills and using space optics to transmit high-speed data. One of their retired initiatives involved developing a real-time heads-up display for the average consumer. The end result was Google Glass, a wearable computer in the form of glasses worn on the face that can display information in front of the wearer’s eyes, respond to ver- bal and movement commands, and more. Google Glass was publicly released in 2014 and has been applied to a wide variety of commercial applications, from providing doctors with hands-free information during surgery to helping autistic children interact with their environ- ment. However, the device never achieved mainstream popularity. The style of the glasses was unappealing and the technology created privacy concerns since wearers could use them to record others without permission or cheat on exams. Though Glass was retired, the product lives on in its enterprise edition for businesses. The technology highlighted the need for rules to protect people from being recorded.

Google’s Initiatives Like all successful major corporations, Google is expected to act with integrity and give back to the communities where they do business. Google has invested in a number of initiatives that support economic development, envi- ronmental awareness, and charitable endeavors.

GV In 2009, Google formed Google Ventures, later shortened to GV, as a separate entity to provide funding for startup firms. The venture capital fund began with $100 million in seed money and now manages more than $4.5 billion

in assets of its own. They invest this money in startup companies at the forefront of technological innovation. The money goes not only to firms that market internet- based technologies or consumer electronics, but also to green technology firms, biotechnology and life-sciences companies, and more. Their best-known investments include Uber, Lime, and Slack. GV’s goal is to invest in entrepreneurs that can change the world through technology by having “a healthy disregard for the impos- sible,” mirroring what the Google X department is trying to do within Google itself.

Google Sustainability Google has recognized the business opportunities that come from adopting sustainable operations and technologies. Greener technology not only saves Google money in the long run with decreased energy costs, it also enables the company to create greener products for consumers. Google, which reached their goal of 100 percent renewable energy for their global operations in 2017, claims their data centers use 50 percent less energy than typical data centers. Now, 100 percent of shipments to and from Google are carbon neutral. Google has committed to include recycled materials in every single product they make. For employees, Google offers a shuttle system run on biodiesel, an on-campus car sharing program, company bicycles to commute between buildings and departments, and the largest electric vehicle charging station in the country. Other sustainability successes for Google include a large solar installation on their campus and LEED-certified buildings.

Google.org Google.org is the charitable arm of the organization. According to their website, the organization provides assistance to “nonprofits using technology and innova- tion to tackle complex global challenges” by giving more than $100 million in grants and 200,000 volunteer hours each year. Google.org also develops tools for nonprofits and provides disaster relief. Google for Nonprofits provides resources such as discounts on Google products and free AdWords advertising to nonprofit organiza- tions. Google.org has also partnered with nonprofits to offer them use of Google’s considerable resources. For example, they provided tools to the National Center for Missing and Exploited Children to help the nonprofit in their fight against global child exploitation. Google extended their community service outreach efforts with the introduction of the Google.org Fellowship that allows their employees to work full-time for their nonprofit partners for up to six months. Collectively, Google aims for 50,000 hours of pro bono work annually through the program.

In addition to the company’s work through Google. org, Google contributes hundreds of millions of dollars

C B P _ F errell_ C a s e _ Studie s.indd 428 12/9/2019 6:23:04 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society

Case 4 Google Searches for Solutions to Privacy Issues 429

directly to various charities and socially responsible organizations. Just before the company’s initial public offering in 2004, Google’s cofounder Larry Page prom- ised Google would continually contribute 1 percent of their profits, 1 percent of their equity, and a significant amount of employee time to philanthropic endeavors. In terms of giving employee time, Google encourages employees to get involved in giving back to their com- munities. For instance, Google matches up to $6,000 of each employee’s contributions to nonprofits annually. They have donated more than $50 million to thousands of nonprofits. Google also encourages employees to take time to volunteer in their communities, especially during their annual GoogleServe event, which sets aside one to two weeks each June for Google staff worldwide to get involved in their communities and donate time to good causes.

Privacy Being a large company, Google has many risks and ethical issues they must constantly address. In many ways Google has helped advance ethical conduct in the web and technology industries. Google has been named multiple times among Ethisphere Institute’s “World’s Most Ethical Companies” due to their contributions to the community and the environment. The company also consistently ranks among Fortune magazine’s “100 Best Companies to Work for” because of their fun and innovative work environment.

