More than a billion people worldwide have signed up for Google accounts, clicking through screens promising that “your personal info is private and safe.” This week, Google’s sign-up process came under fire when European Union consumer rights groups issued new privacy complaints suggesting that the opposite is true—that Google intentionally designs default settings to deceive new users into granting permissions to harvest and share a broad swath of personal info.

“The language Google uses at every step of the registration process is unclear, incomplete, and misleading,” the European consumer organization BEUC told Reuters. BEUC is helping to coordinate a potential civil lawsuit in Germany and several new complaints to data-protection authorities from consumer rights groups in France, Greece, the Czech Republic, Norway, and Slovenia.

The key issue in these complaints is how hard Google makes it for account users to choose privacy-friendly options. It’s much easier, the consumer groups argue, to set up an account to share personal info than to protect it. As Tech Crunch reported, Google designed a one-click “express personalization” option allowing data tracking, while “manual personalization” requires 10 clicks to turn off tracking.

A Google spokesperson told Reuters that “we are committed to ensuring these choices are clear and simple,” denying any wrongdoing because “these options are clearly labelled and designed to be simple to understand. We have based them on extensive research efforts and guidance from DPAs (data protection authorities) and feedback from testers.”

Google did not immediately respond to a request to comment on any plans to alter the sign-up process. (Update: Google responded with a statement that added that they “welcome the opportunity” to engage with consumer advocates and regulators regarding privacy concerns.)

Do better

BEUC maintains that Google could do better.

“Contrary to what Google claims about protecting consumers’ privacy, tens of millions of Europeans have been placed on a fast track to surveillance when they signed up to a Google account,” said Ursula Pachl, deputy director-general of BEUC, in a statement. “It takes one simple step to let Google monitor and exploit everything you do.”

Instead, she countered, “Privacy protection should be the default and easiest choice for consumers.”

BEUC sees Google as a repeat offender, pointing to additional privacy complaints dating back four years and past fines by EU antitrust regulators amounting to more than $8 billion. Reuters reported that the tech company “could face fines worth up to 2 percent of its global turnover if found guilty of breaching EU privacy rules.”

BEUC expects that the newest complaints from consumer rights groups will pressure regulators to take action against Google. BEUC is working to ensure that account holders are always in control and clearly understand how their data is used.

For now, anyone creating a new account by default grants Google permission to save web and app activity, including their entire YouTube history and use of Google services like search, to personalize ads. On the Privacy and Terms page, users are told that “you’re in control,” with “more options” to turn off these particular settings linked below summaries that explain why the default settings to widely share data are beneficial.

Pachl said the EU complaints will continue until Google accounts are no longer “subjected to surveillance by design and by default,” as required by the EU’s data protection law, the General Data Protection Regulation.

https://arstechnica.com/?p=1863933