Google Knows if You Have the Flu

Search users trust companies like Google to keep the contents of their search private. Recently, Google threatened that trust in using search queries to track flu outbreaks. Even though the motivation for this use may be wholly altruistic, and the information may be entirely aggregate without any personal identifiers, this still demonstrates that Google considers search queries Google property to be used as the company sees fit and not private communications from individual users.

Search Privacy and the Flu

Google's new service, Google Flu Trends, "uses aggregated Google search data to estimate flu activity in your state up to two weeks faster than traditional systems." Although not every search for flu-related terms corresponds to a sick person, on average, Google has found that searches for flu-related terms from a particular location indicate an emerging outbreak. (Google most likely determines the location of a search user based on the user's IP address, although that fact is not stated in the documents.)

Google's description of Flu Trends states that Google is "keenly aware of the trust our users place in us, and of our responsibility to protect that privacy. Google Flu Trends can never be used to identify individual users because we rely on anonymized, aggregated counts of how often certain search queries occur each week."

Unfortunately, this misses the mark. As Orin Kerr, a frequent sparring partner of privacy advocates, notes: "But do we want Google establishing such a cozy relationship with the federal government? I don't. I've thought about writing an article calling for a Search Engine Privacy Act, to prevent unauthorized use and disclosure of search queries. Stories like this make me think I may put that on the front burner rather than the back burner."

Demanding Control of Search Records

Our control over the private details of our own lives is threatened by the fact that Google both claims the legal right to voluntarily turn search records (albeit aggregated and anonymized) over to federal authorities, and actually does so without user notice and consent. More than anything, this clearly indicates that Google views itself, and not users, as the owners of those records.

We must demand that Google, and the law, change that view. Search records belong to the person conducting the search, not to the company that runs the search engine. To protect privacy and autonomy, we need to support efforts to establish that we own these records and that Google use them only with our informed consent. Contact Google and demand control over search records so that we, not Google, can decide if and how they are used.

Chris Conley is the Technology and Civil Liberties Fellow with the ACLU of Northern California.