One of the greatest risks faced by digital companies involves hacking attacks and online scams. Google is attempting to address these risks head on. For example, Google was hit with a massive phishing attack. Gmail users were sent an email that supposedly came from someone they knew inviting them to open up a document in Google Docs. Those that clicked on the link were directed to a real Google page, where they were asked to input their passwords to download a fraudulent app. Once the fraudsters had the users’ credentials, they used them to access the users’ contact lists to send out more phishing emails. Google immediately reacted to disable the accounts and notify their Gmail users. Though phishers are becoming more sophisticated, Google successfully blocks approximately 100 million phishing emails per day. In addition to their preventative efforts, when Google can’t positively identify a phishing attempt, they display a safety warning above questionable emails in a user’s inbox.

Despite their contributions to ethics, Google’s actions have been called into question. For instance, when Google created an ethics board to guide “respon- sible development of AI” at the organization, thousands petitioned for the removal of a board member who made concerning comments about trans people and whose company was skeptical of climate change. Many ques- tioned whether the eight members who would meet only

four times per year could possibly understand the full scope of Google’s AI development. When debate about their board members continued, it became clear that the board was a liability for Google. Google dissolved the ethics board after just one week and resolved to find better ways to add outside perspective on AI topics.

Google also faces intense antitrust scrutiny from the European community. Competitors in Europe claim Google uses their dominant market position to promote their own offerings and demote rival results in search listings. In 2010, the European Union (EU) investigated Google’s practices. Google proposed concessions and business changes it was willing to make to satisfy competitors and investigators, but none were accepted, and the EU announced formal charges against Google in 2015. The initial charge was that Google favors their comparison-shopping service over competitors. The EU later filed another antitrust charge against Google targeting their AdSense advertising platform. These accusations are similar to the EU’s investigation into Microsoft, which eventually led to $2.3 billion in fines and significant changes in how Microsoft conducted business worldwide. Google was fined a third time in 2019 for hindering competition. The $1.7 billion fine was in response to Google allegedly blocking their rivals from placing ads on third-party websites. In total, Google has been fined more than $9 billion by the EU in the past few years alone. Additional changes need to be made by Google to avoid further investigations.

For the sake of brevity, this case will focus on one major ethical issue Google has continually wrestled with as they seek to expand their reach: privacy. The advent of the internet and mobile technology provides so many opportunities for stakeholders that many do not realize the cost for this information might be significant portions of their privacy. Many consumers are shocked to find that web companies such as Google and Facebook track their online activity and use this information to tailor advertisements or sell to marketers. Other consumers feel that Google’s use of their personal information is a small price to pay in exchange for access to the company’s superior services. For Google—which offers so much free content and gets most of their revenue from advertising—this information is extremely valuable to their continued business success. Google’s privacy policy details what information they collect and how they use that information. For instance, Google claims they may share non-personal information with their partners.

Despite Google’s attempts to be transparent, there are ethical gray areas regarding the collection and use of data. Because there is still little legislation regulat- ing how internet companies gather and employ user information, it is tempting for firms to push the limits on privacy. Going too far, however, creates reputational and legal problems. Google was fined $57 million under the EU’s General Data Protection Regulation (GDPR) in France. The French data protection authority claimed

C B P _ F errell_ C a s e _ Studie s.indd 429 12/9/2019 6:23:04 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society

430 Case 4 Google Searches for Solutions to Privacy Issues

Google did not disclose how data is collected across their services properly. Such concerns are not exclusive to the GDPR. Although Google is the most popular search engine, one recent poll found that 52 percent of Google users have concerns about their privacy when using it. This could be a potential obstacle for Google since consumer trust plays a big role in how they interact with a company. The following sections discuss some of the major privacy issues Google has experienced.

Search Queries One of the major privacy criticisms levied against Google is that the company keeps track of users’ search terms. Keeping a longer history allows Google to create a custom user experience. Consider all the things you have ever searched for using Google’s search engine. Now consider how comfortable you feel knowing the com- pany has recorded and stored all those search terms… forever. This tracking cannot be turned off—users can disable their Google web history to remove any external record of searches and prevent the information from being used in certain ways, but Google will continue to record and store search terms for internal purposes. To address privacy concerns, users can automatically set their Google history to be deleted on a 3-month or 18-month schedule, so it’s no longer a manual process. To be fair, the practice of retaining search data is not limited to Google—many other internet firms do the same. Because Google is the most popular search engine in the world, they are more heavily scrutinized.

