Lawmakers chide Google for making you work to get out of its services

[The AchieVer]

Lawmakers chide Google for making you work to get out of its services

A senator describes Google's privacy policy: "You can hide a dead body in there and nobody would ever find it."

 

Senior privacy counsel for Google Will DeVries testifies during a hearing before the Senate Judiciary Committee.

Alex Wong/Getty Images

It's not easy finding privacy online -- and Congress members want to change that.

Lawmakers called out Google on Tuesday at a Senate hearing on data privacy, pointing out how many hoops average people need to jump through to stop the tech giant from tracking them.

 

Google lets people opt out of location and data tracking, and notes that people consent to providing their data by agreeing to its privacy policy. 

 

Sen. John Kennedy, a Republican from Louisiana, criticized Google's privacy policy, telling Will DeVries, the company's senior privacy counsel, that the average person doesn't read those documents.

"You can hide a dead body in there and nobody would ever find it," Kennedy said at the hearing.    

 

The hearing took a look at privacy legislation like the European Union's General Data Protection Regulation and California's Consumer Privacy Act, and how lawmakers in the US could create a bill that improves on existing laws.

The panel included representatives from Google, Intel, DuckDuckGo, Californians for Consumer Privacy and the Center for Democracy and Technology.

 

Congress has held multiple hearings on dataprivacy with tech giants and privacy advocates over the last year, with the hope of drafting a federal privacy law for the US. 

 

Multiple privacy scandals and data breaches involving tech giants have boosted momentum for regulation, but there are still arguments on how the law should work. 

 

The debate on Tuesday centered around opt-in versus opt-out consent.

 

"Our current notice and consent model is broken," Michelle Richardson, the Privacy and Data project director at the Center for Democracy and Technology, said in her opening remarks. "We need Congress to think much bigger and instead of keeping this model limping along, move the privacy burden back to where it belongs: the companies who collect and use our data."

 

Opt-in consent means you have to agree to all uses of your data before it's collected. The GDPR requires this, and that's why you were flooded with hundreds of "Privacy Policy update" emails last May.  

 

Opt-out consent is the current status quo, where people's data is collected by default if they use a service, forcing them to go to their privacy settings to shut off the data gathering. 

 

"There is significant evidence that defaults are sticky, and consumers rarely alter their default privacy settings," said Sen. Mazie Hirono, a Democrat from Hawaii. "The privacy regime should be an opt-in." 

 

Several lawmakers used Google as an example of how much data could be collected under default privacy settings. 

After DeVries told lawmakers that the data Google collects provides a benefit to users, Sen. Lindsey Graham, a Republican from South Carolina, asked for specifics.

The Google senior privacy counsel started explaining that Maps needs your location to provide accurate directions when Graham interjected, "The phone is off."

DeVries said that Android phones still need your location data to "perform basic functions."

 

Sen. Josh Hawley, a Republican from Missouri, described Google's location tracking on Android devices, citing a Vanderbilt University study that found its phones sent data about 14 times an hour. 

Google responded to the study from last August, arguing that the research contained "wildly misleading information." 

Hawley also cited a report finding that Android devices were storing location dataeven when Location History is disabled. 

 

"They think they can opt out of the tracking you're performing, but they can't meaningfully opt out," Hawley said. "It's kind of like that old Eagles song, 'You can check out anytime you like, but you can never leave.'"

 

DeVries admitted that Google should do a better job of explaining its location services and make its privacy policy clearer, but he didn't agree with opt-in consent for privacy regulation. 

Tech giants like Google, Intel and Apple have argued against opt-in consent, saying that it causes "click fatigue" and citing the GDPR as an example. 

 

After the GDPR came into effect, millions of people received hundreds of notifications asking them to opt-in to new privacy policies.

 

"I wouldn't want to overwhelm users by having opt-in for everything. I worry it would cause click fatigue, and people would just start agreeing to everything," DeVries said. 

 

David Hoffman, Intel's director of security policy, agreed, telling lawmakers that opt-in consent would put too much of a burden on people. 

In some cases, opt-in consent has become a "take it or leave it" approach, meaning that if you don't agree to provide your data, you won't be able to use the service. Privacy advocates warned against that, pointing out that the policy sometimes gives tech giants even more power. 

 

"The one in Europe is opt-in, and once you've opted in, the companies can sell your data, and that's my worry," said Alistair Mactaggart, the chief advocate behind California's Consumer Privacy Act. "Once you've opted-in, it's business as usual." 

 

Several other senators called for opt-in consent for data privacy, including Democratic Sen. Diane Feinstein from California and Republican Sen. Marsha Blackburn from Tennessee.

 

"I would like my privacy to be protected, and it seems to me that if somebody has a proposal, I should be able to say yes or no," Feinstein said. "I think the way one would know that they're protected is that they have to be able to opt in as opposed to opt out."

 

 

 

Source