EFFector 17.12: Google's Gmail and Your Privacy - What's the Deal?

[Dave Farber <dave () farber net>]

For more information on EFF activities & alerts:
  <http://www.eff.org/>

To join EFF or make an additional donation:
  <https://secure.eff.org/>

EFF is a member-supported nonprofit.  Please sign up as a member today!

 : . : . : . : . : . : . : . : . : . : . : . : . : . : . : . : .


* Google's Gmail and Your Privacy - What's the Deal?

As you've no doubt already heard, Google's new "Gmail" beta email
service is raising concern about privacy protection.  How much
concern?  Well, it's not often that an email service is widely
misinterpreted as an April Fool's joke!

The basic concept: Google plans to offer you a gigabyte's worth
of email storage capacity - by one count, up to 500 times that
offered by its competitors.  But the company also intends to
scan the contents of your email messages in order to display
advertisements relevant to your online conversations.

Google's announcement last week of the new service sparked widespread
speculation about the possible impact Gmail would have on users'
privacy.  Among the questions EFF has been asking: What information
would Google pull from email?  Would it log this information?  For
how long?  Could your Gmail address or any other personal
identifier be linked to those logs - or to your Google search
history?

This week, we sat down with Google and got some preliminary
answers:

~ How Google Scans Your Email

The process happens instantaneously: Google scans your email
in order to target relevant ads the moment you click to open
a message.  The scan examines the text of the email you are
opening and extracts what Google calls "concepts" in order to
target relevant ads.  By the time the text of your email is
displayed, the ads have already been chosen and placed on the
same page.

~ No Log Made of "Concepts" Data

Google says that no record is created of the "concepts" extracted
from your email, nor is a log made of which ads are served to
you.  (Advertisers will see your IP address if you click
through an ad, but this is the way most ads work online.)

~ Your Gmail Email Address Can Be Linked to Your Search History

It is possible to link your email address to your search history
using your unique Google "cookie" - a bit of software code that
automatically allows both the Google search engine and Gmail to
"recognize" you whenever you return to the website.  Unless
you delete it, this cookie will remain on your computer's hard
drive for long enough to be effectively permanent.

While Google says that it doesn't currently correlate email
addresses with search history, we know that the company will
do so if required by law - e.g., if it receives a search
warrant, subpoena, etc.  For this reason, EFF strongly
recommends that Gmail users delete the Google cookie often.

~ What's Next?

Although some of our concerns have been addressed, others remain.
In next week's issue of EFFector, we'll discuss these concerns -
many of which would apply to any business offering a free
gigabyte of Web mail.

NYT article on Gmail:
<http://www.nytimes.com/2004/04/08/technology/circuits/08goog.html>
(Registration unfortunately required.)

EFF's weblog post on Gmail, including links to other relevant
news articles:
<http://blogs.eff.org/deeplinks/archives/001375.php#001375>

Gmail privacy policy:
<http://www.google.com/gmail/help/privacy.html>

 : . : . : . : . : . : . : . : . : . : . : . : . : . : . : . : .


* Comcast Tracks Websurfers, EFF Calls for Wipeout

San Francisco, CA - EFF filed a friend-of-the-court brief this
week asking a federal appeals court to overturn a district
court's ruling that Comcast Cable did not violate federal privacy
law when it secretly logged its customers' web-surfing habits.

At issue in the case is whether Comcast collected "personally
identifiable information" (PII).  The lower court found that
since Comcast covertly linked customers' online surfing patterns
to a particular computer IP address rather than to a name, the
company was not collecting personally identifiable information.
Yet Comcast could easily have matched the IP address to the
customer at any time.

"Taken to its logical conclusion, the district court's argument
would mean that even your phone number and address do not qualify
as personally identifiable information, since the information
cannot be used to identify you without additional information
from the phone book," said Kevin Bankston, EFF attorney and Equal
Justice Works/Bruce J. Ennis Fellow.  "Unless overturned, this
decision could render useless a number of federal privacy
statutes specifically written to safeguard information that
could be used to identify you."

EFF amicus brief in the case:
<http://www.eff.org/Privacy/20040408_Klimas_v_Comcast_Amicus_Brief.pdf>

-------------------------------------
You are subscribed as interesting-people () lists elistx com
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/