The big question users ask is whether their search terms can be traced back to them personally. Google claims that although they store users’ search terms, after 18 months the data becomes “anonymized” and theo- retically untraceable. However, critics debate this claim because supposedly anonymized data from other search engines was later matched to specific users. Google claims they treat this information with respect, using it to refine their search engine. Yet under the Third Party Doctrine and the Patriot Act, the U.S. government could subpoena the data if deemed necessary for national security. Needless to say, Google’s storage of users’ search terms is a controversial topic. In fact, several smaller search engines such as DuckDuckGo use the fact that they do not track user activity as a competitive differentiator from Google.

Tracking Users Tracking users has become a major issue for Google. A storm of criticism was unleashed when government regulators and consumers learned the company’s phones tracked users’ locations. It was revealed that Android phones contained location-logging features enabling the firm to collect GPS coordinates of their users as well as the coordinates of nearby Wi-Fi networks. Similar

tracking features were found on the Apple iPhone. The revelations spurred legislators to write letters to Google asking for clarification on how they track users and use this information. It was later discovered by an AP investigation that even when users have turned off location history, Google still saves their location.

Google also tracks users on the internet. For Google, offering advertisers the ability to specifically target their ads to desired users based on their interests is invaluable to remaining competitive in the advertising market. Additionally, Google uses this information to customize their services to individual users. For example, users will see different results for the same Google search terms based on what Google believes they most likely want, based on what they know about them. Many privacy advocates do not like this pervasive use of tracking, and there is ongoing concern by regulators and others over how Google uses the information they collect. Google’s privacy policy does allow users to opt out of many tracking functions, but users must actively do so—the default is to be tracked. This is especially problematic for the many users that do not realize they are being tracked and/or do not know how to use Google’s settings to opt out. All of the popular web browsers, including Google Chrome, now include a “Do Not Track” option, which indicates to websites that the user does not wish to be tracked. However, the designation has no legal or regulatory authority and has so far remained mostly symbolic, with many websites simply ignoring it.

On the other hand, supporters of Google maintain that tracking is necessary to provide the best services to users. These services are often free because Google is able to generate revenue through advertising. Tracking also allows Google to customize their services to individual user needs. Consumers must therefore be proactive in deciding whether they place greater value on their privacy or Google’s free services.

Although some people do not appear to mind having their web activity tracked in exchange for Google’s free services, Google has repeatedly violated public trust. In 2012, security analysts revealed that Google was using loopholes in Apple’s Safari browser to ignore their default privacy settings while simultaneously telling Safari users they were protected. Google eventually paid $22.5 million to settle the FTC charges and an additional $17 million to settle similar charges brought by 37 states and the District of Columbia. Google has also been accused of failing to respect user privacy in the real world. In 2010, Google announced they had accidentally scanned data from some users’ personal wireless networks in the United Kingdom with their vans that collect data and photos for their location-based services. The vans scanned wireless networks of nearby residences and collected activity data from unsecured, open networks, including emails, text messages, video and audio files, and more. Though Google promised they would destroy the data collected, a later investigation revealed Google

C B P _ F errell_ C a s e _ Studie s.indd 430 12/9/2019 6:23:04 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society

Case 4 Google Searches for Solutions to Privacy Issues 431

still retained some of this user data. The violation exacerbated their image of being a firm that disregards privacy. Soon after the incident, it was discovered Google had been collecting the same type of information from unsecured residential wireless networks in other countries as well. In the United States, Google was fined $25,000 by the Federal Communications Commission (FCC) for deliberately delaying and impeding its inves- tigation. The investigation led to a $7 million settlement among Google, the FCC, and 38 states and the District of Columbia. At least seven other countries also found Google guilty of similar activity in their jurisdictions.

Yet another privacy-related incident for Google involved the Google Play App Store. A developer who started selling a mobile application through Google’s app store was shocked by the amount of information he was given about his customers, including their names, locations, and email addresses, even though nowhere in the app buying process were customers asked to give consent to release that information. The developer argued that this practice violated Google’s privacy policy, which at the time stated that identifiable information would never be given to third parties without user consent. Some privacy experts agreed with the developer; others did not, stating that the information shared was minimal and of the type commonly expected to be given out in making any purchase. Still, Google’s approach to privacy continues to be a subject of controversy and debate.

As technology evolves, the definition of personally identifiable data changes. In 2019, Google and the University of Chicago were sued in a lawsuit that accused the company and the university of failing to strip identifiable data from medical records in a collaboration designed to use AI to improve diagnosing medical problems. The artificial intelligence that Google is developing reads health records to assist doctors. To learn and produce accurate results, the machines must analyze large quantities of old health records. Though patient data was largely “de-identified,” dates of services were left intact, raising concerns. The lawsuit claims the retention of dates violates HIPAA, the legislation that provides data privacy for medical information, because dates could potentially be cross-referenced against other data Google collects, such as location history from Google Maps, to identify individuals.

