Starting on March 29, Google is changing its infamous “Web & App Activity” controls for paid users of Google Workspace. That feature is now being split up into two settings, one still called “Web & App Activity” and another called “Search history.” The big news is that Google is taking advantage of this settings split to re-enable some tracking features, even if users have previously opted out.
Google has started emailing Workspace administrators about the change (thanks, Hacker News), and a support page gives some details about what’s going on. Both the email and support page are incredibly confusing—even Google’s own employees have a hard time parsing Google’s privacy controls—but we’ll try to shed some light on the situation.
The support page begins, “Starting March 29, 2022, the Web & App Activity Admin console setting is going away.” “Web & App Activity” is one of the two main Google privacy settings (along with “Location History”) that saves everything you do on your Google account. You might remember these settings from several lawsuits about how confusing and poorly labeled they were. Leaving these settings on means that features like autocomplete work better, but it also means that Google gets to keep all your activity.
Note that this line says the Admin control for the Web & App Activity setting is going away, not the entire setting itself. Google is saying the Web & App Activity feature will no longer be centrally controllable by your administrator. The crux of those earlier privacy lawsuits was that having privacy settings bizarrely split across two switches was unnecessarily confusing. Now, with Search History, privacy settings are split across three switches.
Google tries to describe the difference between the two changed settings, saying, “Google Workspace search history collects search data for Google Workspace products like Gmail and Google Drive. Web & App Activity previously collected searches for all Google services. Now it only collects searches for additional Google services.”
The terms “Google Workspace products” and “additional Google services” are the key to understanding that description. Basically, Google is splitting the data that was previously captured by “Web & App Activity” into two settings. “Search History” will only cover apps that are part of the “Google Workspace” product lineup. There is a full list of those services here, but it’s basically Gmail, Calendar, Docs, Contacts, Drive, Google Chat, and Keep—the business apps—and not Google Maps, Google Search, YouTube, and other products that lack a strong business use case. So for paying Workspace users, Search History will now cover usage data for Workspace stuff, while Web & App Activity will cover every other Google product that isn’t specifically listed in the Workspace terms.
Google’s reasoning for this change is that, because Workspace apps are paid for, “Google never uses your data in Google Workspace core services for advertising,” the company said. So basically the new “Search History” setting could be called “save data that won’t be used for ads.” Meanwhile, the “Web & App Activity” setting could be called “save data that will be used for ads.” Google hopes that this distinction—if anyone can understand it—will lead to more privacy-conscious people leaving the Search History setting on.
Regarding the promise to not use data from “Workspace core services,” Google’s statement doesn’t cover Google Search (it’s not a core Workspace app), which is the primary vector for Google ads and data for Google ads. That’s right—the “Search History” setting from Google doesn’t cover Google Search history.
I struggle to give Google the benefit of the doubt here since the end result of all these changes just happens to be “more user tracking.” The organization-wide control for Web & App Activity is leaving the admin panel, and the switch for that control will now be up to each individual user. Google would probably argue that the switch for Web & App Activity doesn’t belong in the admin panel since it no longer affects specifically “Workspace” products. But we’re still talking about a Workspace account, and leaving the setting up to less tech-savvy users will result in fewer of them finding and understanding it.
The new Search History setting also isn’t in the administrator panel. Google is leaving this up to users and taking the incredible step of turning on data retention even for users who have previously opted out of the tracking this covers. Every individual user who already said they don’t want this will have to hunt down the setting again. Admins who don’t want this will have to hound each individual user to shut it off.
There is already widespread confusion in the Hacker News thread and other places about these changes, and Google’s communication in the email and support page is nowhere near as clear as it should be. To quote one of the Googlers cited in Arizona’s location-history lawsuit, Google’s settings and communication feel like they are “designed to make things possible, yet difficult enough that people won’t figure it out.”
https://arstechnica.com/?p=1831215