Google Inc. is now disclosing more details on how it collects and uses data obtained from users, but it is remaining silent on several key questions that concern privacy advocates.
The company's new privacy policy, though little changed in substance from one issued 15 months ago, is easier to read and reflects Google's expansion beyond its core search engine business.
It also describes in greater detail what Google is doing to protect against abuses.
But it remains remains silent on how long information is kept. That's an area of growing concern as Google offers more and more services that potentially collect and store a wealth of personal data, making the company's servers a prime target for abuse by overzealous law enforcers and criminals alike.
The most material change is in format. The July 1, 2004, policy is replaced by a set of three statements: a full-length policy twice as long as the one it replaces, a "highlights" version and explanations in question-and-answer format.
"We know privacy is important to our users, and it's important to us, too," Google associate general counsel Nicole Wong wrote in the company's official Web journal. "That's why we work hard to let people know how we collect and use personal information to provide our services. A clearly written privacy policy is part of this effort."
The goals of the new statements, she said, was "to help you make informed choices about using our services."
The new policy, issued Friday, states that Google may use personal information to display customized content and advertising, develop new services and ensure that its network continues to function. The practices aren't new but weren't explicit before.
And while the old policy says Google restricts access of such information to employees on a need-to-know basis, the new policy stresses that those individuals may be fired or criminally prosecuted for violations.
Google also reorganized its disclosures, bringing to the top details on information collected for e-mail, personalized search and other newer services that require registration.
The fact that information may be shared among services is also moved to the section describing the types of information collected.
Reflecting the fact that Google has been acquiring and partnering with more companies, the policy now includes language on affiliated companies and sites, though it did not specify what types of affiliates fall under those clauses.
"The affiliated sites may have different privacy practices and we encourage you to read their privacy policies," Google warns.
Chris Hoofnagle, senior counsel with the Electronic Privacy Information Center, said the changes do nothing to diminish his worries that Google is amassing "quite a trove of transactional and personal data" through its various services, which include e-mail, driving directions, photo-sharing, instant messaging and Web journals.
Because storage is cheap, data from these services can be retained practically forever.
Google has said it had no set time limits on data retention, leaving such determinations to individual product teams who may find data still useful for tweaking search algorithms and other services.
