Google Buzz Gets a Wake-Up Call

Earlier this week, Google released Buzz, a social networking extension to its Gmail and Gchat services. But the biggest buzz about this new service concerned its privacy problems. Fortunately, Google showed once again that when you Demand Your dotRights and tell companies to respect your privacy, they will respond. Keep up the pressure and tell Google that Buzz still has some problems to fix!

Not the Kind of Buzz Google Was Hoping For

Buzz is Google's latest foray into the social networking space occupied by services like Facebook and Twitter. Unlike those services, which were built from scratch, Google rolled out Buzz on top of its existing Gmail and Gchat services—interfaces that are most commonly used for private communications--and pre-populated your "following" list with your most frequent chat and email contacts. And then it made that information part of Buzz users' profiles, and made it public by default, neither of which was clear to many users.

And Buzz Mobile isn't much better. Although Google does present Buzz users with a choice about attaching their location information to their buzzes, it encourages them to do so by making location sharing the default—in fact, unless users uncheck the default option, they will never again be asked whether their location information will be added to their posts. But what Google does not make clear to mobile users is that their buzzes will not be available only to their friends and followers, but to every other nearby Buzz user!

(There have also been rumors that Buzz can automatically import pictures from an Android phone and use those as profile pictures, but we haven't seen confirmation of that—if true, of course, this is another huge privacy issue.)

The buzz on Buzz immediately called out these problems. CNET called Buzz a "privacy nightmare," Business Insider warned that Buzz has a "huge privacy flaw," and the Consumerists stated that Buzz "managed to completely overstep the bounds of personal privacy." Good Morning Silicon Valley might have put it best by saying that "Buzz has privacy issues and it's Google's default": instead of making privacy the default, Google put users' information at risk, and has suffered the consequences.

You Speak, Google Responds

Fortunately, Google has already started to respond to your complaints about Buzz by improving privacy controls. In particular, new Buzz users will now see a message that their follows and followers will be part of their public profile unless they uncheck the provided checkbox.

This isn't enough: it's not clear whether this will affect anyone who has already started using Buzz, it's not enough to tell users that their follows list is already loaded up with their most frequent email and chat contents, and it doesn't adress the mobile privacy issues at all.

But it does show that Google is willing to listen to your concerns and meet your demands. So please contact Google and tell them to take the privacy sting out of Buzz by:

• Protect privacy of contact lists. As we said, new Buzz users automatically import some of their email and chat contacts into their Buzz profile, and this information is still public by default. Users—including people who have already joined Buzz—need to be given real control over whether and which contacts they import from private services like Gmail and Gchat into services like Buzz. And this information should be private by default.
  
  (If you are already a Buzz user, here's a good tutorial on how to hide your followers list from your profile.)
• Protect location privacy. Google's default options set up your account to (a) automatically tag every Buzz post from your device with your current location and (b) share all of your Buzz posts with any other Buzz user nearby, whether a friend of yours or a complete stranger.
  
  Again, Google needs to change its default settings for location information. Because location information is so sensitive, users should not be encouraged to immediately and permanently choose to share their location; instead, privacy should be the default option. In addition, users should be able to choose whether to share mobile buzz with only their friends or with the whole world, and privacy should again be the default.

We are disappointed that Google has already "ma[de] a lot of Facebook's privacy and opt-in mistakes right out of the gate" instead of learning from Facebook's mistakes and doing things right the first time, but we hope that they will respond to the current buzz of criticism and fix the problems now. To encourage them to quickly correct these mistakes, please contact Google and tell them to address the privacy holes in Buzz.

And for more information about efforts to push companies like Google to respect your privacy on social networks and elsewhere on the Internet, please join our online privacy campaign, Demand Your dotRights!

Chris Conley is the Technology and Civil Liberties Fellow with the ACLU of Northern California.