Privacy Audits Although Google has faced lawsuits from consumers claiming the company violated their privacy rights, a lack of internet legislation enables Google to continue many of their practices. However, Google found them- selves in trouble with governmental authorities after allegedly violating their own privacy policies. In 2010, Google launched the failed social networking platform Google Buzz. Most of those who chose to join were unaware that the identities of their frequent contacts on

Gmail would be made publicly available on the internet through Google Buzz. Although users could opt out of having this information released, they claimed the opt- out features were difficult to locate. Other accusations claimed that even those users who opted out of joining Google Buzz were still enrolled in certain features of the social network, and that those who requested to leave the network were not fully removed. Although Google worked to fix these problems, the FTC’s investigation found Google had acted deceptively and violated their own privacy policies. Google agreed to settle with the FTC by agreeing to never again misrepresent their pri- vacy practices and allowing approved third-party firms to conduct privacy audits every other year regarding how the company uses information. These audits will take place for 20 years from the date of the settlement. That same year, Facebook agreed to a similar deal after allegedly violating their users’ rights to privacy, and other companies have since become subject to privacy audits as well. If Google’s audits reveal problems, the FTC may impose fines of $16,000 for each violation per day.

These audits are a blow to Google’s operations. As one of the first internet companies to have this kind of audit imposed on it, the company will have to tread carefully regarding how it collects and uses information. On the other hand, Google might choose to see this as an opportunity to improve their internal controls and privacy practices to ensure user information is respected. Doing so could gain more trust from users and prevent future legislative action against the company. So far, Google’s record in honoring the settlement is mixed. Its 2012 privacy audit found no issues, but that same year the FTC found Google’s bypassing of the Safari browser’s default privacy controls to be a violation of the agreement and fined the company for it. As one of the world’s largest internet companies, the actions Google takes in this area will significantly impact the future activities of other companies.

From Many Privacy Policies to One For most of their history, Google has had separate privacy policies for most of their products, each detailing how Google collects and uses information for that product. Google’s rapid growth and expansion from just search into an internet behemoth had resulted in over 70 separate Google privacy policies across their offerings. This was beneficial in one sense, as consumers who took the time to read the policies could understand in great detail how Google was operating each product. On the other hand, the overwhelming amount of policies was confusing, tedious, and time-consuming to sift through, and the average consumer would have been hard-pressed to decipher them.

Google announced they was unifying their myriad privacy policies into just one, which would govern

C B P _ F errell_ C a s e _ Studie s.indd 431 12/9/2019 6:23:04 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society

432 Case 4 Google Searches for Solutions to Privacy Issues

Google’s practices across their entire organization. At first glance, this seemed like an efficient change. However, it had many subtler implications that sparked wide- spread concern. Could consumers still opt out of specific information-sharing in individual products? Did the new policy adequately explain all the different ways Google gathered and shared information so consumers could be properly informed? Did the new policy expand Google’s information-gathering power under the guise of making things simpler?

One especially concerning aspect of Google’s new policy was that it allowed the company to take all the information they gathered on their users across all their products and combine them together. Coupled with the new unified login system, the new privacy policy allowed Google to use information on a much larger and more encompassing scale. Users’ Google searches might affect the ads they see on their Android phones, YouTube browsing histories could be combined with Gmail activity to better understand user interests, and more. Was this “all-seeing eye” approach acceptable, especially for such a large company with so many widely used services?

Understandably, the announcement of a unified privacy policy led to considerable backlash. Google received letters from Congress members and U.S. attor- neys general expressing concern about the new policy. Competitors such as Microsoft took advantage of the situation to run ads drawing consumer attention to Google’s potentially unsettling approach to user privacy. The EU asked Google to delay implementation of the policy until it could study and better understand its implications. In defending itself, Google emphasized that they were not gathering any more information than before, nor were they making any changes to existing user ability to opt out of information-sharing or use product-specific privacy settings. They were merely making their existing practices simpler and clearer for customers to understand, as well as improving their own ability to serve users by unifying the information it gathered across offerings. They argued the new policy was in legal compliance and refused to delay the transi- tion. On March 1, 2012, the unified policy took effect.

