Key findings
- Google disclosed more about policies affecting freedom of expression and privacy than other internet and mobile ecosystem companies in the Index, although it still falls short in key areas.
- The company disclosed less than its Global Network Initiative (GNI) peers about implementation and oversight of its commitments to users’ rights, and lacked clear grievance and remedy mechanisms.
- Google improved disclosure of options users have to control their own information, and of how it tracks users across the internet. It disclosed options for users to opt out of targeted advertising, suggesting that targeted advertising is on by default.
Analysis
Google earned the highest score among internet and mobile ecosystem companies, disclosing more information about policies and practices affecting users’ freedom of expression and privacy than its peers. A member of the Global Network Initiative (GNI), Google made clear commitments to freedom of expression and privacy, despite gaps in implementation and oversight. The company improved disclosure of privacy-related policies by clarifying options users have to control what information the company collects about them, including whether the company tracks users across third-party websites. However, there is much room for improvement. Google could improve grievance and remedy options, in line with its GNI peers. It could disclose more comprehensive data about its terms of service enforcement. While Google disclosed more than any company in the Index about how it handles government requests for user information, U.S. law prohibiting companies from disclosing the exact number of government requests for stored and real-time user information prevented the company from being fully transparent about these types of requests.
- Do more to protect privacy. Google should do more to protect privacy by clarifying what information it collects, shares, and for what purpose, and committing to not share users’ information for advertising unless they opt in.
- Be transparent about policing of content. The company should disclose comprehensive data on content and account removals due to violations of the company’s terms of service.
- Provide better avenues for redress. The company should improve mechanisms for how users can submit complaints when they believe the company has violated their rights.
Google Inc. (a subsidiary of Alphabet Inc.) is a global technology company with services that include the Google search engine; Gmail, an email service; and YouTube, a video-sharing platform. It also provides consumer hardware products, and systems software, like its open-source mobile operating system, Android.
Governance
Google ranked fourth among internet and mobile ecosystem companies in the Governance category, disclosing less than all of its GNI peers. While it articulated a clear commitment to uphold users’ freedom of expression and privacy rights (G1), Google did not disclose evidence of board- or executive-level oversight over these issues (G2). The company committed to conduct human rights due diligence when entering new markets, but researchers were not able to locate evidence that it conducts assessments of risks associated with the processes and mechanisms used to enforce its terms of service (G4). There is also significant room for improvement in terms of the company’s grievance and remedy mechanisms when users believe their freedom of expression or privacy rights have been violated (G6).
Freedom of expression
Google placed second in this category, disclosing more about policies affecting freedom of expression than all other internet and mobile ecosystem companies, apart from Twitter.
Content and account restrictions: Google disclosed less than Twitter, Kakao, and Microsoft but more than the rest of its peers about its content moderation policies and practices (F3, F4, F8). It provided detailed information about what types of content and activities it prohibits, including some information about its processes for identifying content and activities that violate the company’s terms of service (F3). Google was one of four companies evaluated to disclose any data about content or accounts it restricted for terms of service violations, but this data is not comprehensive (F4).
Content and account restriction requests: Google disclosed more than any other internet and mobile ecosystem company about how it handles government and private requests to restrict content and accounts (F5-F7). Its transparency report included detailed data about government requests to restrict content or accounts (F6). However, Google’s disclosure of data about private requests was significantly less detailed than that of Kakao, Twitter, Microsoft, and Oath (F7).
Identity policy: While for Gmail, YouTube, and Google Play, users are not required to confirm their identity, app developers are required to do so (by making a small financial transaction).
Privacy
Google earned the highest privacy score among internet and mobile ecosystem companies, though it did not lead on all indicators.
Handling of user information: Google disclosed more than most of its peers other than Twitter about how it handles user information, but fell short in key areas. The company provided some information about what user information it collects (P3) but was less transparent than most of its peers about what it shares (P4). It improved disclosure of options users have to control information the company collects about them, including for the purposes of targeted advertising, which suggested that targeted advertising is on by default (P7). The company also clarified options users have to control whether and how it tracks users across third-party websites (P9).
Requests for user information: Google disclosed as much as Microsoft about how it handles government and private requests for user information (P10, P11). It demonstrated a clear commitment to challenge overbroad government requests, and provided clear examples and guidance of how it handles these requests. The company disclosed it notifies users when government officials request their information, but it was not clear about whether it does so in the case of private requests for user information (P12).
Security: Google disclosed more than any other internet and mobile ecosystem company about its security measures (P13-P18). It received full credit for disclosing that it has internal mechanisms in place to secure user information from unauthorized access (P13), and earned the highest score for disclosure of its encryption policies (P16). Like most companies, Google disclosed nothing about its notification and remedy policies in the event of a data breach (P15).
P7. Users’ control over their own user information
Google improved its disclosure of options users have to control the collection of some user information, including their location, search history and browsing activity.
P9. Collection of user information from third parties
Google improved its disclosure of how its Android mobile ecosystem tracks users across the internet and the purposes for doing so.
