In the past, Google already offered (and continues to offer) what they call “unlisted” albums, but those were troubled with privacy issues from time to time. For instance, in the beginning you could simply try guessing the album title (say, a title like “Private”) to get to the unlisted album. Recently, Google fixed a vulnerability with how outgoing links were potentially passing on the unlisted album URL’s authentication key to third-party sites due to the referrer field. Also, sometimes sharing just a single photo caused you to potentially share access to the whole album. In fact, this issue remains even for “sign-in” albums: when you select “Share Photo" for a single photo in a sign-in album, the recipient will be able to view your full album.

In other news, Google Picasa software product manager Mike Horowitz has left Google to join Fetch Technologies.

Comments

Nielsen has partnered with technology firm Digimarc to launch the new service, Nielsen Digital Media Manager, designed to help online video distributors, TV networks, and independent content producers to police where users are posting and watching copyrighted video content.

Set to launch in mid 2008, the new service features two tracking techniques: digital "watermarking" and fingerprinting." "Content owners have lost the ability to track and control the distribution of their content," Dave Harkness, Nielsen’s svp, strategy and development told Adweek. "They feel the can no longer control their own destiny."

Nielsen says it has talked to Google and News Corp.’s Fox about the new service. The company also plans to offer the service to NBC Universal or the Discovery Channel along with social networks that host video content.

"We are in a unique position to offer a comprehensive, practical solution," Harkness said. "The problem that other companies have is they need the content ahead of time [to implement their tracking]. For Nielsen, that’s no problem at all."

Court To Anti-Google Aussies: Yawn

Proving Google doesn’t separate its organic and paid search well enough for consumers to tell the difference will require more than just a stack of papers dropped off at the courthouse.

A report in Australian IT described how the judge derided Google’s attackers over the case they’ve tried to make since its beginnings in July:

…a judge said yesterday its court documents were almost "incomprehensible", "opaque" and "somewhat repetitious".

In a further blow yesterday, the judge hearing the case, James Allsop, said correspondence between the parties made it "tolerably clear" the ACCC did not have a misleading and deceptive case against subsidiaries Google Ireland and Google Australia as their pleadings currently stood.

Google contends its "One Box" shading, and text identifying sponsored links, helps people tell the difference between a paid and organic result listing. The two sides will go at it again in October.

This has been the biggest thorn in YouTube’s side ever since Google (with its bags of cash) bought the company. Viacom almost immediately slapped them with a billion-dollar infringement lawsuit.

In his post at the Google Blog, Chen reiterates a complaint made when copyright complaints first came flying at YouTube like teams of angry hockey dads. "Some legal departments take down a video one day and the marketing department puts it up the next. Which is their right, but our community can’t predict those things, and neither can we."

What they can do, says Chen, is employ Audible Magic for help identifying copyrighted audio content. Video content is trickier though and they are working on technology to solve the problem.

Chen writes:

We are beginning tests on an automated system to identify and match specific videos. The technology extracts key visual aspects of uploaded videos and compares that information against reference material provided by copyright holders.

Achieving the accuracy to drive automated policy decisions is difficult, and requires a highly tuned system. Once accuracy is achieved, the challenge becomes speed and scale to support the millions of people who use YouTube every day.

We are working with some of the major media companies to test what we have developed. We’re excited about the progress so far, and we’re dedicated to making these tests successful, but as always with cutting-edge technologies, there’s no guarantee of success. 

Given the amount of money the company will lose if plaintiffs like Viacom are victorious, it seems Chen and company should go beyond we’ll-give-it-a-try-but-can’t-promise.

But with technical minds at Google coupled with deep pockets for hiring the best there is, that not-completely-sure-if-we-can-do-it attitude has a chance of changing.

The talk began this past Saturday when Privacy International released a report that ranked Google at the bottom of a list of companies when it comes to privacy. The report claimed Google was “achieving status as an endemic threat to privacy.” Google naturally enough responded with their disappointment with the report, though apparently not to the liking of Privacy International. PI wrote an open letter to Google and accused the search engine of running a smear campaign against them.