The new privacy policy was poorly received in Europe. The EU Justice Commissioner questioned the legality of Google’s new policy according to EU law. French data regulators launched an investigation con- cerning the new policy, believing the policy might not adhere to EU Internet transparency and privacy laws. Google maintained their new policy met EU regulations. However, in 2013 six European countries banded together to take legal action against Google for not complying with the requests of the government. Google has since been fined by several European countries for breaking their privacy or data protection laws, including nearly $1 million by Spain and $204,000 by France. The Netherlands threatened a fine of up to $15 million

if Google does not comply with its desired changes. The company narrowly avoided yet another fine in the U.K. by agreeing to change their privacy policy for U.K. users, and there are signs it may make such a change Europe-wide in an attempt to allay the concerns of the EU and its member nations. Google has learned that activities which are legal in one country might not be legal in another.

The public’s reaction to Google’s unified privacy policy once again brings to light the more general debate over the company’s gathering and use of user informa- tion. Supporters argue that Google uses this information to create improved services for users. It helps the firm remain competitive with strong rivals such as Apple and Facebook. Critics are concerned that Google is constantly overreaching and seems to have little actual concern for user privacy, only slowing or backtracking when they are forced to by consumer backlash or governmental regulators. Critics are also worried by the ease with which Google appears to change their policies, which could spell trouble for users and their privacy rights. Google keeps a log of changes made to their policies to improve transparency with a comparison tool that allows users to see what changes were made between versions.

“Right to Be Forgotten” In 2014, the European Union’s highest court ruled that EU citizens have a “right to be forgotten.” In other words, consumers have the right to prevent certain types of content from showing up in online search results. Such content includes results that are inadequate, irrelevant, no longer relevant, or excessive. The court decision allows individuals to petition search engines to remove such content from search results, and if refused, to take the matter to a local data protection authority for adjudication.

The court decision sent shockwaves through the internet search community. Was this censorship, or the beginning of an acknowledgment that search engines have a duty to at least somewhat curate their results? Was this a victory for privacy, or a defeat for freedom of speech? How will search companies be able to properly decide whether removal requests are legitimate or stretch beyond the boundaries of the court decision?

In response to the ruling, Google set up a process by which they process “right to be forgotten” requests. The claimant fills out an online form, which is reviewed and processed by a team of Google lawyers, paralegals, and engineers. “Easy” cases, where the correct decision is relatively clear, are made by that team. Difficult cases are forwarded to a senior panel of Google experts and executives to decide. For instance, a published U.S. record of the name of a 16-year-old German individual convicted in the United States of a sex crime could be controversial because in Germany the record would

C B P _ F errell_ C a s e _ Studie s.indd 432 12/9/2019 6:23:04 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society

Case 4 Google Searches for Solutions to Privacy Issues 433

not be published due to his minor status. Google also releases periodic “Transparency Reports” providing information on right to be forgotten requests. So far, Google has received over 650,000 requests to remove 2.43 million URLs, mostly from individuals who want to protect their private information. Google removes approximately 43 percent of these URLs.

Google and other internet search companies continue to express their opposition to the “right to be forgotten” concept, and many others agree. Some are opposed to it outright, citing freedom of speech concerns; others believe it may be a good idea but that private companies such as Google should not be the ones deciding which links to keep and which to take down. Simultaneously, EU regulators are dissatisfied with how Google has chosen to interpret the court decision. For example, Google is only removing links from their Europe-specific search engines such as Google.fr or Google.co.uk, meaning anyone can simply move to Google.com to find the hidden content. Simultaneously, other areas of the world are considering the right to be forgotten idea, with varying success. In Mexico courts have ruled for some individuals petitioning Google to remove content, but critics worry the right is being used largely by politically powerful individuals to remove unsightly aspects of their past. California has passed a law requiring websites to provide a mechanism by which minors can have content they post removed, believing children should not be punished for online missteps. Hong Kong’s top privacy regulator has embraced the concept wholeheartedly, suggesting Google should apply the EU ruling to their operations globally.

“Right to be forgotten” adds another wrinkle in Google’s privacy concerns. Now, at least in some parts of the world, Google must not only worry about the information they collect itself, but also about what information posted by third parties might be showing in its search results.

Google in China Google has had a tough time in China. When Google decided to enter the world’s most populous country, they faced an ethical dilemma. On the one hand, Google did not want to miss the opportunity to tap into a market consisting of more than one billion potential consumers. On the other hand, Google could not enter China with- out censorship. If it created a Chinese version of Google and hosted it outside of China, it would be subject to China’s “Great Firewall,” which the government uses to censor foreign sites. Google tried this method first, but their Chinese search engine was intermittently blocked and was otherwise slow and inconsistent for users, causing Google to steadily lose market share to domestic Chinese competitors such as Baidu. Google’s other option, to host a search engine from within China, would require agreeing to self-censor their search results

in accordance with Chinese law. Such an agreement went against the essence of what Google stood for—providing free and open access to information. Could Google agree to censor themselves and still hold true to their “Don’t Be Evil” mantra?

