Tag Archives: privacy

Reflections on the frustratingly user-hostile motivations behind Google’s unified user accounts

“If it’s free, you’re not the customer, you’re the product.”

–Everyone on the Internet

As I’ve written about several times on this blog, my 11-year-old son did an informal internship with us at Room 34 this summer. Part of the process of getting him set up as a part of the business was giving him his own email address.

We use Gmail (as part of Google Apps for Business) for our email. As such, creating an account for him on our email domain essentially created a Google user account for him, because Google has, of course, bundled all of their services together under a single login: Gmail, YouTube, Google+ (which no one uses), etc. Sounds convenient, right? Sure, but…

A couple of weeks ago, unbeknownst to me (go ahead and judge my parenting now), my son discovered that with his mail login he was able to log into YouTube as well. We have made it clear to him in the past that (legally) you have to be 13 to get a YouTube account, and that we had no intention of helping him circumvent that. But, kids being kids, he tried to take advantage of this back door he had discovered.

Problem is, YouTube asked for his birthdate. And he gave it. His real birthdate.

Nope! said YouTube, and his account was suspended. But not just his YouTube account. His entire Google account. Suddenly we found he couldn’t log into his email. I went into our Google Apps for Business account to manage the domain, and I discovered, to my supreme annoyance and frustration, that when a user account is “suspended” it really is suspended — it’s in a strange state of semi-existence. It can’t be used, but it also can’t be deleted, even by a domain administrator. So now his email address — his email address on my business domain name, not “gmail.com” — is entirely untouchable.

It’s no surprise that we are Google’s product. A customer is a person or company who pays for products or services rendered. Google’s advertisers are their customers, and our attention is the product they are selling.

As a result, Google collects enormous amounts of data about its users. It tracks as much of our activity across all realms of the Internet as possible. That’s why we are a valuable product to their customers — the advertisers. The more information Google collects about us, the more valuable we become as targets for advertising. And all of that data collection is why Google is required to comply with the federal law regarding collection of information about people under the age of 13 on the Internet. Therefore, my 11-year-old son not only can’t have a YouTube account, but he can’t have an email address that is connected to Gmail, because a Google account is a Google account, period.

On a basic level this is a major inconvenience to me and to my son for our purposes of getting him experience working on the Internet. But on a much deeper level, it is more profoundly disturbing for its privacy implications.

As a web developer, I work often with Google Analytics. I help our clients set it up on their websites. I even use it on my own sites (including this one). It’s great to see where your traffic is coming from, which parts of your site are or aren’t getting traffic, which devices and browsers your visitors are using, etc.

But remember, Google isn’t just collecting that data for your benefit. They’re collecting all of that and much more for their own purposes, far beyond what they even make available to site owners on Google Analytics.

Google has created a scenario through Gmail and YouTube (and, I suppose, Google+) where a large percentage of Internet users are logged into Google at all times, with cookies stored in their browsers. Combine that with Google Analytics being installed on a large percentage of websites around the world, and Google knows that you are visiting all of those sites. You may not be providing the sites you’re visiting with any of your information, and they can’t read Google’s cookies themselves, but they’re pulling in a little piece of Google on every page load, and that piece of Google can read the Google cookies on your computer, identifying not just a computer with your same OS and web browser, connecting from your specific IP address, but you, the logged-in Google user.

What are they doing with that information? And what might someone else do with that information?

I do not like this, not one bit. And yet I still happily use these Google services. And you probably do too.

Google’s redesign: a second look

I want to follow up on my post about Google’s redesign from a couple weeks ago, as this redesign has, unsurprisingly, continued to evolve (or at least, reveal itself through ongoing usage).

It’s clear that Google is phasing in a massive overhaul, not just of how their products look, but how they work, and more specifically how they work together. This is a full-scale rethinking of the Google brand, and I’m not sure I like it.

The natural inclination for most users when something is unexpectedly changed is initially resistance. (Just look at how TechCrunch announced their redesign yesterday. They knew what the reaction would be.) And I frequently fall into that too, only to finally come around after a while when I finally “get it” or just get used to it.

But there are unprecedented challenges for Google with this redesign, owing mainly to two things: 1) users’ absolute dependence on Google tools for certain online tasks (search and mail being the most obvious) and 2) the vast scope of products and services Google is attempting to graft together.

The first is hard to avoid: the more users depend on something, the more upset they’ll be when you change it. (Like this.) The second is not. The second is neither necessary nor obvious. It didn’t have to happen at all, and it doesn’t have to happen the way it is. And as time goes on, I realize that’s what I dislike most about both the initial shoddy execution and the plan and goals underlying it.

As I consider it more, I realize that my disappointment and frustration stem from the fact that this massive integration effort affects my dependence on Google products in a way more profound than I would have expected. I have a Google Apps account for my room34.com domain, and in the conversion Google has forced upon that domain, I am running into numerous issues as I’ve had to merge my personal Google account with my domain account (which I didn’t even realize were separate, since they both use the same email address). Certain data didn’t survive the transition (like my Reader subscriptions); third-party applications that tie into these services are no longer working because of the “2-step verification process” which itself isn’t working, for reasons unknown; certain tools are unavailable to my domain, without explanation (I can’t create a Google Profile, which also means I can’t use Google+); and worst of all, whenever I run up against one of these issues, all Google can do is direct me to outdated and irrelevant documentation. No answers, only more questions.

I’m left with the impression that all of this was not fully thought through. But then again, I don’t think all of it could be thought through. I think it’s damn near impossible to integrate all of these disparate products and services into a cohesive whole, when most have been developed by relatively autonomous internal teams or acquired from outside, and were never designed nor envisioned as one day becoming integrated. And while I applaud Google for its (apparently sudden) focus on this grand new vision for its products, I’m not sure it’s something I really want anyway. Google is already a bit frightening and monolithic, with its vast stores of personal data collected about each of its millions of users. Despite its “Don’t be evil” motto, (former) CEO Eric Schmidt has said things like this (as quoted on Daring Fireball):

“We don’t need you to type at all. We know where you are. We know where you’ve been. We can more or less know what you’re thinking about.”

That quote is taken out of context, but the context doesn’t really help it much. With thinking like that trickling down from the top, do you really want Google to seamlessly integrate all of its products? Their disarray was the only thing providing a modicum of security-through-obscurity for Google’s users. Google may just be collecting all of this personal data to help it more effectively deliver ads to your eyeballs, which is how they make their money, and is bad enough. But that data is there. Who knows how it will be used by Google or whoever else might get their hands on it in the future?

Then again, maybe I shouldn’t be too paranoid. Google’s incomplete efforts at integration are probably a good thing after all.