On Sunday Danny Sullivan posted on both the perceived smear campaign and the Privacy International report itself. Danny took a detailed look at how Google handles many of the things the report criticized them about and gave his own grade. In the end his conclusion was that Google does well enough on privacy in comparison to the others the PI report investigated.

• A Race to the Bottom: Privacy Ranking of Internet Service Companies
• Watchdog group slams Google on privacy
• An Open Letter to Google
• Google Ranked the Lowest in Privacy Protection Study
• Google Bad On Privacy? Maybe It’s Privacy International’s Report That Sucks

On Monday the blogosphere was abuzz with talk about the report and Google’s response. Matt Cutts as you’d expect defended Google, though there were some who felt too much of his defense was pointing the finger at other companies like AOL for releasing millions of search queries last summer.

It seemed as though everyone was commenting on the report and both Danny’s and Matt’s posts. Jordan McCollum and Andy Beal each posted to Marketing Pilgrim within a few minutes of each other without realizing the other was posting, which I found humorous. Fortunately for us both wrote good posts.

• Why I disagree with Privacy International
• Google Almost “an Endemic Threat to Privacy”
• Wake-up Google, the World Thinks You’re Big Brother!
• Google Privacy Practices Under Attack
• Privacy International Slams Google Over Privacy Practices

On Monday night Google explained why they have interest in collecting data and agreed to anonymize the data after 18 months instead of the 18 – 24 month range they had originally planned. Additionally the said they would explore ways to redesign cookies to reduce expiration times.

• How long should Google remember searches?
• Google responds to E.U. Working Party letter
• Privacy Is Search’s New Click Fraud
• Google Responds To EU: Cutting Raw Log Retention Time; Reconsidering Cookie Expiration
• Google to Reduce History of Personal Searches

In a stroke of bad timing, a flaw was discovered in Google video on Tuesday, further raising privacy concerns. Users who posted Google videos to other social network sites were at risk of having their usernames and passwords exposed since the information was send in plaintext over http instead of encrypted over https. And of course more images were found through Google Maps Street View that some would probably prefer not be seen.

• Google Video Flaw Raises Privacy Concerns by Exposing Usernames and Passwords
• Google Video Security Flaw Exposing Private Username & Password Information?
• Digg Digest – 06/13/07: Google’s Privacy Challenged, Because Maps Bare All

All in all it was a bad week for Google in regards to issues of privacy.

My Take

George Orwell was right, albeit 15 or 20 years early in his prediction. Big Brother is watching and will continue to watch. Even more Big Brother will consistently find new ways to watch and watch closer than it can at this moment. Technology has always been a two-edged sword. The same data that’s used to make our lives easier through digital transactions is also collected and stored where it may one day be used in the worst case to steal our identities.

I think most of us would say we want our privacy to be protected. At the same time most of us are willing to give out some of our data if we get enough in return. You’ve probably given plenty of websites information like your email address and credit card number. You’ve probably given some your physical address and even your phone number.

How many toolbars do you have installed now? What part of the day are you logged into something like Gmail? We give up information about ourselves all the time when it makes our lives more convenient.

In an ideal world no data about us would be collected and stored. That isn’t going to happen. Data collection has been going on a lot longer than Google and it will continue long after Google. Technology makes it easier to collect, store, and unfortunately share personal data. As much as I wish it weren’t so it simply isn’t going away.

Why Google though? Why all the backlash against Google? Are they really worse than everyone else. I don’t have my own report on the state of privacy in the search industry nor do I have plans to write one, but over the last year I’ve written more posts on things Google has done to protect our privacy than any other search engine. One of the first posts I ever wrote was about Google’s refusal to hand over search data to the U.S. government. None of the other search engines has ever caught my attention as doing the first thing to protect privacy. Only Google.