Despite criticism, Google applied the principles of utilitarianism to the situation and concluded that the benefits of setting up a search engine inside China out- weighed the costs. They refused to offer localized email or blogging, finding the Chinese censorship and report- ing requirements for these services to be too egregious. However, for search Google decided the greater good would be to provide Chinese citizens with “the greatest amount of information” possible, even if some of that information was censored. In 2006, Google opened their localized, self-censored Chinese search engine. Whenever a search term led to censored results, Google added a message to the results page notifying the user that some entries were missing. They also left up their original, uncensored Chinese search engine hosted outside of China, so users could try to use it if they wanted.

Despite these precautions, Google’s plan ran into problems almost from the onset. Google gained signifi- cant market share and became a serious competitor to Baidu, but the company’s relationship with the Chinese government was continually tense, with Google accusing the government of interfering with the search engine beyond expectations. Google also faced intense backlash in the United States, including their leadership being called to testify at Congressional hearings about how they could justify self-censoring in China considering the principles they claimed to stand for everywhere else in the world. In 2010, Google announced they had been targeted by a sophisticated cyberattack that appeared to originate from China and, among other things, had attempted to access the Gmail accounts of known Chinese human rights activists. Google stated that the implications of the cyberattack required them to reevalu- ate their approach toward the Chinese market, and they could no longer justify self-censorship. They shut down their China-hosted site and forwarded visitors to their external, uncensored but often-blocked Chinese search engine. As a result, Google saw their market share in China plunge and Baidu retaking its dominant position. The Chinese government was also not happy with Google’s handling of the situation and immediately began blocking and/or censoring large portions of Google’s services.

Google did not give up on the largest market in the world. Google began a secret project in 2017 with the Chinese government called Dragonfly. The plan was to again launch a censored search engine in China. The project was kept under wraps until it was exposed by The Intercept, an online news publication. A previ- ous Google employee called the project disturbing. In 2019, Google officially terminated Dragonfly, and the company stated they had no active plans to launch in

C B P _ F errell_ C a s e _ Studie s.indd 433 12/9/2019 6:23:04 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society

434 Case 4 Google Searches for Solutions to Privacy Issues

China. The company will have to remember the lessons they learned from both of their failed attempts and the sensitive ethical issues involved with censorship if they make any future moves into the Chinese market.

Government Response to Privacy Issues Consumer concerns over privacy issues prompted Congress to consider new legislation regulating what information internet companies such as Google can col- lect and how they can use it. Internet companies, in turn, are attempting to make such legislation unnecessary by developing their own industry standards, such as the “Do Not Track” feature now found on all major web browsers. Such self-regulation is an attempt to ward off federal legislation that could seriously limit the tracking activities of companies like Google.

Some of the ideas that federal regulators have been discussing include a User’s Bill of Rights and a manda- tory Do Not Track feature. The Bill of Rights would, among other things, require companies to adhere to certain privacy practices. Its intent in this area would be to make internet privacy policies easier for users to understand. A mandatory Do Not Track mechanism would be comparable to Do Not Call legislation, which makes it illegal for companies to sell to consumers over the telephone if those consumers are on the national Do Not Call registry. A similar law regulating internet tracking could seriously impact how internet companies collect information.

Many states are dissatisfied with the lack of federal action on this topic and have passed their own internet privacy laws. California law, for example, provides special privacy protection to minors online and requires websites to disclose whether they are respecting the “Do Not Track” requests they receive from user brows- ers. However, more recent government decisions have overturned privacy regulations that would have required internet providers to get users’ permission before being able to sell their data. Critics claim that the government is failing to address the privacy gap, giving online companies like Google free rein in collecting, storing, and using user information.

Because legislation could be a serious threat to Google, the company spends millions on lobbying and employs lobbyists on their staff. Google hopes to stave off regulation they feel restricts their ability to coordinate targeted advertising or offer customized services to users. However, with privacy issues and internet breaches becoming a growing concern, the chance of increased regulation in the future is high. Although Google might not be able to prevent legislation restricting some of the activities of internet firms, they can work with regulators to push for legislation with less of a negative effect

on their operations. Google’s lobbyists are having a profound impact on laws safeguarding internet security.

