The Washington PostDemocracy Dies in Darkness

Facebook is now in the data-privacy spotlight. Could Google be next?

Rep. Adam Kinzinger (R-Ill.) showed that his photo and name were used in a fake Facebook account. Zuckerberg thinks A.I. can prevent that in the future. (Video: The Washington Post)

With Facebook chief Mark Zuckerberg getting grilled on Capitol Hill this week about his company’s data-gathering practices, privacy experts are asking a central question: Who let Google off the hook?

The titan of search, smartphones and Web browsing makes more money off its users than Facebook does, gathers more of their data and covers parts of their lives that Facebook can only dream of, Google documents show: what websites they’ve looked at, what places they’ve visited, and many (if not all) of their searches, calendars, documents and emails.

But in the privacy firestorm that has grown out of Facebook’s Cambridge Analytica scandal, Google has emerged almost entirely unscathed. Google executives were originally invited to testify on the use and abuse of data, but the Senate committee ultimately decided against pursuing it, and the company was referenced only sparingly during several hours of congressional questioning Tuesday and Wednesday.

The quiet fear among the nation's tech elite, though, has been that extra attention on Facebook will reflect on everyone — Google, perhaps, most of all. Those tremors could threaten the tech behemoth’s invincibility. Asked Monday whether he would like to see Google executives testify, Sen. Bill Nelson (D-Fla.) said: “Absolutely. Because it's not just Facebook. [Zuckerberg] happens to be the point of the spear. But all these other apps and sites that get your personal data, that’s another way of us losing our privacy.”

Google’s parent company, Alphabet, runs the world's most popular search engine (Google), smartphone operating system (Android), Web browser (Chrome), video site (YouTube) and email service (Gmail), giving the company unprecedented details about its users.

[Facebook’s Zuckerberg gets grilled by House in second day of hearings]

Google and Facebook share a long-standing duopoly that dominates online advertising. And Google shows no signs of slowing down: It is already considered an industry leader in driverless-car development (Waymo), smart-home appliances (Nest) and artificial intelligence (through Google AI and DeepMind), all of which need user data to thrive.

“Google really has a much bigger footprint when it comes to tracking and profiling the everyday lives of billions of people,” said Wolfie Christl, a privacy researcher for the nonprofit think tank Cracked Labs who writes about big data and digital rights. “And it’s often very invasive and very sensitive information. Many people try to Google search what they wouldn’t even tell their own partner.”

Google spokeswoman Andrea Faville said the company allows users to learn what data is collected about them, see how it’s used and control how much is shared. The company’s policies prohibit deceptive behavior and misuse of personal data, she said. “If we find evidence of violations, we will take action,” Faville said. “Google is completely focused on protecting our users’ data while making the products they love work better for them.”

People who have downloaded their Facebook data have been surprised to find catalogues of their online relationships, events and messages, as well as which advertisers have their contact information. But a download of one’s Google trove can be even more exhaustive, including users’ full browsing and search histories and by-the-second data on their physical activities and real-time locations.

Google has not been tied to the major Facebook scandal of the hour: how the political consulting firm Cambridge Analytica exploited the social network’s long-lax privacy policies to improperly gather the personal data of up to 87 million users, mostly in the United States.

[AI will solve Facebook’s most vexing problems, Mark Zuckerberg says. Just don’t ask when or how.]

Like Facebook, however, Google’s massive advertising network was used by Russian sources to spread disinformation during the 2016 presidential campaign. And some of the most recent privacy shocks have sprung forth from loose rules both companies allowed.

Facebook users who downloaded their data from the service last month found years-long logs of “metadata” from their text messages and phone calls, including names and phone numbers. That data gathering was made possible only because Android users had, perhaps unknowingly, agreed to share their call and message details when they installed Facebook's mobile app. Google has since changed how Android apps ask users’ permission for call and message data, but apps can still access it. Apple’s iPhone operating system, iOS, has never allowed third-party apps to access call data.

“On the one hand, it seems like Google has simply done a better job of managing the data it has and ensuring privacy protections are in place. What Facebook did reflected some incompetence,” said Brian Wieser, a senior analyst for Pivotal Research Group. “On the other hand, I think the reason for consumer outrage is because the Cambridge Analytica episode is highlighting consumers' mostly latent fears around how their data can be used against themselves. In that sense, Google is not much better.”