Google of course has the means to collect more data about us than any of the other search engines given their market share and properties like DoubleClick. Still I have to question why Google is always held as the poster child for being soft on privacy. My general feeling is I’d sooner trust them with my data than I would trust Microsoft. Does that mean Google does enough to protect privacy? No. I don’t think anyone is doing enough, but they do seem to be doing more than others.

Regardless of what their privacy record is, Google does have a PR problem on its hand when it comes to privacy. I think Andy Beal said it best

You can do all of the analysis you want of the study, pick as many holes in it as you can, bring out your supporters to counter the study’s findings, but it ultimately doesn’t matter. People are starting to get a little freaked out by Google’s pervasiveness and are really starting to get concerned about what it knows. Google needs to fight the perception that it is becoming “big brother”, not the reality, before the perception becomes the reality.

It’s that pervasiveness of Google’s that’s the problem. Google’s dominance puts them in front of us and us in front of them more often than any other company. Their record is irrelevant. It’s the perception of that record that is the issue and the perception is that Google isn’t doing enough.

Sadly I think the issue of privacy is going to get worse before it gets better. And while Google may be unfairly taking more than it’s share of the heat it’s good that the issues are being raised and being discussed. It’s only through open dialog that we’ll be able to find a workable solution.

What’s your take? Are you worried about all the information out there that could be connected back to you? Are you afraid someone with ill intent could possible gain access to your data? Is Google doing enough to protect your privacy? Is anyone doing enough? Do you have any ideas on what might be the best solution to the problem?

Comments

Tag:

On the surface, Online Consumer Protection Act sounds noble enough – it would require online pharmacies to publicly comply with state and federal licensing requirements and fill only those medications prescribed by doctors who have personally examined the patient.

Certainly, prescriptions meds are far too easy to get online. People have been hurt and killed by bad drugs and there has been pressure put on directories and search engines to tighten their requirements for pharmaceutical ads. Something needs to tighten somewhere.

But where this bill oversteps the balance is that it institutes another level of government control over ISPs by requiring they block sites they suspect of advertising or selling illegal pharmaceuticals.

While regulation is often necessary, this nipping at the heels of the DoJ’s Big Brother behavior and Congress’ general lack of common sense when it comes to the Web (Internet gambling and the series of tubes, anyone?), the extent to which the government seeks control is, at least a little, alarming.

CNet’s Anne Broache notes that the bill’s main critics come from, quite surprisingly, the Drug Enforcement Administration (interesting they have time to protest given how busy they are winning the War on Drugs). The DEA says policing pharmaceuticals on the Web is their job, given to them via the Controlled Substances Act.

That the hand of noble causes often devolves into an unnecessary iron fist is beside the point. Ratcheting up control at every opportunity is a scary thought – it’s the type of thing that makes online poker illegal but horse race gambling and lotteries not.

If we are to regulate the Internet (and to be clear, some regulation is necessary), let’s use regulation sparingly. 

NY Board Seeks Google DoubleClick Delay

Hooking up Google’s voluminous databases with DoubleClick’s horde of tracking information about web surfers could be a privacy nightmare just waiting to explode. The New York State Consumer Protection Board would rather not see that happen.

"People may not realize it, but Google already collects and retains an enormous amount of personal data about the specific websites and advertisements that are visited by millions of people," Mindy Bockstein, chairperson and executive director of the CPB, said in a statement.

"If this information is misused or falls into the wrong hands, this data collection could seriously harm the privacy rights of consumers," she said.

Bockstein isn’t interested in Google’s nebulous attestations that it protects consume privacy. Her agency wants the steak and not just the sizzle, so to speak. The CPB asked the FTC to compel Google "to make full and public disclosure of its current data collection practices and contemplated data collection practices post-merger."

The CPB also listed what they want to see in a privacy protection program:

• a plan to protect Google’s database from cyberthieves;
• consumer access to the personally-identifiable information in Google’s database and the ability to delete or edit inaccurate information;
• an opt-out mechanism that would allow an Internet user to prevent Google from tracking and storing information about the websites visited by an individual computer user; and,
• remedies in the event of a data breach or failure to comply with a consumer’s opt-out request.