Conclusion Google’s success story is unparalleled among search engine providers. The company started off as a small search engine and ranking system, and has become one of the most profitable internet companies in the world. Today the company is the owner and provider of prod- ucts that go above and beyond simply a search engine. While there might be a risk of Google overextending itself, the company has a talent for making highly profit- able acquisitions that increase its global reach.

As a way to manage its various businesses, in 2015 Google created a new publicly traded holding company called Alphabet run by Google founders Larry Page and Sergey Brin. Google was made a subsidiary of Alphabet with its own CEO. The founders believe that developing a holding company and “slimming down” Google to focus more on its internet businesses will be beneficial for the firm in the long run.

Google has made itself into the epitome of a “best company to work for.” The benefits Google offers employees are extensive, and Google empowers them to make decisions to improve the company’s opera- tions. The company has taken a strong stand on green initiatives and supports technologies to address global challenges. Google’s “Don’t Be Evil” mantra became a popular yardstick to guide Google’s actions. After Google became part of the holding company Alphabet, their popular motto was modified to “Do the Right Thing.”

On the other hand, Google has faced challenges in privacy, many of which continue to this day. Google is forced to draw a fine line between using user information to generate revenue and violating user privacy. Because Google can offer targeted advertising to advertisers through their collection of information, the company can provide quality internet services to their users for free. At the same time, Google has committed question- able actions that seem to infringe on user rights and has encountered resistance from governmental authorities on many privacy-related initiatives.

With the threat of new regulation, Google lobbies to prevent legislation from being passed that proves unfavorable to the company. Because Google depends on tracking and similar activities to maintain profitability, it has a large stake in the privacy issue. However, rather than seeing this solely as a liability, Google might instead choose to improve its privacy practices and increase transparency in its operations. Google has the responsibility to ensure stakeholder rights are respected. Although Google has made great strides in social responsibility, both the company and society know there is room for improvement. Google’s size, reputation, and

C B P _ F errell_ C a s e _ Studie s.indd 434 12/9/2019 6:23:04 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society

Case 4 Google Searches for Solutions to Privacy Issues 435

history give them a unique opportunity to positively impact how companies interact on the internet.

Questions for Discussion 1. Has Google implemented a strategy that serves all

stakeholders? 2. How can Google respect privacy and still maintain its

profitability? 3. How will increasing global regulation of privacy affect

Google’s operations?

Sources “Can Google’s Advertising Business Cross $200 Billion in

3!Years?” Forbes, June 25, 2019, https://www.forbes.com/ sites/greatspeculations/2019/06/25/can-googles-advertising- business-cross-200-billion-in-3-years/#793f29b55408 (accessed August 7, 2019).

“Google’s Gmail Turns 15, Now Has over 1.5 Billion Monthly Active Users,” The News Minute, April 1, 2019, https:// www.thenewsminute.com/article/googles-gmail-turns-15-now- has-over-15-billion-monthly-active-users-99275 (accessed August 7, 2019).

“Smartphone Market Share,” IDC, June 18, 2019, https:// www.idc.com/promo/smartphone-market-share/os (accessed August 7, 2019).

“Philosophy and Goals,” Open Source Project, http://www. webcitation.org/5wiyo36ap (accessed June 1, 2015).

Adam Minter, “Is Google Going Back into China?” Bloomberg View, November 24, 2014, https://www.bloomberg.com/view/ articles/2014-11-24/is-google-going-back-into-china (accessed May 6, 2017).

Adi Robertson, “Google France Forced to Notify Visitors of "150,000 Privacy Policy Fine,” The Verge, February 8, 2014, http://www.theverge.com/2014/2/8/5393418/google-france- forced-to-notify-visitors-of-150ooo-privacy-policy-fine/ in/2527939 (accessed May 6, 2017).

Alex Johnson, “Massive Phishing Attack Targets Millions of Gmail Users,” CNBC.com, May 4, 2017, http://www.cnbc. com/2017/05/04/gmail-google-hack-phishing-attack.html (accessed August 12, 2019).

Alexei Oreskovic and Michael Sin, “Google App Store Policy Raises Privacy Concerns,” Reuters, February 14, 2013, http:// www.reuters.com/article/2013/02/14/us-google-privacy- idUSBRE91D1LL20130214 (accessed May 6, 2017).

Anna Meegan, “Our Hardware Sustainability Commitments,” Google Blog, August 5, 2019, https://www.blog.google/ outreach-initiatives/sustainability/hardware-sustainability- commitments/ (accessed August 7, 2019).

