Google: Claims of bypassing Safari security settings 'mischaracterized'
Connecting state and local government leaders
The search giant defends itself against claims of subverting Safari, as Microsoft says IE's settings were also bypassed.
Google is defending itself against claims that it bypassed the privacy settings in the Safari and Internet Explorer browsers by saying that it was only providing features enabled by signed-in Google account holders and did not collect personal information.
The statement from the company came after the Wall Street Journal reported on how Google was bypassing Safari’s settings, members of Congress called on the Federal Trade Commission to investigate whether Google violated its settlement agreement with the agency, and Microsoft said IE’s settings also were being bypassed.
In a letter to FTC Chairman Jon Leibowitz, Reps. Edward Markey (D-Mass.), Joe Barton (R-Texas) and Cliff Stearns (R-Fla.) described the issue as a “major concern. ... Google’s practices could have a wide sweeping impact because Safari is a major Web browser used by millions of Americans." The browser is used on both iPhones and computers.
Stanford University graduate student Jonathan Mayer discovered the code, the WSJ reported. A technical adviser to the newspaper, Ashkan Soltani, independently confirmed his findings.
“Once the coding was activated, it could enable Google tracking across the vast majority of websites,” reported the WSJ. Three other companies are using similar techniques: Vibrant Media Inc., WPP PLC's Media Innovation Group LLC and Gannett Co.'s PointRoll Inc.
Google removed the cookies after being contacted by the WSJ.
Safari blocks third-party cookies by default but does allow tracking for some purposes and only from sites that users directly visit. For the workaround, the Google used its DoubleClick network to see if Safari users were signed into Google. If they were, the cookie allowed Google to serve personalized ads and gave users the ability to use its “+1” button.
The findings appeared to contradict Google’s instructions on how to avoid tracking in Safari. A Google site stated that Safari’s privacy settings prevented tracking by Google. The statement was removed after the story broke, said the WSJ.
Google also used similar code to track Microsoft’s Internet Explorer users. In a blog post, Dean Hachamovitch, corporate vice president of Internet Explorer, said Google is circumventing IE users’ privacy preferences by bypassing its P3P Privacy Protection. Hachamovitch recommended IE users install IE 9 and add a Tracking Protection List to avoid being tracked by Google. He also said Microsoft may make changes to its products in light of the issue.
In a statement, Google spokesperson Rachel Whetstone said the WSJ article “mischaracterizes what happened and why. We used known Safari functionality to provide features that signed-in Google users had enabled. It’s important to stress that these advertising cookies do not collect personal information.” She added that it was unintentional and that anyone who opted out of Google’s Web-based advertising program was not affected.
In response to the report, Apple spokesman Bill Evans said, “We are aware that some third parties are circumventing Safari’s privacy features, and we are working to put a stop to it.”
The congressmen were particularly concerned by the findings since Google will begin tracking users across its product lines March 1. Users will not be able to opt out other than by closing their Google account, GCN has reported.
However, the upcoming changes will not apply to government clients.
"The new Privacy Policy does not change our contractual agreements, which have always superseded Google's Privacy Policy for enterprise customers," Google Vice President of Enterprise Amit Singh said in a released statement from the company.
The discovery isn’t the only privacy lapse the government is looking into concerning Google. The FTC will investigate Google, Apple and other technology firms for their processes around collecting personal data of young children via mobile apps, reported the Washington Post.
While child privacy laws require companies to obtain permission from parents to collect data about users under 13, as well as clearly explain what information is being collected and how it will be used, Apple, Google and others rarely disclose this, and application developers don’t provide much information on their privacy practices, said the FTC.
Yet responsibility for privacy breaches ultimately are our own fault, said Thomas Claburn in an Information Week article.
“We rely on free services like Gmail while insisting on ‘privacy,’ a term that we probably can't even define to our collective satisfaction,” Claburn said. “We accept terms of service contracts and privacy policies that explain in excessive detail how we will not get privacy, how our information will be used, and then we object. If you object to the way Google does business, use ad-blocking software. ... Perhaps everyone will follow this advice, Google will collapse, and then we can all just go back to fee-for-service computing. How does a $0.25 per search and $99 for an Android 5.0 upgrade sound?”