So why is Facebook the only one in the hot seat? Scott Steinberg, the co-founder of Data Does Good, whose members raise money for nonprofits by sharing their anonymous online shopping data, says the haphazard public conversation about data privacy is dominated by news-making flare-ups, such as the Cambridge Analytica episode. Google, he says, has more often avoided public criticism simply because it has been better at avoiding those kinds of scandals.

“Google should be at the center of the more holistic conversation about data regulation and ethics. … They have significantly more data, both in terms of quantity and sensitivity, than Facebook, Amazon and [major data broker] Acxiom combined,” he said. “If the conversation becomes more about policy than about data breaches, which it’s looking likely that it will, I expect that Google will gain more of the spotlight.”

[Facebook stores its data in this rural North Carolina town, where the privacy debate is just beginning to catch on]

Google and Facebook account for about two-thirds of all U.S. digital-ad revenue, and both companies’ advertising businesses depend on gathering as much user data as they can.

But Google holds a major advantage over Facebook, because it fleshes out a user’s profile with data from all the sites that person uses: Instead of just the interactions people would share with their family and friends, Google knows a person’s private searches, travel schedule and YouTube views. That system of digital bread crumbs is often why a product someone searched for on one website can end up following them around the Internet in ads.

People seem to be taking notice of how closely they’re being targeted by marketers using Google and Facebook’s tools. About 70 percent of U.S. Internet users surveyed in January by market research firm Kantar Millward Brown said they thought online ads were more intrusive now than they were three years ago.

Chris Sperandio, head of privacy at the marketing-data firm Segment, said there’s a major difference in how both companies gather and use their data. Facebook’s advertisers have long targeted people based on informed guesses, built off their profiles, interests and other details but also demographic and spending information sold or shared by data brokers and other third-party sources — what he called “data gossip.”

“When you use Google, you’re almost always signaling some direct intent — whether it’s a search for a product or a place or anything else,” Sperandio said. People “want to give data to companies in return for excellent services and experiences. They don’t want to do that in return for data gossip that’s happening on the back end.”

Google spells out on its privacy page that it gathers a ton of data on its users, separated into three categories: the “things you do,” such as what you search for, which websites and videos you looked at, where you went; the “things you create,” such as your emails, contacts, calendar events, photos and documents; and the “things that make you ‘you,’ ” such as the name, birthday, email address and phone number you gave when opening a Google account.

But the ways in which Google gathers data are not always so obvious. The company raised privacy concerns in 2017 when it said it would begin measuring the real-world performance of its online ads by working with undisclosed companies that had access to 70 percent of the credit-card and debit-card transactions in the United States.

[Google now knows when its users go to the store and buy stuff]

Users, fairly or unfairly, say they tend to trust Google more than Facebook anyway. An Axios/SurveyMonkey poll of a few thousand American adults last month found that Google’s favorability was 78 percent, handily beating Facebook, at 48 percent.

Privacy experts said Google’s data practices and controls are more advanced, more detailed and simpler to use than Facebook’s. The search giant makes it easier for users to delete parts of their data from the site, such as location history, and regularly notifies users what data of theirs is currently open to outside companies. Facebook last month said it planned to improve its data controls and make its privacy settings easier to find.

It’s unclear how long Google will be able to stay out of Facebook’s data-privacy shadow. Apple chief executive Tim Cook has recently dug in on Facebook with criticism that could just as easily apply to the search giant. “The type of information has to be looked at that companies can hold,” he said in a recent MSNBC interview. “When you’re the owner of many different properties and I can take the information I’ve learned about you from this property, add it to what I learned about you here and here and here, and there’s no reasonable alternative for people.”

“To me, it’s creepy when I look at something, and all of a sudden it’s chasing me all the way across the web,” Cook added.

Experts said Google has one thing going for it: Unlike the #DeleteFacebook movement, there’s no easy way to call off the all-encompassing search engine for good. (And Facebook says that not many people are closing their accounts anyway.)

“Both of them know us better than our co-workers or people in our family,” said Charla Griffy-Brown, a professor of information systems at Pepperdine University's business school. “It all comes down to trust.”