Anthony Spadafora, “These Are the Most Popular Google Chrome Extensions,” Tech Radar, August 6, 2019, https:// www.techradar.com/news/most-popular-google-chrome- extensions (accessed August 7, 2019).

Ari Levy, “Meet the 69-Year-Old Professor Who Left Retirement to Help Lead One of Google’s Most Crucial Projects,” CNBC, May 6, 2017, http://www.cnbc.com/2017/05/06/googles-tpu- for-machine-learning-being-evangelized-by-david-patterson. html (accessed May 6, 2017).

Associated Press, “Developments Related to Google’s Privacy Concerns,” The Huffington Post, April 2, 2013, http://www.

huffingtonpost.com/huff-wires/20130402/tec-google-privacy- history/?utm_hp_ref=travel&ir=travel (accessed May 6, 2017).

Associated Press, “Google Buys YouTube for $1.65 Billion,” MSNBC, October 10, 2006, http://www.msnbc.msn.com/ id/15196982/ns/business-us_business/t/google-buys-youtube- billion/ (accessed May 6, 2017).

Austin Ramzy “Google Ends Policy of Self-Censorship in China,” TIME, January 13, 2010, http://content.time.com/time/world/ article/0,8599,1953248,00.html (accessed May 6, 2017).

Barry Schwartz, “You Can Now Automatically Set Your Google History to Be Deleted,” Search Engine Land, May 1, 2019, https://searchengineland.com/you-can-now-automatically- set-your-google-history-to-be-deleted-316266 (accessed August 12, 2019).

BBC, “Google Privacy Changes ‘In Breach of EU Law’” BBC, March 1, 2012, http://www.bbc.com/news/technology- 17205754 (accessed May 6, 2017).

Ben Elgin, “Google Buys Android for Its Mobile Arsenal,” Bloomberg Businessweek, August 17, 2005, http://www. webcitation.org/5wk7sIvVb (accessed May 6, 2017).

Bianca Bosker, “Google Privacy Policy Changing for Everyone: So What’s Really Going to Happen?” The Huffington Post, February 29, 2012, http://www.huffingtonpost.com/2012/02/ 29/google-privacy-policy-changes_n_1310506.html (accessed May 6, 2017).

Brian Naylor, “Congress Overturns Internet Privacy Regulation,” NPR, March 28, 2017, http://www.npr.org/2017/03/28/ 521831393/congress-overturns-internet-privacy-regulation (accessed May 6, 2017).

Bryan Bishop, “Google Responds to EU Privacy Policy Questions, Pausing Rollout Would Have ‘Proved Confusing’” The Verge, April 5, 2012, https://www.theverge.com/2012/4/5/2928619/ google-responds-eu-privacy-policy-questions-pausing-rollout- confusing-users (accessed May 6, 2017).

Byron Acohido, “Lawmakers Request Probe of Tracking by Apple and Google” USA Today, April 25, 2011, 1B.

Byron Acohido, “Most Google, Facebook Users Fret Over Privacy,” USA Today, February 9, 2011, lB.

Charles Arthur, “Google Facing Legal Threat from Six European Countries over Privacy,” The Guardian, April 2, 2013, http:// www.guardian.co.uk/technology/2013/apr/02/google-privacy- policy-legal-threat-europe (accessed May 6, 2017).

Charles Riley and Ivana Kottasová, “Europe Hits Google with a Third, $1.7 Billion Antitrust Fine,” CNN, March 20, 2019, https://www.cnn.com/2019/03/20/tech/google-eu-antitrust/ index.html (accessed August 12, 2019).

Chip Brownlee, “Google’s New Chrome Makes It Easier to Bypass Newspaper Paywalls,” Slate Magazine, July 31, 2019, https://slate.com/technology/2019/07/google-chrome-update- incognito-mode-paywall-workaround.html (accessed August 7, 2019).

Christopher Williams, “Google Faces Privacy Investigation over Merging Search, Gmail, and YouTube Data,” The Telegraph, April 2, 2013. http://www.telegraph.co.uk/technology/ google/9966704/Google-faces-privacy-investigation-over- merging-search-Gmail-and-YouTube-data.html (accessed May 6, 2017).

Clive Thompson, “Google’s China Problem (and China’s Google Problem),” The New York Times, April 23, 2006, http://www. nytimes.com/2006/04/23/magazine/23google.html (accessed May 6, 2017).

C B P _ F errell_ C a s e _ Studie s.indd 435 12/9/2019 6:23:05 P M03/18/2020 - tp-70a028a4-6922-11ea-a484-024 (temp temp) - Business and Society