users. For example, Google and Yahoo collect search queries (among many other sorts
of data), Facebook collects the social maps of its users, Wikipedia collects the editing
histories of its users, and so forth. The collection of these sorts of data does not look
like the typical Internet surveillance performed by the NSA and other government
actors, but it represents a second type of surveillance on the network, equivalent in
scope to the collection of data flowing across the network.
Google in particular (but not alone) has collected a tremendously large and intrusive
amount of personal data about its users through the operation of its various services.
Google argues that users should not be overly concerned about Google’s data collection: ‘‘we remember some basic information about searches. Without this information,
our search engine wouldn’t work as well as it does or be as secure. [What this information] doesn’t tell Google is personal stuff about you like where you live and what your
phone number is. . . . Logs don’t contain any truly personal information about you.’’ 21
User search data surely help in the way Google says they do (‘‘improve our search
results,’’ ‘‘maintain security,’’ and ‘‘prevent fraud’’). And their explanations of the privacy implications of the data usage of Google’s engineers are accurate in a narrowly
technical sense. But the importance of data is determined by the larger world in which
it exists—by the other data that it connects to. Google’s statement that a cookie does
not tell them ‘‘personal stuff about you like where you live’’ is only true in the narrow
sense that your driver’s license number does not tell the police where you live. Even
though the cookie itself is just a random string of gibberish letters, it can indeed be
used to look up personal information ‘‘like where you live.’’ For example, the cookie
connects to all searches performed by a single person. Many people search for their
own names at some point and for their own addresses at some point (if for no other
reason than to see their houses in Google Maps). The cookie connects those two
searches to the same (otherwise anonymous) person, thus potentially identifying
the name and address of the person behind the random gibberish of a particular
cookie. Researchers have consistently shown the ability to crack the identity of individual users in these kinds of data collections with anonymous but individually unique
identifiers. 22
It is likely that Google’s collection of search terms, IP addresses, and cookies represents one of the largest and most intrusive single collections of personal data online
or off-line. Google may or may not choose to do the relatively easy work necessary to
translate its collection of search data into a database of personally identifiable data, but
it does have the data and the ability to query personal data out of the collection at will.
Even assuming perfect security to prevent data leaks, Google is still subject to many
sorts of government requests for its data. Witness, for instance, the success of Viacom
in subpoenaing the complete log of every video ever viewed on YouTube.com (which
is owned by Google) in the context of copyright litigation. 23
In addition to its search engine, Google’s AdWords displays ads on about 35 percent
of all advertising Web pages. 24 Google logs instances of consumers clicking on ads
42
Hal Roberts and John Palfrey
of data), Facebook collects the social maps of its users, Wikipedia collects the editing
histories of its users, and so forth. The collection of these sorts of data does not look
like the typical Internet surveillance performed by the NSA and other government
actors, but it represents a second type of surveillance on the network, equivalent in
scope to the collection of data flowing across the network.
Google in particular (but not alone) has collected a tremendously large and intrusive
amount of personal data about its users through the operation of its various services.
Google argues that users should not be overly concerned about Google’s data collection: ‘‘we remember some basic information about searches. Without this information,
our search engine wouldn’t work as well as it does or be as secure. [What this information] doesn’t tell Google is personal stuff about you like where you live and what your
phone number is. . . . Logs don’t contain any truly personal information about you.’’ 21
User search data surely help in the way Google says they do (‘‘improve our search
results,’’ ‘‘maintain security,’’ and ‘‘prevent fraud’’). And their explanations of the privacy implications of the data usage of Google’s engineers are accurate in a narrowly
technical sense. But the importance of data is determined by the larger world in which
it exists—by the other data that it connects to. Google’s statement that a cookie does
not tell them ‘‘personal stuff about you like where you live’’ is only true in the narrow
sense that your driver’s license number does not tell the police where you live. Even
though the cookie itself is just a random string of gibberish letters, it can indeed be
used to look up personal information ‘‘like where you live.’’ For example, the cookie
connects to all searches performed by a single person. Many people search for their
own names at some point and for their own addresses at some point (if for no other
reason than to see their houses in Google Maps). The cookie connects those two
searches to the same (otherwise anonymous) person, thus potentially identifying
the name and address of the person behind the random gibberish of a particular
cookie. Researchers have consistently shown the ability to crack the identity of individual users in these kinds of data collections with anonymous but individually unique
identifiers. 22
It is likely that Google’s collection of search terms, IP addresses, and cookies represents one of the largest and most intrusive single collections of personal data online
or off-line. Google may or may not choose to do the relatively easy work necessary to
translate its collection of search data into a database of personally identifiable data, but
it does have the data and the ability to query personal data out of the collection at will.
Even assuming perfect security to prevent data leaks, Google is still subject to many
sorts of government requests for its data. Witness, for instance, the success of Viacom
in subpoenaing the complete log of every video ever viewed on YouTube.com (which
is owned by Google) in the context of copyright litigation. 23
In addition to its search engine, Google’s AdWords displays ads on about 35 percent
of all advertising Web pages. 24 Google logs instances of consumers clicking on ads
42
Hal Roberts and John Palfrey