Digital platforms

Google, LLC

Rank: 4th
Score: 47%

Headquartered in the United States, Google is a subsidiary of Alphabet, Inc. The company offers some of the world's most popular internet services and products and has captured 92% of the search-engine market worldwide. More than two billion logged-in users visited YouTube, its video-sharing service, each month in 2021. Its email service, Gmail, had 1.8 billion users in 2020. Google derives most of its revenue from its targeted-advertising operations.

Yahoo2
54%
Google4
47%
Meta5
46%
Apple6
44%
Kakao6
44%
Yandex8
35%
Baidu9
28%
VK9
28%
Alibaba11
26%
Samsung11
26%
Amazon13
25%
Tencent13
25%

In 2021, Google’s dominant position as an agenda-setter for global information infrastructure and digital ad markets was on full display. The company moved ahead with plans to establish a data center in Saudi Arabia and to build a new cloud region in Israel. These moves drew criticism from company employees and human rights advocates alike, given both countries’ proven weaponization of digital surveillance against marginalized groups and political activists.

Google’s status in Russia since our last evaluation has been especially complicated. The company complied with requests from Russian regulators to censor information about opposition candidates ahead of elections in 2021. But following Russia’s invasion of Ukraine in early 2022, Google suspended ad sales in Russia on YouTube and Google Search, and it halted all payment-based services of YouTube and the Google Play store in Russia. The company offered no evidence that it had conducted human rights impact assessments prior to imposing these measures.

Google’s unique position in the digital ad market was also front and center in 2021. The company announced plans to stop using cookies to track users across the web, proposing an alternative known as FLoC, wherein users would be placed in interest-based groups and tracked at the group level. Although it was billed as a pro-privacy change, experts argued that FLoC could make privacy-invasive practices like fingerprinting easier to carry out. Our own team noted that it also could help to further strengthen Google’s grip on the digital ad market. FLoC soon elicited shareholder pressure against the company on privacy grounds, eventually resulting in Google’s decision to do away with the plan. This came several months after a group of state attorneys general in the U.S. filed an antitrust complaint against the company, alleging that it has engineered a quasi-monopoly over digital advertising markets, colluded with Facebook (now Meta) to control the market, and engaged in a host of related deceptive practices.

Google lost points this year in both our freedom of expression and privacy categories. In addition, the company did not engage with RDR during the company feedback phase of our research. Consistent with criticism noted above, we found that even when users set their browsers to eliminate online tracking (using “Do Not Track”), Google ignored these signals. It failed to give users clear guidance on how they can control Google’s use of their information, and failed to explain how it uses their data for targeted advertising. According to the company’s Privacy Policy, users’ browser types, search terms, and locations (derived from their IP addresses) may still be used for targeted advertising, even when users opt out of receiving targeted ads.

Key takeaways

  • Google offered no evidence that it conducted human rights impact assessments related to its own policy enforcement, its development and use of algorithmic systems, or its targeted-advertising policies and practices.
  • Google provided strong disclosures about its handling of government censorship demands but lacked transparency about how it responds to private requests. It did not commit to push back on overly broad private requests received for Android, Google Drive, and YouTube, and disclosed no information about how it handles such requests for Google Assistant.
  • Google provided users with insufficient tools to control the collection and inference of their information, or the use of their information for targeted-advertising purposes.
  • Google disclosed no policy for dealing with data breaches when they occur.

Key recommendations

  • Publish a commitment to uphold human rights in developing and using algorithms. Google should adopt human rights-centered principles and frameworks to guide the development and use of algorithmic systems.
  • Improve security policies. Google should adopt a strong and comprehensive policy on how it addresses data breaches when they occur, and should conduct and commission third-party security audits on its products and services.
  • Publish more data on actions taken to restrict content and accounts. Google should disclose data on actions it takes to enforce its rules on its search, email, cloud, and digital assistant services. It should also publish additional data on how it enforces its ad content and targeting rules. For example, it should disclose the total number of ads it restricts for violating these rules and indicate how many restrictions it enforced under each rule.

Services evaluated:

  • Google Search
  • Gmail
  • YouTube
  • Android mobile ecosystem
  • Google Drive
  • Google Assistant
  • Market cap: $1.69 trillion (as of April 13, 2022)
  • NasdaqGS: GOOGL
  • Stock structure: Multi-class. Class A shareholders receive one vote per share; Class B (insider) shareholders receive ten votes per share; Class C shareholders have no voting rights.
  • Read more about how stock structures can be a barrier to shareholder participation
  • Website: https://www.google.com
  • *In 2022, we evaluated Google Assistant for the first time.

The 2022 Big Tech Scorecard covers policies that were active on November 1, 2021. Policies that came into effect after November 1, 2021, were not evaluated for this ranking.

Scores reflect the average score across the services we evaluated, with each service weighted equally.

  • Lead researchers: Jie Zhang, Afef Abrougui

Changes since 2020

  • For the first time, Google disclosed that its board of directors oversees how company practices affect freedom of expression and information.
  • In the past, Google Search pledged to notify users when they searched for content that had been restricted or censored, and to explain the reason why it had been restricted. This promise disappeared from the relevant policy in 2021.
  • Google committed to provide Android security updates for at least five years to its Pixel 6 and Pixel 6 Pro phones.

Scores since 2017

100%0%2017201820192020202265%63%61%48%47%
Most companies’ scores dropped between 2019 and 2020 with the inclusion of our new indicators on targeted advertising and algorithmic systems. To learn more, please visit our Methodology development archive.
Governance56%
Freedom of expression44%
Privacy46%

We rank companies on their governance, and on their policies and practices affecting freedom of expression and privacy.

Governance 56%

Google offered no evidence that it conducted robust human rights due diligence on its use of algorithmic systems and targeted-advertising policies and practices (G4c,d). Although the company published a set of AI principles, these principles are not grounded in international human rights standards (G1), and thus are neither legally binding nor enforceable. While it enabled YouTube users to appeal content moderation actions, Google’s content moderation appeal mechanisms for Android and Google Assistant were reserved for developers wishing to challenge the rejection of their apps only. Regular users were not able to appeal content moderation decisions on either service (G6b).

Freedom of expression 44%

Google published data about content it restricted for violating its terms of service, but this data covered only YouTube and Android (F4a,b). Its data about the volume of ad content removed did not state the number of ads restricted according to the rule that was violated (F4c). It published a policy on the use of algorithmic systems explaining how its search-engine ranking results work (F1d, F12) and provided some generalized information about how the recommendation system of YouTube works, but it offered no such policy or information for the other services we evaluated (Gmail, Android mobile ecosystem, Google Drive, Google Assistant).

Privacy 46%

Google lacked transparency about what user data it shares (P4) and infers (P3b), and provided users with insufficient options to control their data (P7). Google provides information on how “Do Not Track” can be turned on for Google Chrome. However, the same page states the following: "Most websites and web services, including Google's, don't change their behavior when they receive a Do Not Track request" (P9.5). It scored especially poorly when it came to its security practices. While Google had systems in place to monitor and limit employee access to user information, it did not disclose whether it conducted security audits (P13), and disclosed no policy for dealing with data breaches when they occur (P15).