In Depth

Online Privacy: Nowhere to Run, Nowhere to Hide

By CSO Contributor

April 21, 2006 — CSO —

When Google announced its Gmail e-mail service two years ago, a lot of people figured the company was joking. After all, the press release was circulated on April Fools Day, and Google had been known to offer up the occasional gag, like saying it was starting a research center on the moon.

More important, the business proposition seemed preposterous. Nobody believed that consumers would tolerate Google's plan of having its computers scan an individual's e-mails and then deliver advertisements to him or her based on the e-mails' contents. Google, of course, wasn't kidding. Two years later, Gmail has tens of millions of users, and the company continues to add new features.

But the incredulity prompted by Gmail's introduction underscores the Web's knotty privacy problem, according to participants at the recent 2006 Wharton Technology Conference. Consumers say they want privacy online, although they often behave in ways that contradict those statements by, for example, posting intensely personal information and photos on public websites. Companies insist they will protect privacy, although they sometimes fail to do so. And everybody is wary of increased government regulation; indeed, some people worry more about potential government misconduct than about corporate abuse. "In a world of photo traffic tickets and warrantless searches, what Google does with my personal information doesn't bother me," quipped conference panelist Gil Brodnitz, a partner at Accenture.

Debating online privacy isn't merely a philosophical exercise. Companies collect reams of information about visitors to their websites and about their customers' Web-surfing ways. You may be able to hide your visits to offbeat, or off-color, websites from your spouse, but you can't hide them from Google and Yahoo. And governments at all levels have shown an increasing hunger for that kind of information. In March, for example, Google squared off with the U.S. government in two privacy cases. In the first case, a judge ruled that the company must give the Federal Trade Commission the entire contents of a customer's Gmail account, including deleted messages. In the second, a judge said the company had to provide 50,000 Web addresses from its database to the Justice Department for a study of child pornography online. In a victory for the company, however, the judge in that case rejected the government's demand for keywords used by customers in searches.

Rights to Content in Perpetuity

In the absence of clear federal rules, Web surfers cannot be guaranteed that firms will protect user information, said conference panelist Wendy Seltzer, a visiting professor at the Brooklyn School of Law. In the pornography case, for example, while Google chose to resist the government's subpoena, Yahoo, AOL and MSN complied. "If we don't have a strong protection law, all we have is the company's word, and hype and fact don't always match," she said. "Anything that is collected in a regime of weak privacy laws is something that the government can get access to."