As one of the biggest targets on the Internet, Google likely has pretty good database security in place today. They already have a process for removing phone numbers and residential addresses from their index.

The opt-out mechanism Bockstein wants is going to be a sticking point. Her agency is essentially asking Google to set up a method of selectively pruning information from its access logs.

That’s a little like asking a prospector to toss the gold nuggets back in the river, and will probably be as well received at the Googleplex. The FTC could be more receptive, and if that is the case we expect to see legal missives related to the DoubleClick deal flying over the summer.

(For the uninitiated, "doi" is a juvenile, circa third grade insult, usually spoken with an lengthy up-twang at the end – doiiiii – replaced in junior high with "doofus," and in high school with "dumb ass." Perhaps unrelated, a search for the word "doi" brings back the US Department of Interior at doi.gov.)

Intended to take effect today, the Trademark Protection Act, legislation that would make it illegal to bid on competitor keywords, may get a work-over. Representatives, after passing the law unanimously despite protests from everywhere, may or may not repeal the act, but admit they’ve still "got some work to do."

That realization, courtesy of Rep. David Clark, descended onto to the Utah legislation only after Google, eBay, Microsoft, AOL, Yahoo, 1-800-Contacts, and Overstock.com sent their heaviest hitters to give them a talking-to, according to the Salt Lake Tribune.

The quote of the week, though, as noted on several blogs, also comes from Clark:

"I wish we had had this interaction with industry 60 days ago."

Um, doi. Though Utah’s lawmakers seem to have a poor understanding of how, exactly, the Internet works, we assume they do understand telephones, and have, at least, some lackeys to some research for them.

Perhaps they should subscribe to the Salt Lake Tribune while they’re making improvements in the legislative process, who called the law a "pointless fight" (hat tip to Eric Goldman).

"It’s only now, after the legislation has been passed, that the politicians figured it was worth maybe understanding what their legislation would actually do," writes Mike Masnick, CEO of TechDirt.

"Great point!" echoes Goldman (referring to Clark’s remarks, not Masnick’s). "The world would be a better place if legislators did their homework first before blasting their legislative guns."

But the headline of the week award goes to Kevin Newcomb at Search Engine Watch:

Utah Legislators Doing Research — After They Passed the Law

It’s unclear how Utah plans to rework the legislation. One politician said the law would go into effect as planned (heh, because it takes time to unscrew yourself in legislative matters), but the registry that was to be created will be delayed pending further information.

The Trademark Protection Act made its way quietly through the Utah legislature, not receiving so much as a whimper of opposition as Governor Jon Huntsman Jr. in signed it into law mid-March. Since then, however, the bill has created a firestorm of controversy comprising issues of keywords, trademark, and separation of powers.

The general purpose of the Trademark Protection Act is this:

This bill establishes a new type of mark, called an electronic registration mark, that may not be used to trigger advertising for a competitor and creates a database for use in administering marks.

When you start messing with online advertising, however, you’re infringing on Google’s turf, and they don’t like it very much:

Google, other search leaders and trademark experts are taking notice of Utah’s latest grand experiment in trying to control the global Internet. An earlier law to ban advertising spyware was knocked down in the federal courts. Only the federal government can regulate interstate commerce.

Trademark law is not the underlying issue in this piece of legislation. In fact, the concerns stem from a much more fundamental issue concerning the separation of powers between state and federal government.

In particular, the power to regulate interstate commerce is directly endowed to the federal government within the framework of the Constitution and is, consequently, beyond the jurisdiction and purview of the states.

Trademark lawyer Martin Schwimmer examines the TPA within this context in his blog post:

Because of the potential impact on interstate commerce from the state’s regulation of electronic registration mark use on Internet search engines, this legislation has a high probability of being held to be unconstitutional.

