Google ranked first in the 2017 Index. A founding member of the Global Network Initiative (GNI), Google outperformed all internet and mobile companies and received the highest score overall. For the first time, this year’s evaluation included Google’s Android mobile ecosystem, which outperformed Apple’s iOS and Samsung’s implementation of Android. But there is much room for improvement.
While Google bested all other companies in the Freedom of Expression and Privacy categories, it fell noticeably short in the Governance category, especially next to other GNI member companies. In addition, Google could significantly improve public disclosures about policies affecting its Android mobile ecosystem. Poor disclosure on the Android mobile ecosystem, relative to the other Google services evaluated, pulled down the company’s overall score. In addition, while Google performed well across most privacy indicators, the company could improve its disclosure related to how it collects, shares, and retains user information.
Google Inc. (a subsidiary of Alphabet Inc. since October 2015) is a global technology company that develops a range of products and services that facilitate discovery and management of information. Alongside its significant suite of consumer applications and devices, Google also provides advertising services, consumer hardware products, and systems software, like its open-source mobile operating system, Android.
Google ranked sixth out of the 22 companies evaluated in the Governance category. While Google articulated a clear commitment to upholding users’ freedom of expression and privacy rights (G1), it did not disclose evidence of board-level or even executive-level oversight over these issues within the company (G2). This marked a decline in clarity of disclosure about governance and accountability mechanisms across Google’s global operations since the company’s corporate restructuring under Alphabet. In addition, although Google committed to conduct human rights risk assessments when entering new markets, we found no evidence that it conducts assessments of risks associated with the processes and mechanisms used to enforce its terms of service (G4). It also had notably weak remedy and grievance mechanisms enabling users to submit complaints about infringements to their freedom of expression or privacy (G6).
Google was the top-performing internet and mobile company in the Freedom of Expression category.
Content and account restrictions: Google disclosed less than Twitter, Kakao, and Microsoft but more than the rest of its peers (F3, F4, F8). It provided detailed information about what types of content and activities are prohibited, including some information about its internal processes for identifying content and activities that violate the company’s terms of service (F3). Google was one of only three companies evaluated to disclose any information about content or accounts it restricts for terms of service violations (F4). In 2015, Google reported removing 92 million videos from YouTube for terms of services violations, but there has been no follow-up disclosure since or evidence of similar disclosures for other Google services evaluated.
Content and account restriction requests: Google disclosed more than any other company in the Index about how it handles government and private requests to restrict content and accounts (F5-F7). Its transparency report included detailed data about government requests to restrict content or accounts (F6). Notably, Google’s transparency report includes data on government requests to remove apps from Google Play. Google’s disclosure of private requests was significantly less detailed than that of Kakao, Twitter, Microsoft, and Yahoo (F7).
Identity policy: Google lost points on F11, which evaluates whether companies require users to verify their identity in order to use its services. While for Gmail, YouTube, and Google Play, users are not required to confirm their identity, app developers are required to do so (by making a small commercial transaction).
Google earned the highest score among internet and mobile companies in the Privacy category.
Handling of user information: Google performed poorly on a number of indicators related to disclosure of how it handles user information. The company provided some information about the user information it collects (P3), but was less transparent about what it shares and for how long it retains it (P4, P6). Laudably, Google disclosed more than any other company about options users have to obtain the information the company holds about them (P8).
Requests for user information: Google disclosed less than Microsoft and on par with Twitter about how it handles government and private requests for user information (P10, P11). It demonstrated a clear commitment to complying with government and private requests for user information only when prescribed by law, as well as to challenging overbroad requests.
Security: Google tied with Kakao and received full credit for disclosing internal security measures that limit access to user data (P13), and received the second-highest score for clear policies addressing security vulnerabilities, including having a bug bounty program (P14). Similar to most companies evaluated, Google disclosed nothing about how the company notifies users and other affected parties about data breaches and steps taken to mitigate damage (P15). But it earned the top score for clearly disclosing its encryption policies for each service, ahead of the second-best scoring companies on this indicator, Apple and Yandex (P16).
