Google, Inc. 65%

OVERALL – 65%

Google, a founding member of the Global Network Initiative (GNI), earned the highest overall score in the Index. However there is much room for improvement. While aspects of U.S. law and the company’s business model would need to change in order for Google to achieve a perfect score, the company’s score could improve substantially even if its business model and the legal and regulatory environment in the United States were to remain unchanged. If the company were simply to match the top-scoring company for each indicator in the Index, its overall score would rise by nearly 10 percentage points.

COMMITMENT – 78%

Google came in third place on disclosed commitments and mechanisms to implement them, behind Yahoo and Microsoft, whose disclosures were more clearly articulated and thorough. Our researchers found no evidence of board-level oversight of the company’s practices that affect users’ freedom of expression and privacy (C2). On human rights impact assessments (C4) the company ties with Microsoft but is overtaken by Yahoo. While Google’s grievance and remedy mechanisms are somewhat better than those of other U.S.-based Internet companies, Google falls behind the Internet company Kakao and the telecommunications companies Bharti Airtel, América Móvil, and Vodafone on articulating specific ways that stakeholders can communicate grievances to the company and see those grievances addressed (C6).

FREEDOM OF EXPRESSION – 68%

Google substantially outperformed all other companies in the Index on Freedom of Expression. The company was particularly strong in disclosing its process for responding to third-party requests to restrict content or restrict users’ access to the service (F6). “Transparency reporting” about government requests was also strong across the board (F7). Google was second only to Twitter in its process for notifying users about restrictions (F5) although the highest score for that indicator was only 50 percent.

Private requests for content restriction: The company could better disclose information about private requests to restrict content or access to services. While the company provides data for Google Search on requests related to copyright infringement and related to the “Right to be forgotten” ruling in Europe, it provides no data about private requests to restrict content on YouTube (F8).

Enforcement of terms of service: As with all companies evaluated in the Index, users and the public generally have no insight into the volume and nature of actions that Google initiates to enforce its own terms of service (F9).

PRIVACY – 57%

On disclosures related to privacy, Google finds itself at the top of a cluster of companies whose performance nonetheless remains unsatisfactory – despite some laudable efforts in particular areas such as transparency about government requests for user data.

Handling of user information: Along with its peers, Google generally suffered from lack of clarity and specificity in its disclosures related to the handling of user information (see Section 4.3) It performed substantially worse than its peers on disclosures about whether it collects user information from third parties (P8), and there is no evidence that it respects the “Do Not Track” standard that allows users to opt-out of certain types of web tracking. Its disclosure about the sharing of user information with third parties (P4) was much weaker than all other Internet companies except Mail.ru, (although no company scored higher than 51 percent on this indicator). It was surpassed by Twitter and Microsoft in disclosures about retention of user information (P7).

Transparency about requests for user data: On “transparency reporting” about third-party requests for user data (P11), Google placed second behind Twitter, with Yahoo close on its heels, for the range of its disclosure. Notably, while Google does notify users about requests for user data made through subpoenas in civil court cases (P10) its transparency report does not include data about requests from civil subpoenas that involve private parties. A concrete example is when Chevron issued subpoenas to several email services, including Gmail, in 2012 for information related to the accounts of several people involved in a lawsuit against the oil company. Google notified the users whose information had been requested about the subpoena (which it subsequently challenged in court). However data about that request, and other such requests made by private entities involved with litigation or otherwise, are not included in Google’s transparency report.

Security: Google is exemplary in its approach to educating users about security threats (P14). Its score on security standards (P12) was relatively high but could be improved with some basic disclosure about whether it regularly conducts security audits (information that Vodafone and AT&T have disclosed). It also lost points on that same indicator for vague and out-of-date disclosures about what systems it has in place to limit and monitor employee access to user information.

Encryption: On disclosure about whether the company enables users to encrypt their own content (P13), Google received partial credit. The “safer email” section of Google’s Transparency Report discusses PGP encryption (which users need to set up themselves, independently of Gmail’s features, using third-party tools) as an option for at-risk users. This disclosure acknowledges that users can encrypt their Gmail content, however, companies can only receive full credit on this indicator if they provide such encryption by default. Notably, the company’s page on “End-to-End Encryption” states that it is developing a new feature that would allow users to encrypt messages with a built-in option. Once such a feature is available to all users, the company could earn a higher score.