As the tech titans fight a growing global battle countering privacy concerns over their insatiable hunger for our personal data to sell advertising, not all technology giants are equal.
Fears are mounting that some companies may be collecting some personal data without our knowledge, but experts say Google’s power makes it the biggest threat to privacy, given the amount of information it gathers and the huge reach of its sites and apps.
It seems that what billions of smartphone users worldwide thought was data-sharing with Google on web pages has morphed to a level of surveillance that most people struggle to understand.
A report by US technology firm Oracle Corporation on the issue is being sifted through by the Australian Competition & Consumer Commission and the Office of the Australian Information Commissioner.
Every moment, if you believe Oracle, Google is tracking billions of users using the phone in their pockets.
Last week, The Australian detailed claims Oracle made in a presentation to the paper.
Chris Griffith joins Biz Tech host Chloe James to discuss all the latest consumer technology.
Oracle believes users unwittingly are uploading on average one gigabyte a month of personal data for Google to analyse. Equally worrying is Oracle’s claim that Google’s Android operating system continues to track a user’s exact location when location services are turned off and when the phone doesn’t have a SIM, the smart card in your phone that connects it to your provider’s network.
In its privacy policy, Google acknowledges tracking can be achieved without an active SIM or without satellite-based tracking (GPS). It can record a user’s address on the internet — their IP address, which identifies them online — through a phone’s use of Wi-Fi access points and Bluetooth, a short-range wireless technology.
A phone can be used to identify which floor of a shopping centre you visit. You can be tracked through mobile phone towers using the phone’s modem and triangulation. While it is technically possible to track you, Google says it doesn’t track users when Android’s master location switch found in settings is set to “off”. It also says any data it collects for marketing is used anonymously.
It says it doesn’t sell identifiable location data on your phone, although you might give it and third parties permission to access it. “They (users) are free to disable Google’s location service at any time, and the data this service sends back to Google’s location servers is anonymised,” a Google spokesman says.
An interesting aside is Oracle’s role here. It’s an unusual move for a giant US technology corporation to dob in another US corporation with a presentation to a media organisation in such a public way. Oracle is playing corporate whistleblower. Oracle does have a motive: a $US8 billion-plus ($10.5bn) legal case over Google’s apparent copying and use of components of Java software, which Oracle owns. It has been the subject of multiple trials.
Google is savage in its response. “Like many of Oracle’s corporate tactics, this presentation is sleight of hand, not facts, and given that Oracle markets itself as the world’s biggest data broker, they know it,” Google says in a statement.
Google says smartphone data is not shared at a near constant rate and that shared information about location amounts to less than 20MB a month.
Other data is shared. Most users seemingly understand the trade-off, that Google offers a swag of services free of charge in exchange for data about buying habits. But surveillance wasn’t part of the deal as we understand it.
University of NSW professor of artificial intelligence Toby Walsh says Google’s access to more than half the credit card transactions in the US means the company can do more than merely monitor people only in shopping centres. It can also distinguish serious buyers from window shoppers and adjust advertising accordingly.
“You can work out who is the best person to focus your energy on,” says Walsh.
In a blog post last year to advertising clients, Google ads and commerce senior vice-president Sridhar Ramaswamy says the company captures most of US credit and debit card transactions.
“Even if your business doesn’t have a large loyalty program, you can still measure store sales by taking advantage of Google’s third-party partnerships, which capture approximately 70 per cent of credit and debit card transactions in the US,” he says in the post written for last year’s Google Marketing Next event.
It discusses applying machine learning to marketing analytics and measuring store sales revenue from store visits.
“This includes visits that happen in multistorey malls or dense cities like Tokyo, Japan, and Sao Paulo, Brazil, where many business locations are situated close together,” says Ramaswamy.
Ramaswamy says Google is using machine learning to better work out when a user is ready to buy a product. “It (machine learning) analyses trillions of search queries and activity across millions of websites to help figure out when people are close to buying and surface ads that will be more relevant and interesting to them.”
Walsh says many users don’t understand how sophisticated data tracking and usage has become. “Now they’re following you in the real world. It may be your credit card that is tracking you; it may be your Google Maps, providing information that tells Google you went off to Westfield, you walked into JB Hi-Fi; and now we see the credit card transaction that you went and bought a fan.”
Walsh says that, across time, Google could know exactly what your research and buying pattern is, which shops and online stores you use, what you buy and how often, and gain a predictive profile of your behaviour.
“There are plenty of cases that show that users don’t appreciate they’re being tracked as much as they are,’’ he says.
“With Android, people thought they were opting out (of being tracked) but in fact they weren’t. Android was still collecting information on them after they turned off location tracking, and they had removed the SIM.”