In the context of this legislation, there has been no specific delegation by Congress of the authority to regulate the type of Internet advertising that this legislation targets, whether triggered by an electronic registration mark or any other method.

As if the mounting case against the Constitutionality of the bill weren’t bad enough for Utah, now the Electronic Frontier Foundation is involved. EFF attorney Corynne McSherry was unavailable for comment when contacted, but has issued a statement concerning Utah’s Trademark Protection Act:

Aside from its constitutional flaws, the law is just bad public policy. It undermines the fundamental purpose of trademarks: to improve consumer access to accurate information about goods and services. Trademarks are just shorthand terms that designate the origin of a product.

Comparative advertising uses those shorthand terms to provide more information about the trademarked product and competitive products. That’s why comparative trademark use is clearly protected under federal trademark law. If it weren’t, Pepsi wouldn’t be able to tell consumers that more people think Pepsi tastes better than Coke, and Apple wouldn’t be able to make fun of Microsoft on national television every night.

Attempts to gather the Utah legislature’s side of the story have thus been unsuccessful, the TPA’s chief sponsor, Dan R. Eastman, failed to respond to requests for comment at the time of publication.

This will be an interesting news item to follow as the story develops, given the implications for all the major search engines that make use of paid advertising models driven by keyword sales. 

Utah Law Bans Competitor Keyword Bids

Using a competitor keyword or phrase to trigger an advertisement online in Utah is against the law. The passage of the Trademark Protection Act in Utah would require search engines to check a database of registered trademarks to avoid displaying ads in this way.

The profitability angle for Utah can’t be ignored. An annual fee of no more than $250 would be charged for each registered electronic mark under the law. Utah would reap an enormous windfall from brand name advertisers who wish to circumvent Google’s lawful practice of not investigating keywords as trademarks used to trigger ads in the US.

If you are looking for people who think this law is a bad idea, you’ll be spoiled for choice at the selection. You can start with Utah’s own General Counsel; they appended a legislative review note to the proposed act in the weeks leading up to its passage.

In summary, the General Counsel found problems with the Act as written:

Because of the potential impact on interstate commerce from the state’s regulation of electronic registration mark use on Internet search engines, this legislation has a high probability of being held to be unconstitutional.

The Commerce Clause to the United States Constitution provides that Congress has the power to regulate interstate commerce. (U.S. Const. art. I, sec. 8). This provision also has a “dormant” aspect that “prohibits state . . . regulation that discriminates against or unduly burdens interstate commerce.”

Search engines would either have to check every ad request to see if a user in Utah was making it, then check the search terms against the database of electronic registration marks for possible trademark issues.

Utah’s General Counsel office also considered the possibility that search engines would have to check every user query against the Utah database to avoid the need to determine someone’s location. “Any benefit to the state from this legislation is likely substantially outweighed by the burden on every Internet search engine or similar system to re- engineer its systems and constantly check the search terms or the location of a user,” they noted.

That potential would trigger the dormant aspect of the Commerce Clause. The Electronic Frontier Foundation commented on issues with Utah’s passage of the bill:

Aside from its constitutional flaws, the law is just bad public policy. It undermines the fundamental purpose of trademarks: to improve consumer access to accurate information about goods and services. Trademarks are just shorthand terms that designate the origin of a product.

Banning such competitor trademark usage would undermine legally permitted comparative advertising, according to the EFF’s Corynne McSherry. “That’s why comparative trademark use is clearly protected under federal trademark law. If it weren’t, Pepsi wouldn’t be able to tell consumers that more people think Pepsi tastes better than Coke,” she wrote.

Danny Sullivan brought up a scenario suggesting one difficulty Utah’s trademark system would have with this law:

Can you imagine registering common words like “Orange” or “Egg” or, hmm, “Apple” for protection? Then someone wants to use these words in a non-competitive way. How can the system automatically know this?

It’s difficult to see Utah’s Trademark Protection Act as anything more than a blatant money grab. Let the Constitutional challenges begin.