The Google Maps apps shows how easy it is to build a comprehensive picture of your general movements.
Select the second option in the Google Maps app, “Your Timeline”. You’ll see that Google has tracked you every day over several years if you shared your location history at some time. On iPhones, Google would have asked for always-on location access. You may have granted access without realising how pervasive it is.
Google knows if you travel in a car or plane, walk, cycle or catch a train or tram. It records shops you visit in the daily timeline. If you take photos en route, it inserts them at the right moment to remind you of the event. It’s the illustrated diary you may not know you were keeping.
The problem is users don’t understand the extent to which data is collected when they opt into sharing location history for something simple, such as getting information about their commute. It’s easy to grant a permission without understanding the extent of its use.
The privacy debate sparked by Oracle has arisen as Europe’s General Data Protection Regulation regime comes into force today. It restricts data that tech companies can collect. Tech firms have been rewriting their privacy agreements ahead of it and users globally have been bombarded with these new agreements. It’s unlikely users will spend their waking hours reading them to become aware of their rights. It’s likely most people will miss the chance to rein in data-sharing.
Walsh believes regulators should require Google to ask users whether they are prepared to be tracked so closely. Access to data should be renewed periodically. “I think (the companies) should have to frequently come back to you and check that you’re still happy to give your data away,” he says. Data should have a use-by date after which it must be deleted.
Google says users can see what data is collected and how it’s used in “My Account” and control it from there. It says Australians visited the My Account facility more than 22 million times last year.
Walsh says Google is not the only company squirrelling away more data than it should. “Uber was discovered to be tracking people after they were dropped off, after they had given up the ride. They wanted to work out where people were going,” he says, noting that Uber potentially could discover which restaurants riders went to and which cinemas they visited.
Then there’s data from the hidden business models, such as bike hire companies. The idea in Sydney that you can abandon a hire bike anywhere gives companies a more precise idea of where you ride to.
Australian Privacy Foundation chairman David Vaile says Google is at heart a commercial surveillance business. “They use psychographic profiling to get inside the heads of users and to exploit that for almost subliminal advertising,” he says. “They are delivering messages to you that you find strangely appealing, strangely plausible, and it’s under the radar. This is a consumer protection problem where users are treated like cattle or sheep.”
Much has been written about DeepMind, Google parent Alphabet’s specialist London-based artificial intelligence unit acquired in 2014, and how Alphabet will leverage artificial intelligence from it for commercial use. DeepMind was mentioned at Google’s recent I/O conference, where it announced annual software updates.
DeepMind produced an AI-related feature called “adaptive battery” for improving a phone’s battery life based on a user’s app choices, and an AI-inspired feature for optimising screen brightness. It’s basic stuff, in terms of applying AI to Android.
But another Alphabet company, X, is delving deeper into AI. A leaked video from X discusses how Google could move beyond passively recording people’s movements and purchases to actively influencing people’s choices to aid its data collection. The video cites Richard Dawkins’s book The Selfish Gene,where users are “transient carriers” or “survival mechanisms” of data. Users are influenced to perform actions that let Google collect more data about that user. So humanity is subjugated to carrying out actions that enhance Google datasets. Google X describes the data it collects as belonging to “the selfish ledger”.
“User-centred design principles have dominated the world of computing for many decades but what if we looked at things a little differently?” the video says. “The ledger could be given a focus, shifting it from a system which not only tracks our behaviour but offers direction towards a desired result.”
Google says the video is unrelated to any plans and is a “thoughtful experiment”. But it illustrates the perils of the tech world exploring futuristic ideas in a social vacuum.
Last month The Wall Street Journal reported that Google was likely to keep “shadow profiles”, data on non-users. Facebook also says it keeps such shadow profiles.
The OAIC and the ACCC are examining Oracle’s claims.
“The OAIC met with Oracle and is considering information it provided about Google location services,” a spokesman says. The ACCC says it is looking at Google and Facebook as part of its digital platforms inquiry. “We are exploring how much consumers know about the use of location data,” an ACCC spokesman says.
Vaile is unconvinced by Google’s assurances: “We need to look at these giants. They might be too big and too dangerous. They are bigger than countries and their artificial intelligence is out of control. They might need to be broken up.” He says there is a need for legal reforms.
“The law needs to be strengthened and put in the hands of individuals. We should be able to sue for breach of privacy, breach of data protection and breach of security. (The Coalition and Labor) have squibbed on addressing this despite being given a blueprint by the Australian Law Reform Commission.”
If Google isn’t breaching privacy, it needs to work harder to convince members of the public its monitoring of their locations and shopping habits is benign. It’s hard to understand, let alone trust, such a complex tracking capability.
Published in The Australian newspaper.